MD5: c8d0396fa07cfcbaeced96a3cd0ab0e7
SHA1: aee048ac58e6f9a7cff2e95dfd167deda3a31dec
SHA256: 3209f04da2c2470c1498f67f45b5826d9a747d6e397a15602f1254366d141101
SSDeep: 24576:6scX5fMvV/ZBjE9EAp3eX/pzrUZYLYWbGF:lTjErp6hzrUeLlbI
Size: 944624 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: AirInstaller
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

6_Offer_7.exe:412
wmic.exe:340
SoundcloudDLD-PC_173913.en_88.exe:2868
SoundcloudDLD-PC_173913.en_88.exe:2952
regini.exe:2560
regsvr32.exe:2544
SoundcloudDLD-PC_173913.en_83.exe:2536
SoundcloudDLD-PC_173913.en_83.exe:1160

The MemScan injects its code into the following process(es):

f.exe:320
%original file name%.exe:1756

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process 6_Offer_7.exe:412 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SoundcloudDLD-PC_173913.en_83.exe (43880 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsj3.tmp (0 bytes)

The process f.exe:320 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ORWHWPUN\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CXMBYF23\jquery-ui.min[1].js (10194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHET21E3\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6_Offer_7.exe (91898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6HSVSTWR\dc[1].js (1657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6HSVSTWR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CXMBYF23\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CXMBYF23\DynamicOfferScreen[1].htm (1140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CXMBYF23\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ORWHWPUN\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6HSVSTWR\jquery.min[1].js (3307 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHET21E3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHET21E3\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHET21E3\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ORWHWPUN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ORWHWPUN\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CXMBYF23\Setup_product_2736[1].exe (162863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ORWHWPUN\button[1].png (458 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process wmic.exe:340 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process %original file name%.exe:1756 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsMad.dat (23779 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (11 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (0 bytes)

The process SoundcloudDLD-PC_173913.en_88.exe:2868 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\uninstall.bat (260 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\Uninstall_173913.bat (326 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe (0 bytes)

The process SoundcloudDLD-PC_173913.en_88.exe:2952 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoftwareUpdater_silent_9898_98.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{FDCFFECB-5ED7-44F8-84F7-E82F4DAD3A73} (5442 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{FDCFFECB-5ED7-44F8-84F7-E82F4DAD3A73} (0 bytes)

The process SoundcloudDLD-PC_173913.en_83.exe:2536 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{3945EF81-76E6-49B5-B2E0-C0260AF5EEF1} (15021 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_88.exe (15278 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{3945EF81-76E6-49B5-B2E0-C0260AF5EEF1} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{2C0304C5-80EA-4381-9497-1CD21F03D084} (0 bytes)

The process SoundcloudDLD-PC_173913.en_83.exe:1160 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{729DCC32-68A3-448C-8314-8F30A6446C1C} (274 bytes)
%Documents and Settings%\%current user%\Application Data\uninstall.bat (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{02DF25BF-148E-4FAF-B86B-92E2FD879988} (784 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\scripts\xpath.js (1202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{F64280D7-A435-4E9A-8CEB-240A7EB84BEB} (7 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\scripts\PC_173913.2.js (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{04246B01-1714-4BE3-BDBB-16C3814BE59E} (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{DAAF5541-F79A-4EAA-8EC6-1788003E9D31} (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{8581D34E-0A18-4199-8722-36B9D01668DD} (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{FB7729F2-25E0-4704-AE6F-9977663A5D69} (6584 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe (15116 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\scripts\json2.js (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{74ED8894-B157-45D6-8778-695A38E2AFB8} (113 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\FF_Plugin.21.xpi (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{85FDE9A7-5618-4EDC-A501-BA0362B41A71} (2392 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\scripts\main.js (1346 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\FF_Plugin.xpi (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C0495114-4C8F-4DA5-8992-62ECF1C0660F} (7 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\PCGizmosBHO.dll (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{87EB5210-EF5A-4C97-A6C2-DE1DCDA9E417} (1856 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\PCGizmosBHO.20.dll (1212 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\Uninstall_173913.bat (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{D760421C-83C5-489C-B21D-82B03F74D831} (7386 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\ssl.crt.pem (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{162F7CB7-BA17-4538-BFCC-0CE8E260916C} (274 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\libeay32.dll (7547 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\ssleay32.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{446C0175-A4E8-4794-989E-D06B6654740A} (6584 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\regddata.reg (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{F8CDEBF9-735A-4D18-A930-CD7DB22E6C85} (1856 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\libeay32.2.dll (15104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{E7522FD9-8F56-40A0-B668-492026DDA29A} (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{72F651D6-8983-447E-8F22-238BB99F6EB7} (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{15A93E2F-97FB-4BCA-B2A3-8B1B98986728} (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{5AB89244-878B-480A-92D3-6F24B3EED1E1} (2392 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\ssleay32.2.dll (2860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{8BF5225D-A9EA-444A-B3C3-8F7B3724E300} (113 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\scripts\base2-dom-fp.js (104 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{729DCC32-68A3-448C-8314-8F30A6446C1C} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{7115F0F1-B7A2-44DF-BB41-4ED79CAF3173} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{02DF25BF-148E-4FAF-B86B-92E2FD879988} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{F64280D7-A435-4E9A-8CEB-240A7EB84BEB} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{04246B01-1714-4BE3-BDBB-16C3814BE59E} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{DAAF5541-F79A-4EAA-8EC6-1788003E9D31} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{8581D34E-0A18-4199-8722-36B9D01668DD} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{FB7729F2-25E0-4704-AE6F-9977663A5D69} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{74ED8894-B157-45D6-8778-695A38E2AFB8} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{85FDE9A7-5618-4EDC-A501-BA0362B41A71} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C0495114-4C8F-4DA5-8992-62ECF1C0660F} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{87EB5210-EF5A-4C97-A6C2-DE1DCDA9E417} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{D760421C-83C5-489C-B21D-82B03F74D831} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{162F7CB7-BA17-4538-BFCC-0CE8E260916C} (0 bytes)
%Documents and Settings%\%current user%\Application Data\PC-Gizmos\regddata.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{F8CDEBF9-735A-4D18-A930-CD7DB22E6C85} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{E7522FD9-8F56-40A0-B668-492026DDA29A} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{446C0175-A4E8-4794-989E-D06B6654740A} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{15A93E2F-97FB-4BCA-B2A3-8B1B98986728} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{5AB89244-878B-480A-92D3-6F24B3EED1E1} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{8BF5225D-A9EA-444A-B3C3-8F7B3724E300} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{72F651D6-8983-447E-8F22-238BB99F6EB7} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0E563A29-454D-4BF3-9621-E00D0BC1585F} (0 bytes)

Registry activity

The process 6_Offer_7.exe:412 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 E1 29 EB ED B7 19 91 67 3E 63 FD 95 B4 B5 26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process f.exe:320 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121020141211]
"CachePrefix" = ":2014121020141211:"
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014121020141211\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121020141211]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 75 58 8C 96 BE 36 70 3F 0F 86 32 BC BD FF F3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121020141211]
"CacheRepair" = "0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121020141211]
"CacheLimit" = "8192"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wmic.exe:340 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 68 B9 1F 0C 59 0E 08 40 C6 43 87 02 32 35 43"

The process %original file name%.exe:1756 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 6E 18 FE 32 6F 38 D0 DD 4D E5 72 B0 79 5E E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process SoundcloudDLD-PC_173913.en_88.exe:2868 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\FF_Plugin.xpi, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\FF_Plugin.xpi, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\PCGizmosBHO.dll, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\PCGizmosBHO.dll, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\libeay32.dll, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\libeay32.dll, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\ssleay32.dll, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\ssleay32.dll, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\PC-Gizmos]
"CloseUpdaters" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 FB D6 3B ED 9F 00 6C 85 AC BC D0 21 B5 D4 FA"

[HKCU\Software\PC-Gizmos]
"ExePath" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_88.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"PC_GIZMOS" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_88.exe --update"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SoundcloudDLD-PC_173913.en_88.exe:2952 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKCU\Software\PC-Gizmos]
"InstallDate" = "65 9D 2B 8F FC 7F E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\PC-Gizmos]
"CloseUpdaters" = "0"

[HKCU\Software\PC-Gizmos\]
"SoftwareUpdater_silent_9898_98.exe" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\PC-Gizmos]
"NextUpdate" = "90951"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 91 77 C3 0D 55 CE F8 E5 C9 D5 85 64 A5 67 5D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"PC_GIZMOS" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_88.exe --update"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process regini.exe:2560 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 1D 9E 41 00 9B EE 83 32 AF 31 44 38 8D BF BA"

The process regsvr32.exe:2544 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 C0 9A 73 41 23 EA 21 6B 47 DB BA 9A 78 08 5C"

The process SoundcloudDLD-PC_173913.en_83.exe:2536 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\PC-Gizmos]
"CloseUpdaters" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\PC-Gizmos]
"NextUpdate" = "93891"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F DC 5A 15 60 24 07 E6 86 09 FC 7D D6 08 6C 95"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"PC_GIZMOS" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe --update"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The MemScan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundcloudDLD-PC_173913.en_83.exe"

The process SoundcloudDLD-PC_173913.en_83.exe:1160 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\FF_Plugin.xpi, \??\%Documents and Settings%\%current user%\Application Data\PC-Gizmos\FF_Plugin.xpi"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Gizmos 173913]
"DisplayVersion" = "83"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Gizmos 173913]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\Uninstall_173913.bat"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Gizmos 173913]
"DisplayName" = "SoundCloud Downloader"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\PC-Gizmos]
"UID" = "adm_{E4D0CB3A-A1D1-42FA-ABED-98032D0B6213}"
"FirstUpdateAfterInstall" = "1"
"NextUpdate" = "87325"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 E5 D9 93 90 9C 07 22 F3 CB 15 DE 9A BA A1 8F"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{A817C286-3D6B-4ECD-A99C-E44E50DBC523}" = ""

[HKCU\Software\PC-Gizmos]
"ExePath" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Gizmos 173913]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe"
"Publisher" = "PC Gizmos LTD"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"PC_GIZMOS" = "%Documents and Settings%\%current user%\Application Data\PC-Gizmos\SoundcloudDLD-PC_173913.en_83.exe --update"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"Timestamp"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: soundcloud
Product Version: 3.0
Legal Copyright: soundcloud
Legal Trademarks: soundcloud
Original Filename:
Internal Name:
File Version:
File Description: soundcloud
Comments: setup Installer
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 17
0056dd242a074de2635c262591d87cb8
04cbb2d1ef3ea93c21e1649c4d0211ed
a9b4574226ef01b58766bb5d8a1310e5
e569b8c6b39dfe36bd0dae8c28562a26
11ba29ba1363b398f0a22a2a2770d50a
0247feb18a68b19202397073000198cd
1820458cb2a3fecf3b8b5020fb7ba2e8
67c0a02a9b3445d2d0e5e48f98752264
128fc4d8eafe2e24b8c5b4655904bacc
59b54b6ba5badeb39923fa4784dceea4
45e798928a77b54b0b2e75004c01805b
dab46ad33a3209125dff028dd2c434a3
57578211b5602b8a15c880fea286d305
9aba159b7da4484b754335f8104d0c68
86f25137711af8a1d72a98f9b9e2c31e
463ce987c4251eea282096ec51cdc463
1797e6c3e22121e1d51dc920f8466621

URLs

URL	IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=1184&distid=3885&productid=2736&subpubid=-1&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&version=4.0
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/Files//Setup_product_2736.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://stats.l.doubleclick.net/dc.js
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=1184&distid=3885&productid=2736&subpubid=-1&campaignid=0&networkid=1&reqid=173755632&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&status=0&installedid=2736&offerscreenid=&offerorder=7&downloadduration=2469&installduration=47
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=173755632&x=y&clickid=10267063668f8f01a2c37189f89e82
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/scripts/SoundCloud_Downloader/FF_Plugin.21.xpi
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/base2-dom-fp.js
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/json2.js
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/scripts/SoundCloud_Downloader/PCGizmosBHO.20.dll
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/xpath.js
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/scripts/SoundCloud_Downloader/PC_173913.2.js
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/libeay32.2.dll
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/main.js
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/ssleay32.2.dll
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/common/ssl.crt.pem
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://dlrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://d1sx46e0q3eu7z.cloudfront.net/shared/static_pages/ThankYou.php?&productname=Sound Cloud
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://pagead.l.doubleclick.net/pagead/conversion/971710777/?random=1418239486743&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0
hxxp://ib.anycast.adnxs.com/tt?id=2280592&referrer=[REFERRER_URL]
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1418239480&bdh=jKIavHwT9QUnO4uP9FkKHkMQpOo.&bdref=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&bdtop=false&bdifs=2&id=2280592&referrer=[REFERRER_URL]
hxxp://www.google.com/ads/conversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3212534569	173.194.113.210
hxxp://www.google.com.ua/ads/conversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3212534569&ipr=y	173.194.113.216
hxxp://ams1.ib.adnxs.com/if?e=wqT_3QKgBKgXAgAAAgDWAAUI-LuipAUQyY7ej4_AmfgIGI-TvOXnrMKdXyABKi0JAAAABQIAEQUGDAAAABkBBRAAAPA_IQkJCAAAKREJsDCQmYsBOP4RQP4RSAJQ_fH1B1iBtxZgAGjQugJwAHis2QOAAQGKAQNVU0SSAQEG8FKYAawCoAH6AagBALABALgBAsABA8gBAtABANgBAOABAPABAIoCOnVmKCdhJywgMzQ1NTg5LCAxNDE4MjM5NDgwKTt1ZigncicsIDE2NjExNTgxLDIeAPBjkgKdASFDeDNWNGdqMWpZUUNFUDN4OVFjWUFDQ0J0eFl3QkRnQVFBUklfaEZRa0ptTEFWZ0FZTDhHYUFCd0EzZ0RnQUVEaUFFRGtBRUJtQUVCb0FFU3FBRURzQUVBdVFFQUFBQQkDCE1FQgkJAQE8REpBVWJXVzZqMzVQQV8yUREoIER3UC1BQkFQVQ0sKC4umgIdIWxRYklQOqAA8IFnYmNXSUFRLtgC7AjgAvvnDuoCT2h0dHA6Ly9pYi5hZG54cy5jb20vYm91bmNlPyUyRnR0JTNGaWQlM0QyMjgwNTkyJTI2cmVmZXJyZXIlM0QlNUJSRUZFUlJFUl9VUkwlNUSAAwCIAwGQAwCYAwCgAwGqAwCwAwC4AwDAA6wCyAMA&dlo=1&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D2280592%26referrer%3D%5BREFERRER_URL%5D	37.252.163.8
hxxp://a1961.g.akamai.net/ANX_async_usersync.js
hxxp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0	192.237.192.176
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://a1834.g1.akamai.net/js/widgets/clkL.min.js
hxxp://a1834.g1.akamai.net/styles/widget/static/theme2_template8.css
hxxp://a1834.g1.akamai.net/images/addons/icons/22171/Uniblue_freescan_EN1.jpg
hxxp://a1834.g1.akamai.net/images/widget/2/addon.png
hxxp://a1834.g1.akamai.net/images/widget/2/widget.png
hxxp://a1834.g1.akamai.net/images/widget/2/header.png
hxxp://a1834.g1.akamai.net/images/widget/button.png
hxxp://counter-817696455.us-east-1.elb.amazonaws.com/blank.gif?t=143736165251&h=b7a6b38bcd2c437fd987d8fa970dcfa0&cids=lkr
hxxp://ib.anycast.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://ib.anycast.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://pixel.ad.mlnadvertising.com/sync.ashx?partner=2591&psid=A1001&puid=6862088793012242831
hxxp://pixel.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A1001&puid=6862088793012242831
hxxp://ib.anycast.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://c.live.com.nsatc.net/c.gif?anx_uid=6862088793012242831&Red3=MSAN_pd
hxxp://ib.anycast.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2A0853F19B3D6619172654FD9F3D654B|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://updates.dnsomatic.com/
hxxp://d31daqvu7m7qwy.cloudfront.net/files/gizmos/exe/SoundcloudDLD-PC_173913.en_88.exe
hxxp://cdn.delivery51.com/js/widgets/clkL.min.js	87.245.202.67
hxxp://cdn.delivery51.com/images/widget/2/header.png	87.245.202.67
hxxp://google-analytics.com/__utm.gif?utmwv=5.3.4&utms=500&utmn=489171&utmhn=www.pc-gizmos.com&utmcs=UTF-8&utmsr=1138x640&utmvp=1124x213&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=11.3 r300&utmdt=Install&utmhid=2097570333&utmr=0&utmp=Error:0x0|83|WXP_P_|IE6.0.2900.5512_|&utmac=MO-31818336-1&utmcc=__utma=76134676.2829482533.1344257376.1344257376.1344257376.1;+__utmz=76134676.1344257376.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmip=37.57.16.189&utmu=qB	173.194.113.212
hxxp://counter.d.delivery51.com/blank.gif?t=143736165251&h=b7a6b38bcd2c437fd987d8fa970dcfa0&cids=lkr	54.243.56.0
hxxp://static.revenyou.com/offers/images/Theme8/button.png	198.232.124.224
hxxp://installer.apps-track.com/Installer/Flow?pubid=1184&distid=3885&productid=2736&subpubid=-1&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&version=4.0	54.225.159.229
hxxp://cdn.adnxs.com/ANX_async_usersync.js	87.245.202.10
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/scripts/SoundCloud_Downloader/FF_Plugin.21.xpi	54.192.46.157
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png	64.233.164.95
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js	64.233.164.95
hxxp://ib.adnxs.com/tt?id=2280592&referrer=[REFERRER_URL]	37.252.162.147
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/json2.js	54.192.46.157
hxxp://www.googleadservices.com/pagead/conversion.js	173.194.113.205
hxxp://ib.adnxs.com/a_usersync?cbfn=ANX_async_load	37.252.162.147
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css	64.233.164.95
hxxp://ib.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load	37.252.162.147
hxxp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]	37.252.162.147
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css	198.232.124.224
hxxp://cdn.delivery51.com/images/addons/icons/22171/Uniblue_freescan_EN1.jpg	87.245.202.67
hxxp://installer.apps-track.com/Installer/Track?pubid=1184&distid=3885&productid=2736&subpubid=-1&campaignid=0&networkid=1&reqid=173755632&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&status=0&installedid=2736&offerscreenid=&offerorder=7&downloadduration=2469&installduration=47	54.225.159.229
hxxp://google-analytics.com/__utm.gif?utmwv=5.3.4&utms=500&utmn=501656&utmhn=www.pc-gizmos.com&utmcs=UTF-8&utmsr=1138x640&utmvp=1124x213&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=11.3 r300&utmdt=ExeUpdate&utmhid=2097570333&utmr=0&utmp=Error:0x0|88|WXP_P_|IE6.0.2900.5512_|&utmac=MO-31818336-1&utmcc=__utma=76134676.2829482533.1344257376.1344257376.1344257376.1;+__utmz=76134676.1344257376.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmip=37.57.16.189&utmu=qB	173.194.113.212
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png	198.232.124.224
hxxp://updater.pc-gizmos.com/version.php?cmd=update&gizmoID=173913&days_ins=0	23.23.170.77
hxxp://ib.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load	37.252.162.147
hxxp://updater.pc-gizmos.com/version.php	23.23.170.77
hxxp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2A0853F19B3D6619172654FD9F3D654B|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")	37.252.162.147
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js	64.233.164.95
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/ssl.crt.pem	54.192.46.157
hxxp://cdn.delivery51.com/images/widget/button.png	87.245.202.67
hxxp://www.googleadservices.com/pagead/conversion/971710777/?random=1418239486743&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0	173.194.113.205
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js	64.233.164.95
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg	198.232.124.224
hxxp://cdn.delivery51.com/images/widget/2/addon.png	87.245.202.67
hxxp://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud	54.192.47.114
hxxp://stats.g.doubleclick.net/dc.js	74.125.205.154
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg	198.232.124.224
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/base2-dom-fp.js	54.192.46.157
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg	198.232.124.224
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/scripts/SoundCloud_Downloader/PC_173913.2.js	54.192.46.157
hxxp://updater.pc-gizmos.com/files/gizmos/auto-update/SoftwareUpdater_silent_9898_98.exe?gizmoID=173913&uid=adm_{E4D0CB3A-A1D1-42FA-ABED-98032D0B6213}&days_ins=0	23.23.170.77
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&	23.23.115.80
hxxp://updater.pc-gizmos.com/Get_Name?name=173913	23.23.170.77
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/libeay32.2.dll	54.192.46.157
hxxp://dl.revenyou.com/Files//Setup_product_2736.exe	198.232.124.224
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0	173.194.113.217
hxxp://cdn.delivery51.com/images/widget/2/widget.png	87.245.202.67
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/scripts/SoundCloud_Downloader/PCGizmosBHO.20.dll	54.192.46.157
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/ssleay32.2.dll	54.192.46.157
hxxp://c.bing.com/c.gif?anx_uid=6862088793012242831&Red3=MSAN_pd	207.46.194.10
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&	23.23.115.80
hxxp://installer.apps-track.com/Installer/TrackFinish?reqid=173755632&x=y&clickid=10267063668f8f01a2c37189f89e82	54.225.159.229
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1418239480&bdh=jKIavHwT9QUnO4uP9FkKHkMQpOo.&bdref=http://www.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&bdtop=false&bdifs=2&id=2280592&referrer=[REFERRER_URL]	37.252.162.147
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/exe/SoundcloudDLD-PC_173913.en_88.exe	54.192.46.157
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png	198.232.124.224
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/xpath.js	54.192.46.157
hxxp://myip.dnsomatic.com/	67.215.92.215
hxxp://cdn.updater.pc-gizmos.com/files/gizmos/common/main.js	54.192.46.157
hxxp://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0	54.225.159.229
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg	198.232.124.224
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png	64.233.164.95
hxxp://cdn.delivery51.com/styles/widget/static/theme2_template8.css	87.245.202.67
www.facebook.com	31.13.64.97

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE Double User-Agent (User-Agent User-Agent)
ET POLICY Internal Host Retrieving External IP via myip.dnsomatic.com - Possible Infection
ET MALWARE Possible Windows executable sent when remote host claims to send html content
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Traffic

GET /tt?id=2280592&referrer=[REFERRER_URL] HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Tue, 10-Mar-2015 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:40 GMT

Content-Length: 0
....


GET /bounce?/tt?id=2280592&referrer=[REFERRER_URL] HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=6862088793012242831; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:40 GMT

Content-Length: 1117
<html><head></head><body style="margin:0;padding:
0"><script>!function(){function n(n){try{if(!window.location.
ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.l
ength;o>r;r  )n.call(null,window.location.ancestorOrigins[r],r)}cat
ch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.
call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isT
op:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.p
ush({referrer:n.document.referrer||null,location:n.location.href||null
,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,i
sTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="
",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l&
gt;0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.
ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeUR
IComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write
('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1418239480&bdh=jK
IavHwT9QUnO4uP9FkKHkMQpOo.' c '&id=2280592&referrer=[REFERRER_URL]">
;</scr' 'ipt>')}();</script></body></html>nt>....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1418239480&bdh=jKIavHwT9QUnO4uP9FkKHkMQpOo.&bdref=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&bdtop=false&bdifs=2&id=2280592&referrer=[REFERRER_URL] HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=6862088793012242831; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChII_MUTEAoYASABKAEw-LuipAUQ-LuipAUYAA..; path=/; expires=Tue, 10-Mar-2015 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREg77LkSZ>y%%phwSNL8fRJuOEt; path=/; expires=Tue, 10-Mar-2015 19:24:40 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:40 GMT

Content-Length: 1174
if (typeof adnxs !== 'undefined' && typeof adnxs.richmedia !== 'undefi
ned') {adnxs.richmedia.setSize(300, 250);}document.write('<iframe f
rameborder="0" width="300" height="250" marginheight="0" marginwidth="
0" target="_blank" scrolling="no" src="hXXp://ams1.ib.adnxs.com/if?e=w
qT_3QKgBKgXAgAAAgDWAAUI-LuipAUQyY7ej4_AmfgIGI-TvOXnrMKdXyABKi0JAAAABQI
AEQUGDAAAABkBBRAAAPA_IQkJCAAAKREJsDCQmYsBOP4RQP4RSAJQ_fH1B1iBtxZgAGjQu
gJwAHis2QOAAQGKAQNVU0SSAQEG8FKYAawCoAH6AagBALABALgBAsABA8gBAtABANgBAOA
BAPABAIoCOnVmKCdhJywgMzQ1NTg5LCAxNDE4MjM5NDgwKTt1ZigncicsIDE2NjExNTgxL
DIeAPBjkgKdASFDeDNWNGdqMWpZUUNFUDN4OVFjWUFDQ0J0eFl3QkRnQVFBUklfaEZRa0p
tTEFWZ0FZTDhHYUFCd0EzZ0RnQUVEaUFFRGtBRUJtQUVCb0FFU3FBRURzQUVBdVFFQUFBQ
QkDCE1FQgkJAQE8REpBVWJXVzZqMzVQQV8yUREoIER3UC1BQkFQVQ0sKC4umgIdIWxRYkl
QOqAA8IFnYmNXSUFRLtgC7AjgAvvnDuoCT2h0dHA6Ly9pYi5hZG54cy5jb20vYm91bmNlP
yUyRnR0JTNGaWQlM0QyMjgwNTkyJTI2cmVmZXJyZXIlM0QlNUJSRUZFUlJFUl9VUkwlNUS
AAwCIAwGQAwCYAwCgAwGqAwCwAwC4AwDAA6wCyAMA&dlo=1&referrer=http://
ib.adnxs.com/bounce?%2Ftt%3Fid%3D2280592%26referrer%3D%2
55BREFERRER_URL%5D"></iframe>');document.write('<scr'   
'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ip
t>');....
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=6862088793012242831; sess=1; icu=ChII_MUTEAoYASABKAEw-LuipAUQ-LuipAUYAA..; anj=dTM7k!M4.NCxrEQDgEREg77LkSZ>y%%pk3y_nYA3@N4[-

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:44 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:44 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/8DYRWSDgEREg77LkSZ>y%%pghn_n^qK!9>)(:38=V-^orOIZh[%![wIXm`enn; path=/; expires=Tue, 10-Mar-2015 19:24:44 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:44 GMT

Content-Length: 124
ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=39136398759
4223&m=6862088793012242831", "c":9, "tagtype":"img"});HTTP/1.1 200 OK.
.Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires
: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/
w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo
 BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=6862
088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:44 GMT; domain
=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec
-2014 19:24:44 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k
!M4/8DYRWSDgEREg77LkSZ>y%%pghn_n^qK!9>)(:38=V-^orOIZh[%![wIXm`en
n; path=/; expires=Tue, 10-Mar-2015 19:24:44 GMT; domain=.adnxs.com; H
ttpOnly..Content-Type: application/javascript; charset=utf-8..Date: We
d, 10 Dec 2014 19:24:44 GMT..Content-Length: 124..ANX_async_load({"url
":"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=6862088793012
242831", "c":9, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=6862088793012242831; sess=1; icu=ChII_MUTEAoYASABKAEw-LuipAUQ-LuipAUYAA..; anj=dTM7k!M4/8DYRWSDgEREg77LkSZ>y%%pghn_n^qK!9>)(:38=V-^orOIZh[%![wIXm`enn

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:44 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:44 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.oEVNsVDgEREg77LkSZ>y%%pghn_n^qK!9>)(:38=V-^orOIZhYR>ilHCo8SzLE3GwLbgc2A; path=/; expires=Tue, 10-Mar-2015 19:24:44 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:44 GMT

Content-Length: 144
ANX_async_load({"url":"hXXp://pixel.ad.mlnadvertising.com/sync.ashx?pa
rtner=2591&psid=A1001&puid=6862088793012242831", "c":8, "tagtype":"img
"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragm
a: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="h
ttp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo
 OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Se
t-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 
19:24:44 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/;
 expires=Thu, 11-Dec-2014 19:24:44 GMT; domain=.adnxs.com; HttpOnly..S
et-Cookie: anj=dTM7k!M4.oEVNsVDgEREg77LkSZ>y%%pghn_n^qK!9>)(:38=
V-^orOIZhYR>ilHCo8SzLE3GwLbgc2A; path=/; expires=Tue, 10-Mar-2015 1
9:24:44 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/ja
vascript; charset=utf-8..Date: Wed, 10 Dec 2014 19:24:44 GMT..Content-
Length: 144..ANX_async_load({"url":"hXXp://pixel.ad.mlnadvertising.com
/sync.ashx?partner=2591&psid=A1001&puid=6862088793012242831", "c":8, "
tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=6862088793012242831; sess=1; icu=ChII_MUTEAoYASABKAEw-LuipAUQ-LuipAUYAA..; anj=dTM7k!M4.oEVNsVDgEREg77LkSZ>y%%pghn_n^qK!9>)(:38=V-^orOIZhYR>ilHCo8SzLE3GwLbgc2A

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:45 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.CxrEQDgEREg77LkSZ>y%%pl@C_n^qK!9>)(:38=V-^orOIZhYR>ilI-jyf:HFP6cYN#r<Q!5Zy(M2o9M; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:45 GMT

Content-Length: 118
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=686208879301224
2831&Red3=MSAN_pd", "c":7, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache
-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat,
 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/po
licy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS C
OM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=6862088793
012242831; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domain=.adnx
s.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 
19:24:45 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.C
xrEQDgEREg77LkSZ>y%%pl@C_n^qK!9>)(:38=V-^orOIZhYR>ilI-jyf:HFP
6cYN#r<Q!5Zy(M2o9M; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; 
domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; cha
rset=utf-8..Date: Wed, 10 Dec 2014 19:24:45 GMT..Content-Length: 118..
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=686208879301224
2831&Red3=MSAN_pd", "c":7, "tagtype":"iframe"});....
<<< skipped >>>

GET /pxj?bidder=108&action=SetMSCookies("MUID=2A0853F19B3D6619172654FD9F3D654B|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=6862088793012242831; sess=1; icu=ChII_MUTEAoYASABKAEw-LuipAUQ-LuipAUYAA..; anj=dTM7k!M41.CxrEQDgEREg77LkSZ>y%%pl@C_n^qK!9>)(:38=V-^orOIZhYR>ilI-jyf:HFP6cYN#r<Q!5Zy(M2o9M

Connection: Keep-Alive

Host: ib.adnxs.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=6862088793012242831; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24:45 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.CxrEQDgEREg77LkSZ>y%%pl@C_n^qK!9>)(:38=V-^orOIZhYR>ilI-jyf:HFP6cYN#r<Q!5Zy(M2o9M; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Wed, 10 Dec 2014 19:24:45 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=686208879301224
2831; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Thu, 11-Dec-2014 19:24
:45 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.CxrEQD
gEREg77LkSZ>y%%pl@C_n^qK!9>)(:38=V-^orOIZhYR>ilI-jyf:HFP6cYN#
r<Q!5Zy(M2o9M; path=/; expires=Tue, 10-Mar-2015 19:24:45 GMT; domai
n=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..D
ate: Wed, 10 Dec 2014 19:24:45 GMT..GIF89a.............!.......,......
[email protected]..;..
<<< skipped >>>

GET /Installer/Flow?pubid=1184&distid=3885&productid=2736&subpubid=-1&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&version=4.0 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:31 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 15345

Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"8 $.Fmkcsez_oajgRvjdo
"8.)0.*.LdcKct.5.FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zqa(ogbqRkfrrY
m^ZYph)vg`ociz.v.DKCTWGHA>F^IAACAI>.PIEPW?M=WUkvms]rrn]\kaeMnbtu
\j`UZjsrpapok`Zp`bgl|.w..AIBS^HOA<[email protected]>LDX\gnl\krpoqb
SmalrZpbV[esr\jolso`gl|.w.CDCVYKKC?GWH:AECMA QJ>OP?O?[XiqoYmm//-Rkf
rrYm^ZYcrpapo)-,fmv.x .CC@R]IIB=L]H9>AGK?.OODOO<KCYV`]rr`edlQl`s
sap`TWZ_ondiiqchw.z.BJAY]GG>:J\G@?HGI=.LMCNV=RCWT\pcpilahnNgamu^ldX
\_r]nhkbbodpz.t..FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zno`^r*j`ceQj^op_o_
[Xsu`]o&n^addpz.t.AIBS^HOA<[email protected]>LDX\ojf`1Ql`ssap`
TWjmk_7dpz.t..FH?X[LM>9GXK>=GENC.KJ?RT;QA\Zr]]lqb[q_hcnKj_rt[qa\
Zr]]lqb[q_hcn`ku.y.GGEWZDJ<[email protected]@SSAP@TWhkfa`)pjpkNhdqq`neZ
Wghbe^'ohuqchw.z..GGEWZDJ<[email protected]@SSAP@TWhkfa`)pjpkNhdqq`
neZWghbe^'ohuqch.% O_fGew1,.3 EEDU_JJ;<E]J;[email protected]@NEZWnd&a
mp;tf_vOodoo\kcYVue-td]rany.{.HI@QZEM@;K[M?>@DGC.MNBTU<J@UZjsrpa
pok`Zp`bRkfrrYm^ZYgxot_mln^_o]gdpz.t..FH?X[LM>9GXK>=GENC.KJ?RT;Q
A\ZdkoZpqmtnfQj^op_o_[XiqoYmmqrledpz.t.AIBS^HOA<[email protected]>
LDX\gnl\kr.,2Oodoo\kcYVhot_ml, 1ej{.|..@F>W\FN?AJZE<<FFHD.SMA
LR:PBV[]apo]hbqPiepw_m]WU_^lsamgn`ku.y.GGEWZDJ<[email protected]@SSAP@T
WZubmniefkKj_rt[qa\Z\o`lmj_glhnw.w..EEDU_JJ;<E]J;[email protected]@NEZWkr
^cq'o]gcNgamu^ldX\qr]`m m[fahnw.w.FH?X[LM>9GXK>=GENC.KJ?RT;Q
A\Zlgi^6Piepw_m]WUolhd4hnw.w..EEDU_JJ;<E]J;[email protected]@NEZWo`[qp_`n
cf`kNhdqq`neZWo`[qp_`ncf`kciz.v.DKCTWGHA>F^IAACAI>.PIEPW?M=W
<<< skipped >>>

GET /Installer/Track?pubid=1184&distid=3885&productid=2736&subpubid=-1&campaignid=0&networkid=1&reqid=173755632&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=&netv=&d1=-1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&status=0&installedid=2736&offerscreenid=&offerorder=7&downloadduration=2469&installduration=47 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:41 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK......


GET /Installer/TrackFinish?reqid=173755632&x=y&clickid=10267063668f8f01a2c37189f89e82 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:41 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive
..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html
; charset=utf-8..Date: Wed, 10 Dec 2014 19:24:41 GMT..Server: Microsof
t-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Po
wered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....

GET /widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QKgBKgXAgAAAgDWAAUI-LuipAUQyY7ej4_AmfgIGI-TvOXnrMKdXyABKi0JAAAABQIAEQUGDAAAABkBBRAAAPA_IQkJCAAAKREJsDCQmYsBOP4RQP4RSAJQ_fH1B1iBtxZgAGjQugJwAHis2QOAAQGKAQNVU0SSAQEG8FKYAawCoAH6AagBALABALgBAsABA8gBAtABANgBAOABAPABAIoCOnVmKCdhJywgMzQ1NTg5LCAxNDE4MjM5NDgwKTt1ZigncicsIDE2NjExNTgxLDIeAPBjkgKdASFDeDNWNGdqMWpZUUNFUDN4OVFjWUFDQ0J0eFl3QkRnQVFBUklfaEZRa0ptTEFWZ0FZTDhHYUFCd0EzZ0RnQUVEaUFFRGtBRUJtQUVCb0FFU3FBRURzQUVBdVFFQUFBQQkDCE1FQgkJAQE8REpBVWJXVzZqMzVQQV8yUREoIER3UC1BQkFQVQ0sKC4umgIdIWxRYklQOqAA8IFnYmNXSUFRLtgC7AjgAvvnDuoCT2h0dHA6Ly9pYi5hZG54cy5jb20vYm91bmNlPyUyRnR0JTNGaWQlM0QyMjgwNTkyJTI2cmVmZXJyZXIlM0QlNUJSRUZFUlJFUl9VUkwlNUSAAwCIAwGQAwCYAwCgAwGqAwCwAwC4AwDAA6wCyAMA&dlo=1&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D2280592%26referrer%3D%5BREFERRER_URL%5D

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Date: Wed, 10 Dec 2014 19:24:41 GMT

Connection: Keep-Alive

X-Powered-By: PHP/5.4.26-1~dotdeb.1

Content-Length: 1162
...........V[o.6.~.....X.*........K.....A....HIL(R!.8.....$V..{Z'..H..
..~<.........#T.R....?.. ..........}.8....A..5..[.$...}..WX[M0^.V..
.(...9.w.B..~.v.3..z..i....../....q.].2Bg;...[.G.....!*.e.....Y.\$....
].}./~..TY....<.*i...wr...KA,.0...E8h.....t...b.m......xi3..,.$%.=.
.e...T..B...e...l.....(.C.,AP.!..&Q8......-.*M..t..)I....[..w.....Q.4.
....N..O........f.?..Y2.Y4.G{.Q8....t...B..E.;..LM.ye....,.5..r.r.H.M.
.....'._...^.0..a;.J..k..........)..e.... .._...4g..T.|..p....Bpy.,H.U
Jj`'5..g.Z0S0f=Th.m....0`."N.-X...ee..;...m.;(...=.....&..Q.:[email protected]
..~It...W..{..S~.8.=.Y..ZI..m..,.1.1l.,F..M#....6....a.6).....|..%..7{
'.S.C.ai....K.....d.N..f...!%....w.;.7L:.........,^.^h...........;H.aW
(7P...K...OHz.k...R...$_..N...}.Ab'n...,,C;... .....s...z..9.7....%!..
.>...E^E...../....YA.....T^.S......?(./.G..4....z..&.*i.s18..a./$4.
%[d.1...8....U.!"..S.......U2...g..k..E.g.....8.....4...2....5j...es..
.ZV..../[email protected].....&x.s.....B....,/..........00k...U.....LY.T.
..p.9J.>d...6. .....N.rG.m.]...[.S..}....m...s..Y..nr..7..H.6...&..
.|kU...Y.74..tM..l.{=.S....Di.t..v.ff.{...wC....P.$.y............A....
!.K..$.Q. ....t....G.......X.......:..k....v............

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 10 Dec 2014 19:24:38 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 10 Dec 2014 19:24:39 GMT

Content-Type: image/png

Content-Length: 1914

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT

ETag: "36dd864c691ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 17 Dec 2014 19:24:39 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<...0PLTE.......................
.........................{.......IDATx......:..`..p..J.4.ty.:......)v.
.\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..].
.8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.
\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._.
.d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..&
gt;).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../
..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o
..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F
]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W
7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8..
......KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y.
.)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z
%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y.
..... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S..
...W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>[email protected])e
M.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J..
.,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.
*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.
J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....
X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 10 Dec 2014 19:24:39 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 10 Dec 2014 19:24:39 GMT

Content-Type: image/png

Content-Length: 921

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT

ETag: "f072da2a092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 17 Dec 2014 19:24:39 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...;IDATx..Z;o.1..Y.D...W."$=D..*[email protected].
...........;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.s
h..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[[email protected].
...y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?
7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.
......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K.....
...YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\
D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........
Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N.......
.*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..t
svP!.U0.q.......9z.e [email protected]............. .>=...{WVim...
.f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o
[email protected].^......IEND.B`.....


GET /offers/images/Theme8/button.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 10 Dec 2014 19:24:39 GMT

Content-Type: image/png

Content-Length: 458

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT

ETag: "1b5642f092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 17 Dec 2014 19:24:39 GMT

X-Cache: HIT

Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi.......
.../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f.
..p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C......
.$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....
-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^
.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`.HTTP/1.1 200 O
K..Date: Wed, 10 Dec 2014 19:24:39 GMT..Content-Type: image/png..Conte
nt-Length: 458..Connection: keep-alive..Cache-Control: max-age=604800.
.Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT..ETag: "1b5642f092ce1:0"
..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..Expires: Wed, 17 De
c 2014 19:24:39 GMT..X-Cache: HIT..Accept-Ranges: bytes...PNG........I
HDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx.
..1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<...
.....R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr...
.bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. ...
..%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u
.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._...
...rU.<Z`..d..E.|.0.......B.....IEND.B`...
<<< skipped >>>

GET /js/widgets/clkL.min.js HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Mon, 12 Aug 2013 15:00:20 GMT

ETag: "ecdb-252-4e3c1620c2900"

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Length: 348

Content-Type: application/javascript

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:43 GMT

Connection: keep-alive

Vary: Accept-Encoding
.............N.0...<.f..H!..).B.#...!.&...%U.vL[..dEk..5...c.....).
.1~.p8fl..0.T....{...". .....q$.....b.....<..HKf.Yz}...~...:..l..."
!...4....`..n.1.m..j........Xd...ak...b([email protected].*.3a..Y...&......*...
....V14..EA...j......P=...^[email protected]..............,..h,-.b.Ig.G.=.....k.
T=........>./...7.]....../..D.... ..F.q......Zo'....._..q.c!6..&...
C..R.......


GET /styles/widget/static/theme2_template8.css HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 11 Aug 2010 13:36:53 GMT

ETag: "204c7-1777-48d8c57b10740"

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Length: 1181

Content-Type: text/css

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:43 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........X.n.:.}. ...vW%%.4.<.O.....k.........m .......j..=..93s.
.....d......... ......`.......?H3.../[email protected]...>Wi..=..QBX....%.v.
{\!........7DN." .V...].S7Co.7M...U.Z^....`~..Ca.$!4... G&6..tj..p.)b.
..}T.....%[email protected]..... .j...A...QX......U.._B.u.........
..*..hk........q.....wA..g..V......yjG=......?\..`.QXC..=..{. ....k...
.;.n6W....iqNH...]..;....]..u..Wr..`.)....7........jq..tY...k>#....
..3^...}..2..:......H..9f....CWI....k.?.0....H5..G...8'T..^.g..F7.( =R
j....?...tsE3......"V...j.....,.|[email protected]/.W.aYw%.....9-".....x.3.Y.I.
)5..T.yi.....0..........d...=......n....;.!.w..8%...C.......|..$.....m
r....Y..rH\...........P .DIE...4'.#..H.S..{...0..DA.....GF......s.....
d0%.H 1../...^`o.6T....!..\O.`.........0.......7..../.d...p.b....q...F
.._U........6... ....^....CT..G-y.Y..y.Gk...O.........9...w...t...`.Z.
.2..VW(%...B..7..Z...P...-.........wg..(...5;.....Q..l........t...cH.i
........9...C.S3.MX.......I0`...".Q..a..<.....<.,.....N.D.p...W.
b....x...[........k.......I.... ~{..&..*..!..^.G.....f..A....@`..0....
r..".T......9q...p_.zA...F..-/0F.xn/...p.>cJ....k.u...Q{.K./.V. ...
.<T.&........os.....H...r._.J.............g..f...=..j.%..."0'8,.kJL
.....D..w.......
<<< skipped >>>

GET /images/widget/2/addon.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 27 May 2010 09:24:52 GMT

ETag: "201a2-22a-4878ff6786100"

Accept-Ranges: bytes

Content-Length: 554

Content-Type: image/png

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:44 GMT

Connection: keep-alive
.PNG........IHDR..............5.?....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE...........................................................
.........""H`.)7.:N#Jd.[x...(Ur.....="Ha....."%Oj........%.......*8.2A
.%1.%2......J_.l...3IDATx....Q...E.'(....3. .K....?..C8uj.8..9/....D..
..D...................................................................
..<B$k...-D.6.k.A$k....D.6.k.!R.!..I]{......M..o................"Y.
...... ..I]{...."Y...........H.&u...dmR...H...`m.6X......`m.6X....&u..
.$:...$...a%.iV.k5......._M.....Q........C.M._..0.@.....`.....IEND.B`.
....


GET /images/widget/2/header.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 01 Apr 2010 11:12:54 GMT

ETag: "201a3-1bb-4832af1b6d980"

Accept-Ranges: bytes

Content-Length: 443

Content-Type: image/png

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:44 GMT

Connection: keep-alive
.PNG........IHDR..............]'.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...`PLTE......m........Tw.............GGG0Zw444..................~.
.................................. Nln@..... tRNS.....................
...........\\......IDATx.\.... .E#....Z......%.........l;..y~.......t.
.'...........I.....!X.3S.0../..1Nu]W.vZw.@..._.'.X....Y.S.X..s#..9.k..
#r...v~H.Q.2;.*.......Qz..6{I.K.H..P..&<.).%.dO...C.t...Av....?L.n.
..T.6....%p.w..*.....IEND.B`.HTTP/1.1 200 OK..Server: Apache/2.2.16 (D
ebian)..Last-Modified: Thu, 01 Apr 2010 11:12:54 GMT..ETag: "201a3-1bb
-4832af1b6d980"..Accept-Ranges: bytes..Content-Length: 443..Content-Ty
pe: image/png..Cache-Control: max-age=43200..Date: Wed, 10 Dec 2014 19
:24:44 GMT..Connection: keep-alive...PNG........IHDR..............]'..
...tEXtSoftware.Adobe ImageReadyq.e<...`PLTE......m........Tw......
.......GGG0Zw444..................~...................................
 Nln@..... tRNS................................\\......IDATx.\.... .E#
....Z......%.........l;..y~.......t..'...........I.....!X.3S.0../..1Nu
]W.vZw.@..._.'.X....Y.S.X..s#..9.k..#r...v~H.Q.2;.*.......Qz..6{I.K.H.
.P..&<.).%.dO...C.t...Av....?L.n...T.6....%p.w..*.....IEND.B`...

GET /c.gif?anx_uid=6862088793012242831&Red3=MSAN_pd HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.bing.com

Connection: Keep-Alive

HTTP/1.1 302 Redirect

Cache-Control: private, no-cache, proxy-revalidate, no-store

Pragma: no-cache

Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2A0853F19B3D6619172654FD9F3D654B|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Wed, 10-Dec-2014 23:24:45 GMT; path=/;

Set-Cookie: MUID=2A0853F19B3D6619172654FD9F3D654B; domain=.bing.com; expires=Fri, 09-Dec-2016 19:24:45 GMT; path=/;

Set-Cookie: MR=0; domain=c.bing.com; expires=Mon, 08-Jun-2015 19:24:45 GMT; path=/;

Date: Wed, 10 Dec 2014 19:24:44 GMT

Content-Length: 0
HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalid
ate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bid
der=108&action=SetMSCookies("MUID=2A0853F19B3D6619172654FD9F3D654B
|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: 
Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IV
Do ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; e
xpires=Wed, 10-Dec-2014 23:24:45 GMT; path=/;..Set-Cookie: MUID=2A0853
F19B3D6619172654FD9F3D654B; domain=.bing.com; expires=Fri, 09-Dec-2016
 19:24:45 GMT; path=/;..Set-Cookie: MR=0; domain=c.bing.com; expires=M
on, 08-Jun-2015 19:24:45 GMT; path=/;..Date: Wed, 10 Dec 2014 19:24:44
 GMT..Content-Length: 0..

GET /__utm.gif?utmwv=5.3.4&utms=500&utmn=489171&utmhn=VVV.pc-gizmos.com&utmcs=UTF-8&utmsr=1138x640&utmvp=1124x213&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=11.3 r300&utmdt=Install&utmhid=2097570333&utmr=0&utmp=Error:0x0|83|WXP_P_|IE6.0.2900.5512_|&utmac=MO-31818336-1&utmcc=__utma=76134676.2829482533.1344257376.1344257376.1344257376.1;+__utmz=76134676.1344257376.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmip=37.57.16.189&utmu=qB HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: google-analytics.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Tue, 09 Dec 2014 05:54:17 GMT

Server: Golfe2

Content-Length: 35

Age: 135034

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;..

GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Wed, 10 Dec 2014 11:55:38 GMT

Expires: Thu, 10 Dec 2015 11:55:38 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33186

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 26945

Alternate-Protocol: 80:quic,p=0.02
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D..
 (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK
?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.
......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_.
..~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U.
.....r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x.
..C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......
o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m
...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F
..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.
y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rY
x..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.
p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.
j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`
..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..&
lt;.F..q5C..vR.iO)Z.(..&T..v.Z#.. [email protected]..
.=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd
.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...&l
t;.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o
{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...
,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=....
.P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....
<<< skipped >>>

GET /images/addons/icons/22171/Uniblue_freescan_EN1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 15 Jan 2014 16:20:57 GMT

ETag: "9610f-546-4f004b1996c40"

Accept-Ranges: bytes

Content-Length: 1350

Content-Type: image/jpeg

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:44 GMT

Connection: keep-alive
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((......&.&..".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?...I.5,.*..OA^I.o
.....i^...{.."...........'..1......ht.T}.i..vq..q......jue..7..<.&.
..r...oL..<.0G.....[k...4k.5...8......F.`OC.g.5....]......X..4l0...
#.... .m_...z|.Ke...d..B.0<`.(.#..\...O..Ta.9i!KY.....;..;..r.#...R
~F.....3W}...m>[.K.E..*.....h.[U.......I....*.Ly.......k...........
Y..9'....._I~......z......)k.o1l....IAH.....#.|.:...qT.....x.E......Z.
[email protected]"[email protected]._-...WFSu".Kd.!..>...y..M*9....y.
%.aIv...6q.....,.o...i..$.s....c..z{sX.M....ha.Qn.*j>.Un.?.C...iZ..
...<A.%..}.U?.\}..........IE%c....Y......{gk.n`......9....<W..|'
.~..%......1A..|....RqR..G.V.....8.S....(..g..........0 g..L.g.4?..y:5
.I.bK.>id...........].7..8.LTj...v..h....?......
<<< skipped >>>

GET /images/widget/2/widget.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 27 May 2010 09:24:52 GMT

ETag: "201a5-21f-4878ff6786100"

Accept-Ranges: bytes

Content-Length: 543

Content-Type: image/png

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:44 GMT

Connection: keep-alive
.PNG........IHDR.......d.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...oPLTE)Wu(Vt&Tr.Vp$Rp Nl.A_.=[.;Y.Ig"Pn0Xr.?].Db.B`#Qo.Ge/Wq.@^.C
a.>\.<Z.Hf.Jh%Sq!Om.Ec.Fd'Us.Lj.Mk.Ki-Uo.:X.9W,Tn...&......%tRNS
.....................................?.BO....IDATx....m.P....33.....w.
S..L..g.o.Yk....9. c.........Ms.[..S..k..}.26...!hn h. h.!h^ h.!h.!h. 
h. h> h. h.!h. ..4.~..9....... c.....f...Ms.W..-.26.........gK..[/g
..z36...c....`l06..c....`l06..c....`l06..c....`l....c....`l....c....`l
....c....`[email protected]`.t>....


GET /images/widget/button.png HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 11 Mar 2010 15:16:22 GMT

ETag: "c981-3fd-48187e5c05d80"

Accept-Ranges: bytes

Content-Length: 1021

Content-Type: image/png

Cache-Control: max-age=43200

Date: Wed, 10 Dec 2014 19:24:44 GMT

Connection: keep-alive
.PNG........IHDR...,...,.......u.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE.....MV..k.*.....k~.:...D..K|.S.)a..9r.9.......WS.....6....
....{[email protected]..:.#l.D|.6E....F3..j.$"d._..S..P../..p.-[."..IB..
..`r.3g.Em.6m..K..0....I...`.$...U..g..{.[^.1l.XW....~N..Y..I..p.I"].g
.&...7..h.&...e. Z..Q..X..(z.U.?...W.A?r.5..e....ls.;@..c. T......<
n....XtRNS............................................................
............................x......'IDATx...[[email protected] ..........4
m=.....h..7qs.:.m.....Ln.............bVCI Q..p.;.7..~....c..D...L...T.
...N\...s.B).-D,....L7"..>..N.B.........i.........=.r,b...S‰..)#c
....R/.... ...W.X.M.0...c.W....GK.~......m.h8..K.vnAbd...fF....)qtPX'.
u.7.D.#..../..a.I.,,7.H.Q.\?.HG*jUi.....6... -..K.....M..F...2...3....
9......g...P3.......;..[.#X....t...Q...t.._....C..~..B/"...A.}...>|
.....\...8.<...!H.s.......7 5.4._$^d....Pl<.Y/!.U....3.....]....
j...(V.4Oc...Y......L......... ........3{H"........m..D....4.UZX.t....
..;...$....g....d.&..g.d`...B6.X...?......{...k....IEND.B`.HTTP/1.1 20
0 OK..Server: Apache/2.2.16 (Debian)..Last-Modified: Thu, 11 Mar 2010 
15:16:22 GMT..ETag: "c981-3fd-48187e5c05d80"..Accept-Ranges: bytes..Co
ntent-Length: 1021..Content-Type: image/png..Cache-Control: max-age=43
200..Date: Wed, 10 Dec 2014 19:24:44 GMT..Connection: keep-alive...PNG
........IHDR...,...,.......u.....tEXtSoftware.Adobe ImageReadyq.e<.
...PLTE.....MV..k.*.....k~.:...D..K|.S.)a..9r.9.......WS.....6........
{[email protected]..:.#l.D|.6E....F3..j.$"d._..S..P../..p.-[."..IB..
<<< skipped >>>

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 10 Dec 2014 19:24:34 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 10 Dec 2014 19:24:34 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>..HTTP/1.1 404 Not Found..Date: Wed, 10 Dec 2014 19:24:34 GMT..Co
ntent-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 4968263566528690459

Date: Wed, 10 Dec 2014 05:54:29 GMT

Expires: Thu, 11 Dec 2014 05:54:29 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4131

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 48611

Alternate-Protocol: 80:quic,p=0.002
...........Z.r.8.....PS21b(..3{D..\<..$q6q&{V.q.$(2.H.II.-..v.....l
.V.(....@_...y....8....'.9.. .oYI...f..R.^.[........0fS...~;A.f<r..
U..;..l.D.c.X.<.r...c[8....X&q...F.... ....C.K.0U.t....of .[....`..
H...D..-...K2B..3..#...^...t..t...x...].$..H.a`.p;..n{.F.`.>..R._..
/.m..7..$..U.T.<..0.......:.$.....h..."..Jq.;y.aC..)....p..w.......
.ZO...^.hR.@.:.>R".....S..\.t..z.......u>ug..s....F*..,.sB..np.=
_.({....D2yL..U..t.MY.._..z.*.TD.8........xX.i.'66u?p]....e".....GX^.b
3>.M....m...=.0...d<..-7..}.u.O"d...wz...Xm.LlF.Z...<..2~B..W
.m]....4`..H u..=..%.1..f...5-..=.......L..:].5u...Q].5...^.....<3.
..6........T..=......^.4.J1...v...-A..]`..\7...%OR.k...fGA.....vk.r8.3
>....`.........?.........xoEc./.....:..,N.q.R....2V.H^.Al.......e'.
.v......&}.^.]vo.m....N..,9.....>.,o......?k.....9.8...N8.1.s.a2.g.
.x#.7<.....B"[W.........1.u...].....coz......Q...`.E.B...zo.P'..cn.
.A....X...5.f}.]..E....rmk.1J.M.t:.....*[email protected].?..?...S.
qj...2... ...7v .D.../..bW.s.j.54.NTl......R.w..FDb8l:.d.3......Pw.O.r
.4...}.Z..MU.i.>.g3TB.7...?..8....(~..q'...B..1...C....I....%h.....
.<...C.Xh4.$.5.8.8...%w..qDb...D..R".....<...-..........W".<j
.O..g..''..;.g....ao..g|*)^.......Cg.er..}.qe].?..K.....c.p..*........
.[.%~u.q...*\[email protected]..... ....r..B........7.{g..2..$.-u.
.q.P.b.#...RYm..{c.^...s..u.su../.......GT.....>.t...b..8.UV0.f..k.
.....2|.......BV'(@~..`d...P....^....1....YK...B.....C...W|..k...BwV.@
!....L...l...a.Xq.'...R..7..2?.Ws.h....[...........r...8~.DA&.iI_.
<<< skipped >>>

GET /pagead/conversion/971710777/?random=1418239486743&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Wed, 10 Dec 2014 19:24:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?...HTTP/1.1 302 Found..P3P: policyref="hXXp://VVV.googleadservices.
com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC".
.Date: Wed, 10 Dec 2014 19:24:40 GMT..Pragma: no-cache..Expires: Fri, 
01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Lo
cation: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversio
n/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&valu
e=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=12
76&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm
=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php%
3F&productname=Sound Cloud&ref=http://installer.apps-track.com
/installer/thankyou?productid=2736&pubid=1184&distid=3885%
26countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2
&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CA
AAA&ct_cookie_present=false&convclickts=0..Content-Type: text/html; ch
arset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..
Server: cafe..Content-Length: 76..X-XSS-Protection: 1; mode=block..Alt
ernate-Protocol: 80:quic,p=0.002..............(....I.O.T(...I.UJJL.N/.
/.K.M.../.*)J. .H,J. Q......R`....h.?.....
<<< skipped >>>

GET /Files//Setup_product_2736.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dl.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 10 Dec 2014 19:24:32 GMT

Content-Type: application/octet-stream

Content-Length: 1071758

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Tue, 10 Dec 2013 06:31:48 GMT

ETag: "7f35ed8071f5ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 17 Dec 2014 19:24:32 GMT

X-Cache: MISS

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
...p..................................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
.......p.......z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /blank.gif?t=143736165251&h=b7a6b38bcd2c437fd987d8fa970dcfa0&cids=lkr HTTP/1.1

Accept: */*

Referer: hXXp://d.delivery51.com/widget/render/hash/b7a6b38bcd2c437fd987d8fa970dcfa0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.d.delivery51.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Date: Wed, 10 Dec 2014 19:24:44 GMT

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Server: nginx/1.2.1

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Content-Ty
pe: image/gif..Date: Wed, 10 Dec 2014 19:24:44 GMT..Last-Modified: Mon
, 28 Sep 1970 06:00:00 GMT..Server: nginx/1.2.1..Content-Length: 43..C
onnection: keep-alive..GIF89a.............!.......,...........L..;..

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 10 Dec 2014 18:52:00 GMT

Expires: Wed, 10 Dec 2014 19:52:00 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6091

X-XSS-Protection: 1; mode=block

Age: 1953

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.02
[email protected]..~...e.#K.$.#A..=.!%J|iz...
;@Z.:...y..}..........X.H~{G...O~......-.M^[email protected]........
....!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.W
O8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h
.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ....
....... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}..
.t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>.....
.|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8
a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}[email protected]^...S2.gn.h......;V.
yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or
..%X...78.I.>[email protected].<.W 
EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M..
. ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k
:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<
;._.. J.YK.:9.H}3....U.B..$..W..f$l]^[email protected].,(."
......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V
.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l
..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v.
.~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4..
.1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!
pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t..
.M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 10 Dec 2014 19:16:57 GMT

Expires: Wed, 10 Dec 2014 20:16:57 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 51558

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 456

Alternate-Protocol: 80:quic,p=0.02
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...A
P...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3.
.................E1.-.uz..........ZXI..rZm....../[email protected].....
.yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....
&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,...
...j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.
O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,[email protected]...
..l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xv
rR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9.
.S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvI
o^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._
...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../....
_.........4..s........x..z|...^|.../.._..?.z..............?.......?=..
....N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z
...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y.
...c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3.....
...Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.
n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T..
...D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\[email protected]......
\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.
....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!V
o........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 10 Dec 2014 19:12:19 GMT

Expires: Wed, 10 Dec 2014 20:12:19 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3457

X-XSS-Protection: 1; mode=block

Age: 734

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.02
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B.
...6...._.d.c.......*...V......|U.......w-...p..>Z..........`......
......`............`............`............`............`...........
.`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.
x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1
..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."..
.-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C....
.y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ
..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH
...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._&l
t;....p.p....`............`..b.......:............:.............Xj)...
w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7...
..;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:
.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O..
...m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....
3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD.
.M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;
....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n
.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x....
.].?/..9r......h...]^}M....<....;..........p.p....`........}.....n.
.~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M...
...j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....
<<< skipped >>>

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 10 Dec 2014 17:57:38 GMT

Expires: Wed, 10 Dec 2014 19:57:38 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15853

Cache-Control: public, max-age=7200

Age: 5216

Alternate-Protocol: 80:quic,p=0.02
...........={_.:...)....'.$..&.......-..Ms..e9..'...B.g.3#..........3z
?F........z....n.h..@&b.....v.W.A"...<8H.^.....A*......3....~..X?8.
...<..t..)d.......Hf.Q...._. .,`.....a....>...?...v.Aq.G........
.p.........a$y&.....sX7p........ ..M.d..l.K.....t...8..i6....C..XO....
.@....!.....RG.l .}....b$c..B|8..C}!.8..=.e.K....{..K.9..a..nx......%.
.;..F...J...v..n!.L.....g.C@...~..|...=....q.9n_...P.....Tw.o.........
..k.....^:.....O!..b......=...B..,..j8......k.b./.Y..JE...({k.........
(.L..@. ...b;...s.f...k../--..\..A.M..he.q..u.u.$..<.....$......eBf
....,...r{.[.....h....Tup..$?F?2.... .qk...x..;.......}.Y.[)jL........
.}.4.'..Z_...bms.._..I4.r=...f....U}...|......].FG..\.[9...hp......"..
L..J...a..l.=.C..c.............i..2&.......{....T*w..%#ey....A..`.T..Q
.w.....f2...,....J...y.qqA.........BTo....5.W..9]...]b$K%Z.V..b..x1t..
..]..&.P.Qo.A?..W.R..l.........'".. ..D. ..EA.......$US.t...w?.u*rn.:.
.....?...a,.(..0....`.GL....Z...j[8.[.2k8N...4(.x..4j&..V..p.N)0.;k...
....C..= .].;M.|..&..;........M'....Vy.6*..[J.7`n*...Q..O.%4T ...;....
.'J.........xKK.&..^A...;...........a<.783[X......p...c...3j$.....Z
....c.D.....BW................*.1]KQ].zb.... .?~....V>&."..Q$.....&
.sS..Kq........).....{y.V....T...L.09.-.KK:..yH.....4./..Ni.oaM..X..X.
R...l...[...n2.....6.v.Q.......v.C.0........55..z]__.a.j...fJh.....r.6
a.6v3..!.}^0...,...I.w........i.......Q..q ..c;2.p2 .%..:0..14....z...
.b.*Z..*..>...v].....H...V...kVT.]....I ...._..}.f.....^U..a.V]..wd
.N.....9....n1-0..`...B..Q.MB...7...%.!.L~.."H..xNV`?||.H.........
<<< skipped >>>

GET /files/gizmos/common/base2-dom-fp.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 17219

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AG3AKaPPJFX0hva1t8jLt4U0wCnGhVGqLmKvmI2cRWrpebwvOmrGFQ==
...........}i..G..w..(.R)..$.cp.k.....k.3.. Nm,.40@Kj..._,.V......y^..
.\###"#"#....T.h.. ..d..[.&.m..l~s.n.ZA.e.-*....:[email protected]....
..jP%........*[l...$./...|..{.i...........R/...z..n..M.. ....:..3Zl...
.G./>Dk.j.[D7Y.../...7.......:.g.V..v.......(..&Y.,.z.m.z........&[
G1<..V...|.%[.'.-...^../.l<[di..v>..Mg....6.~..Po...&...A.m.`
0./.h.....*J......>V........;...9...T;<,.GP............. ....:..
...-$..X/w!.|...pqz.^(y..9l......C.....a..`3.<j..'a..OT.Wa.........
..Q....?.....Wac..k...f.3hD.1...A..4.......,qvo..u/........<~..../c
o([.:..|...$..j <.C..l......^m.m.h..............o.{#....5O...Otv...
A. ..&l..W...:......r{.......(.....(..#....j...|).S....W..k.....Q6....
(.....G#.8.#.)6..rI....]h<...m.H.$.D7....JIMT4....x3...#))H...V.0..
.XE.-$G.~.....F:..-I....i=Z..wTs. .#()w.`....A....0H.....g...;^.}Z-...
.$B...!..~..z.H.7 /AwL...5......0c.COM...q}..m.......y...p.#A..%.B....
...8N...<[L...M.........].!.....$.f>..C@=....26."M]Fk99BW4.1....
.i.F]...V....C0.Y.3..S5...k9.Da../..Ead`y..t........:I.C...L9P.`..p,..
.i...o> Q?;...P..^/..h....s...J.Gi....J.|.].N.#[email protected].
.....\[email protected]/.P.9..D. d.L..@=.[.>.|...."p.... X.....Y.
{.XOUT....;..aN~9Gc*y.0.P.u]..MDm.-&&../...........y...t.B..|.y.WKj^..
..!.P...!e.z0J.5.8L.Z..jVS84B.)S.|...f...=...-...P. ........,.....b1..
......!........^0.zhIX...........V.K......,..As. $.H.6.9,L.%).0..I..~.
..... .....<...}x...C.......^ ...Y.tE..Wn.......@K$......C(.H6.X.x.
..X..^?m.Z..jG.....u.(.Q.%.P...H..XJ....\.d.5......|(I.....R~a....
<<< skipped >>>

GET /files/gizmos/scripts/SoundCloud_Downloader/PCGizmosBHO.20.dll HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 113152

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 10:20:58 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:12 GMT

Server: Apache

X-Cache: RefreshHit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HgZXAMKGEOwaVCCLietVsJefiipO6a8O55j-goaPtYvf8py1HYeJuA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........F........
.....LE......LG......LD.......!.......4.......6...............3......O
[email protected]....................
PE..L...}.UR...........!......................... ....................
........... ............@......................... .......$w..........
............................0"..8...........................x\..@.....
....... ...............................text...........................
.... ..`.rdata...`... ...b..................@[email protected]
[email protected]...............................@[email protected]..."..
[email protected]..........................................
......................................................................
......................................................................
......................................................................
............................................VW...W.....~..)...5.......
...f.........~..)..f.......;.s!..$........t..@ j............;.r..._^..
[email protected][email protected](......| ....u!
... ....~...........y..........^..F.$.....^.....................V.5...
.W..;.s.....t..@ j............;.r......w.t0....t.V......G......O(..t..
.Q.P..G.P..x ........_^........1..T!..........U..V...u....E..t.V..q...
....^]..................U...E.h.$....h.$..P.Q.].........U..S.].V..u.SS
j.h....... ...s...t.W.v......~.V.=q.........u._^.C.....[].........
<<< skipped >>>

GET /files/gizmos/scripts/SoundCloud_Downloader/PC_173913.2.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 4269

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Wed, 10 Dec 2014 07:38:52 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:13 GMT

Server: Apache

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _5XLjIHlEW_GiOdQF7j5DMLsdLP2UfSXZBkc7IIbiW2yCkCyV6AD6w==
............ks.6..2... .H.$R.c..L..hZw.$W.w7S.4..I.).GP.....v..K..m...
..$.X.b..d...~.,>qb/J,....$...9#..$\.....\r.^.~h.,. yd;.<..&;.E2
....O.,....e\..........nJ.,I..i^^^...98.p...r-<.......j...s..~zF...
.n.6d.,.L..7...........\;a..9....<......7e.)W.......3?..z.[..m#..b6
.2.B.|...'.vLN..G..`..s...d....^....p......;g.."I@([email protected]
..<..S/.&.3.Y.v....r.nc...;._.*7....a..!g.kMl.3...K`..$......K.MfV.
[email protected]:..&..8c.f.%F;..\..j......t7^om....(.}/.Z4
.)..1.c...].N.>..l..a.I.J=.....s]... }..GWC"g............{.Y.,-...F
[email protected]. ..>.3.a8...[...{..mnou7.........f
...S........ `.......Z4kOW.1$..g.'..ww.'q.Lw?.......U.....@_.c..wL..?.
Vi.Z.R_^su...0.\..ijf$-H.1...\..8..9..y ..,[email protected].............
...ol4..H=.H. [email protected]........./ %..}0...;..$...~7L.h....v.69...
.2..No....w&.........6....,...M8.`...7..'...P.....)2..........l.....p:
[email protected].|...........:G....o..&.K....%LA..#.......D1.].t...
;.?...Q:v2...V2X.dF...`[email protected]...=.P........m.w7)!!.B.9.}...
...1e..>......8....i.i.t.R2...jvZ.....p.c...D.....0Y......CXj4.>
.Z{......<q....$..S.. e.3#...?..;[email protected].*@B...F.,b.9-..Kr.
YA......`wH.7i...V./0V.Z....9 .X..F)$7..Qj."8K...-.m.it...D..d.....~V.
.J....b.u..R..j...PF..<@...BN.r.#Gtp.....= a....6|.L..vHO,..S.b.?..
.p.. FY.U..f.@.. ....t.=z0K....jII"[email protected]...
.L.:...F..$..g#..#..J3...._..U.Ub.R...(/.CQ&......|.po.>8........#.
:..>a:..I...N.."){..d4..6..>.'....?.......{V.K,.X...&C.V.!z.
<<< skipped >>>

GET /files/gizmos/common/main.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 45905

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 08:27:36 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: VsXzh6IPoQ9Xo6eH7DUOnyEAudAWDPgcHXZ7BqWFoTp9qp0h5Ckmpg==
............yw.8.8...9'..a.DR.Y..N.(..,...v..2.{|(...S................
...r....].......BU...........S?.E...a..^........Y..;.~..fz. FPZ.F.q...
..7.2^....B.F..8...........K.q(.x.A.K.`.zX.....{....j.N.X..G...?.Ro..D
...Ow.F.....t.'......5..x8.Oc?..)e........p..b....i(degO.;...........=
.'n.....z<.!h`......;..D].q34d...o.Ww..>....f.._...Y.$.V....p...
~.s...9...'.t.o6..Th..`..........P..U.m..."s...L.......\....G@e?=gH..;
..eW...`Z......].T..}... l(v/o..~{A....;(...zi.....8X]..@.%Ir.."`..C.d
e..`.(O.9w..{.Dnj........U.H.h....b......)..D2].\iq.5...y2....p..a.N..
..q=.of...7....e..b....rE.N<..q....yP..}w..~.>.C......J....-"...
..~g.'....J.|..x.....Q..............qtV..2>..'.....^.t....(]...w...
..&Cw.%.~...~.T.b.:..h.j.E..<;..Q.........v....%.|.}.......[*(RG..&
.N.3Hm.]F..j.zJ..*..z...8...:0 "..\..6..5F... wXBvH...B\I>,cJ..S0..
.g.....o......s{....%.... .......,....d.....W.\.A4tI....?w. y0.....&^.
.,.[y..}'9.;Xfe.qp..i.K........E...@*..H1."..b....c.M.g....5.....O`.@.
...t...1`.YG....)G..D.s.iAR>.....u..b.l..........y.....:.:.S..i.T..
{........{.i...O.}...I..C../n...N....a.o.T.c....;.......A:@.%Y.@.?..JP
.*a.`.6.......fo...S5.M...P..B..>6....D.2...,.6.M.16Md.F~.|x..X....
$..&{...oA..U6..0?l....z..-z.....:.M.....N;q..G.z)..m..F...s..&.....l.
..c.D.....>..J.b.G..w4..;.GI..'....S....QX...B.........3....._.<
NQQ.].....Yy"75.??z<N....= .x8...T...uZ.4.ZFT@T..<....E...u.M.l]
8....[!..DM...8.....3.a...pBT.T...B.$.b.4M..n.{zz.Qc..F.n..#P..i:.....
........[..;.....^5.(...#..)X}.$......T.....e.c.z..ZE.]...,:..N.L.
<<< skipped >>>

GET /files/gizmos/common/ssleay32.2.dll HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 274432

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 15:36:13 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

X-Cache: RefreshHit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HZZbtAb_PAM6p8MclJevBbhRP9ZXA6wMcVL8Edgva_qGYpfJOgV8gw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..............}...}
...}7.L}...}.Jl}...}.J.}...}.Jj}...}...}...}.J|}l..}.Jk}...}.Jm}...}.J
i}...}Rich...}................PE..L....-hJ...........!.........@......
.Y.......................................P............................
[email protected].......<.......@.................... ...$...........
.......................P|[email protected]..........................
..text............................... ..`.rdata.......................
.......@[email protected].......@[email protected]...@..........
.................@[email protected]... ... [email protected].........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /files/gizmos/common/ssl.crt.pem HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Content-Length: 4952

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

X-Cache: RefreshHit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C7gI2m5NXAg1G7qcm9picVDRgcqgz3r6QmkZ2ZXiriIX7AxM7TdfOQ==
-----BEGIN RSA PRIVATE KEY-----.MIIEowIBAAKCAQEA2rnlHUv1ZC1fFqkvsnKxyG
IdWwkX8v2kDOmH/6Ets6N3ZDU7./ P7AU9o/X4rgV6327TiP2b0Vmauw1XVX9mqH7OGddd
XZzK9U2amXEsMZZ63FQTd.FyE9iELxhwpUiUuE7Eq4r8n9HUJOrgX8gSNWMKwgLGMFuE7o
Wp2fb1zfNjjvPy50.uD3/l6l1n7RKyIbQ9bn9FAjogbksOTsbMJgEu9Eiha0fau0ll9836
5tarB wgmls.FKr6Jq WIqkFoWZOpv2oPybqQr6Kd3fa9ZSkGjy6 OnbeO8QChEYV5FXal
mrfebU. 1jpsnngVV0ddz/YJp31rFhH3NtZItwZpWIJaQIDAQABAoIBAAe3VyXZcCbAkwI
x.pcUd1rfC/lYf1AB2gjsSYgHapcoYkjWuyxcT69739jQ7Jz3BIatWjkS VRBXPwMV.HBn
ti9ricnPlzOePGq6 iE/pNd6/4qWTLlmKiqkr82lYK/NL/rx3RlytO4i0tiHd.hDLqFDhT
Wi82rxT5c6j tokvNZCsEMqksw2sKrJ3mUBSLuAkYABD2mILeT2hoduy.vDjHydawFPlaM
z9xt1AMTzoVl66Zj2wNxj1unno6zji3e6WA2zEhTVXDqkpxd8Lu.n6C7Y/OlIxCml/B3ZL
U/zD3L4XKDvnBn jxErf2uQmi1ZTNt7KgzFMX/gccksjuA.ReaJLqECgYEA 2rAOS4a1xB
0y8lKpKJvEZteUWwPBxvtZpFlSYyIwYXUC/cEwPtb.y226/lkQ8ncNx3o4CyVUe/vqsWWS
m7TofSZBrgxa4NpQkSBINm6TxvZuTHTv5TMx.MtXzDmqe/0XveWEXQFSpb8 u4 XQwwYUf
VdUXX9k0kEw4ZvpEXMEWi8CgYEA3raX.PCmriFjjpIgUsy20hULmczJmeL/Ur85NaZyHcX
EgHXwlpR5ovhDwCs1bQ2y9F1vF.DjMB6F7j2NVCOKbmRHBKw2GiZb3v8cRR5 um4Mo3/H2
XkkeWULsl2JYfmsGDx1r .PHxJW4HExoPxkUVrH6r/hXQ6WWlX7xcPOQxgp cCgYB8QKzR
VZTUNwDR iBWryRf.Oj7p1JK0u7ufFjpNmBO6OK6sXx9NVKxwJEHnFBOJEQeRTzjFYWSYh
c7eb0l hHDl.8PNC1j5Po/VvU9n8dLe5  5VAPHSf3NQIWam FCt7l1EypQYKf83EBfp75
k12Rpl.O7SpJJ2qP6etyETuZ7595wKBgQCScTNufuPoirJc3JHn45TAz2Wit7BDk7exRhE
G.8cLpp/37BUfnk BBofeE0tVAt356noArPwTxG3vsdwXNJIli1QeEA236QnNE4NcO.jZg
0VSONJbQFnobLXNOc39G2O6p/6mgjs4G05tZRxi6QXDn9H75WrT80zZzhfKMo.2uevXwKB
gCChcJ2PWfGx8xvIpZSkKss2sHwTXdJ0VjI8KT7w6kpIHe8By0sJL7Mt.DfWXKYRG3
<<< skipped >>>

GET /files/gizmos/scripts/SoundCloud_Downloader/FF_Plugin.21.xpi HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 7116

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Thu, 27 Nov 2014 15:08:37 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:12 GMT

Server: Apache

Age: 9

X-Cache: Hit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uNO8KY_p36FBDyu-bofnj3L5Ma17g5sb2QYk52ipctav7h5MTICRgA==
PK............................chrome/PK.............:..Q...........chr
ome.manifestK.. I. .L..-..IM)-N-*N..,........R.r. 9.3..sS..........a*.
|....."L...!\].."].. ..PK........O.IC...S............install.rdf}.Mo.0
...........1...%..j/=D...`.....1e.....5]....w....P..e.|...Z..8".]..].x
..L.....k...q..1..9.8.2L(....A.we..T..^...?4._E..s)!).r.o...#.........
.=..Q.wr.z.m.$(.....M.e.....6..1C.:.(m.....B.lw....2.Y...=..._....V.up
..j5..8..=..RNS..../.G.k..9tMy...V...>.,^........5.......)/.h.;8...
/.j..C'wY..t.....s..c.......zO......$!..1J....AYE8..H ......%\L)...%..
 .. ..%K.%|.......4.....-Y..G/..PK............V...........#...content/
script-compiler-overlay.xul..K..0.D.R......i.b.CC.#q....v..v..Ho,...]5
b.6.}8...m.....b/.-:.tQj.&...:.2...q.P....a..x..3J[d.n...DS..m....Z@J.
. ......6[T%.-L..G....ux....$X.....Z e|.....0Em....t...L......I./i.PK.
........R.D................content/script-compiler.js.Y{o........0\..#
.v.043.6....G.$...".%.V ..E..z...;$%....0..%..x...NYe.6l..,...o.Z.....
..k...(x..r.....B..O.......R..........y(.:.2|.Pn6...1..K...8.E1.....hu
O.=.v...J% .M.........Z.&W..D#.'...H...SU.)~_p..l..Jq.5#....R.l.......
.#i.^..(.v...H....4.F...M].G..{...~..>.?......d....Z............>
;-tH....g....T<:T8.4{'".un.{.....h.F.N...X... ..1.v.0..qp...{.b.s..
5.W..t....NH&K........*.yi...C..g.,*..L.^[email protected]..!...N..
.&)....P.............e.....\...0..%t.^..f..............pwP.......E.6l.
.w%.E^l.Z,..G.@......./j ..2.w...5..s,....P. W>Hg..%.4I.^U.....f...
i....{.$..J..RE.t.......3#[email protected]~..'-.#".X{........h
<<< skipped >>>

GET /files/gizmos/scripts/SoundCloud_Downloader/PCGizmosBHO.20.dll HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 113152

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 10:20:58 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:12 GMT

Server: Apache

Age: 9

X-Cache: Hit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cAJo58blUt-Rb90rqB96RiRaBRw7pXvgQrDhxDWneL9KNFyoBTlE2g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........F........
.....LE......LG......LD.......!.......4.......6...............3......O
[email protected]....................
PE..L...}.UR...........!......................... ....................
........... ............@......................... .......$w..........
............................0"..8...........................x\..@.....
....... ...............................text...........................
.... ..`.rdata...`... ...b..................@[email protected]
[email protected]...............................@[email protected]..."..
[email protected]..........................................
......................................................................
......................................................................
......................................................................
............................................VW...W.....~..)...5.......
...f.........~..)..f.......;.s!..$........t..@ j............;.r..._^..
[email protected][email protected](......| ....u!
... ....~...........y..........^..F.$.....^.....................V.5...
.W..;.s.....t..@ j............;.r......w.t0....t.V......G......O(..t..
.Q.P..G.P..x ........_^........1..T!..........U..V...u....E..t.V..q...
....^]..................U...E.h.$....h.$..P.Q.].........U..S.].V..u.SS
j.h....... ...s...t.W.v......~.V.=q.........u._^.C.....[].........
<<< skipped >>>

GET /files/gizmos/common/json2.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 5413

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 08:27:34 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Age: 10

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -CxAeYQXt-T9ZQcDalLuOjbxk6xbw-IkyEdJ7pGaCoT9RsAEYwraog==
...........<kS......=...N..l&.c6.r.R7....r...S..[X K.z`X...yt.Z/ .S
.aU)lY..O..9}......EQ.............f...y.../r..rgwwkwgk.....\..(.......
..t$.....|:.&.........;qt,>|.....w..rr(.N.../....'q........z....2..
Q..(.A:W"_.e<.3%.Q.....a.)1W.8.Y...../....,Z.~...%...A..U..^.. ....
G.......p..:=>.x..7.....0..H.~t....;....>.........|..HS...|:=>
;..ww.F..A.d.r!.y..d,p.".]....&.P8J.E.N.R..t..E^d.[...0...Jf.....(h...
d\....82P.H. ....x...]&7.7 ...K..e^.8.....4.2....2^f..%.U.........xP,d
....@z.."][email protected].;[email protected]....$@|.....i.......,Uz...T...p.D.
.A.%..E.V.....X...2S..PD...H.Q..G..P..XGq...v..^..u.BR...dR...H....-ER
.g ..."^No....9D)..;M.F..@.`...VW*.!.......B.....2.{.....7|.7..L.`....
.9.(....^..W.@V(...y........,]...-h...P....C..i.....P..3.S..R..#.s.\?6
.. ...h.l.......qa....R._.4..S.j....,.q.?j.D... [email protected] @....JFF
..e...u^...6*...#.....B.L......`...dN......T..A$......aL<.P..f.5. ;
.........U.F...l.......-.z,.^8... ..f.|..7.m..6...S...p....k{..^.S"`.9
*.lm!..jF.d^.[.G. s~/........;b_x;.x..c..uN.oo...t..U.....2..)........
.p/..]g.G....{!v..9..?....L=}....e...0u...GI.....o....1....k..~.N.oiI.
...*....].=.F..lkR..i....;..2.KEn.(..CM....n....j3<..0.%..:... v...
..c&.....-....hBX1.mw..W.A\...8..A.....Bm.55...]\;..8D.&...\.. *LIk.V.
...#.....u..g%....l.......8..#J..`.!..u(u*...2..R. db..Y.A....._y.4..3
.-.1..^c.'.CG..q...}.......8.....J...v...#.j.0..KV4...8....i...m...[.F
Tn.0l.l \Q..rLZ....X>..c.......1...cXX. !..I..0.w.......tp"...H..DZ
 H.][email protected].*(....vi(i....n...q.K.k......Ba......M.........M..g
<<< skipped >>>

GET /files/gizmos/common/main.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 45905

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 08:27:36 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Vary: Accept-Encoding

Age: 11

X-Cache: Hit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DGXJoy6dBv72juYnmZXBEb_TyS40EsZPv5x5dTY7GQURekwsVAJJfQ==
............yw.8.8...9'..a.DR.Y..N.(..,...v..2.{|(...S................
...r....].......BU...........S?.E...a..^........Y..;.~..fz. FPZ.F.q...
..7.2^....B.F..8...........K.q(.x.A.K.`.zX.....{....j.N.X..G...?.Ro..D
...Ow.F.....t.'......5..x8.Oc?..)e........p..b....i(degO.;...........=
.'n.....z<.!h`......;..D].q34d...o.Ww..>....f.._...Y.$.V....p...
~.s...9...'.t.o6..Th..`..........P..U.m..."s...L.......\....G@e?=gH..;
..eW...`Z......].T..}... l(v/o..~{A....;(...zi.....8X]..@.%Ir.."`..C.d
e..`.(O.9w..{.Dnj........U.H.h....b......)..D2].\iq.5...y2....p..a.N..
..q=.of...7....e..b....rE.N<..q....yP..}w..~.>.C......J....-"...
..~g.'....J.|..x.....Q..............qtV..2>..'.....^.t....(]...w...
..&Cw.%.~...~.T.b.:..h.j.E..<;..Q.........v....%.|.}.......[*(RG..&
.N.3Hm.]F..j.zJ..*..z...8...:0 "..\..6..5F... wXBvH...B\I>,cJ..S0..
.g.....o......s{....%.... .......,....d.....W.\.A4tI....?w. y0.....&^.
.,.[y..}'9.;Xfe.qp..i.K........E...@*..H1."..b....c.M.g....5.....O`.@.
...t...1`.YG....)G..D.s.iAR>.....u..b.l..........y.....:.:.S..i.T..
{........{.i...O.}...I..C../n...N....a.o.T.c....;.......A:@.%Y.@.?..JP
.*a.`.6.......fo...S5.M...P..B..>6....D.2...,.6.M.16Md.F~.|x..X....
$..&{...oA..U6..0?l....z..-z.....:.M.....N;q..G.z)..m..F...s..&.....l.
..c.D.....>..J.b.G..w4..;.GI..'....S....QX...B.........3....._.<
NQQ.].....Yy"75.??z<N....= .x8...T...uZ.4.ZFT@T..<....E...u.M.l]
8....[!..DM...8.....3.a...pBT.T...B.$.b.4M..n.{zz.Qc..F.n..#P..i:.....
........[..;.....^5.(...#..)X}.$......T.....e.c.z..ZE.]...,:..N.L.
<<< skipped >>>

GET /files/gizmos/common/ssleay32.2.dll HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 274432

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 15:36:13 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Age: 11

X-Cache: Hit from cloudfront

Via: 1.1 b51cca8830e8b6164d5fc149a6e27443.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xY3MLCrQCeUgjUTwuOn9xmpU_kn_XAc2juC5dOuqJqMU59tQRFvb-A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..............}...}
...}7.L}...}.Jl}...}.J.}...}.Jj}...}...}...}.J|}l..}.Jk}...}.Jm}...}.J
i}...}Rich...}................PE..L....-hJ...........!.........@......
.Y.......................................P............................
[email protected].......<.......@.................... ...$...........
.......................P|[email protected]..........................
..text............................... ..`.rdata.......................
.......@[email protected].......@[email protected]...@..........
.................@[email protected]... ... [email protected].........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /Get_Name?name=173913 HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html

Date: Wed, 10 Dec 2014 19:24:51 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 21

Connection: keep-alive
SoundCloud DownloaderHTTP/1.1 200 OK..Content-Type: text/html..Date: W
ed, 10 Dec 2014 19:24:51 GMT..Server: Apache..Vary: Accept-Encoding..C
ontent-Length: 21..Connection: keep-alive..SoundCloud Downloader>....


POST /version.php HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Content-Length: 609

Cache-Control: no-cache

<config>

<exe_name>SoundcloudDLD-PC_173913.en_83.exe</exe_name>

<resources>

<file><name>PC_173913.2.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>base2-dom-fp.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>json2.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>main.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>xpath.js</name><url></url><install_folder>./\scripts</install_folder></file>

</resources>

<uid>adm_{E4D0CB3A-A1D1-42FA-ABED-98032D0B6213}</uid>

</config>
HTTP/1.1 200 OK

Content-Type: text/html

Date: Wed, 10 Dec 2014 19:24:51 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 2757

Connection: keep-alive
..<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<c
onfig>...<crc>764763301</crc>...<exe_latest_location
>hXXp://cdn.updater.pc-gizmos.com/files/gizmos/exe/SoundcloudDLD-PC
_173913.en_88.exe</exe_latest_location>...<exe_name>Soundc
loudDLD-PC_173913.en_88.exe</exe_name>...<exe_latest_version&
gt;88</exe_latest_version>...<next_utc_update>93891</ne
xt_utc_update>..<welcome_page>hXXp://welcome.pc-gizmos.com/we
lcome/SoundCloud Downloader/?gizmoID=173913&lang=en</welcome_pa
ge>..<extension_page_ch>hXXp://welcome.pc-gizmos.com/welcome/
SoundCloud Downloader/?gizmoID=173913&lang=en&ext=ch</exten
sion_page_ch>.....<resources>...<file>....<name>b
ase2-dom-fp.js</name>....<url>hXXp://cdn.updater.pc-gizmos
.com/files/gizmos/common/base2-dom-fp.js</url>....<crc>368
0354247</crc>....<install_folder>./scripts</install_fol
der>...</file>...<file>....<name>json2.js</nam
e>....<url>hXXp://cdn.updater.pc-gizmos.com/files/gizmos/comm
on/json2.js</url>....<crc>2535207516</crc>....<in
stall_folder>./scripts</install_folder>...</file>...<
;file>....<name>libeay32.2.dll</name>....<url>htt
p://cdn.updater.pc-gizmos.com/files/gizmos/common/libeay32.2.dll</u
rl>....<crc>341026931</crc>....<install_folder>./
</install_folder>...</file>...<file>....<name
<<< skipped >>>

GET /sync.ashx?partner=2591&psid=A1001&puid=6862088793012242831 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.ad.mlnadvertising.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Expires: Wed, 10 Dec 2014 19:24:44 GMT

Last-Modified: Wed, 10 Dec 2014 19:24:44 GMT

Location: hXXp://pixel.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A1001&puid=6862088793012242831

Server: Microsoft-IIS/7.5

P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC" 

X-AspNet-Version: 4.0.30319

Set-Cookie: uuid=RVNWQS1QRERBVDAxOjVkYTAwNGQyLThjYTQtNDM4MS04ZjRiLTVhYzM1NmM2YjZjMzoxNDE4MjM5NDg0Ljg0Njg1OjA; domain=ad.mlnadvertising.com; expires=Thu, 10-Dec-2015 19:24:44 GMT; path=/

X-Powered-By: ASP.NET

Date: Wed, 10 Dec 2014 19:24:44 GMT

Content-Length: 230
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://pixel
.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A10
01&puid=6862088793012242831">here</a>.</h2>..</b
ody></html>......


GET /sync.ashx?cktst=1&partner=2591&psid=A1001&puid=6862088793012242831 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=2280592&referrer=[REFERRER_URL]

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.ad.mlnadvertising.com

Connection: Keep-Alive

Cookie: uuid=RVNWQS1QRERBVDAxOjVkYTAwNGQyLThjYTQtNDM4MS04ZjRiLTVhYzM1NmM2YjZjMzoxNDE4MjM5NDg0Ljg0Njg1OjA

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Length: 43

Content-Type: image/gif

Expires: Wed, 10 Dec 2014 19:24:45 GMT

Last-Modified: Wed, 10 Dec 2014 19:24:45 GMT

Server: Microsoft-IIS/7.5

P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC" 

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 10 Dec 2014 19:24:45 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Pragma: no-cache..Content-Length: 4
3..Content-Type: image/gif..Expires: Wed, 10 Dec 2014 19:24:45 GMT..La
st-Modified: Wed, 10 Dec 2014 19:24:45 GMT..Server: Microsoft-IIS/7.5.
.P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI
 DEV PSA PSD IVA PVD OTP OUR OTR IND OTC" ..X-AspNet-Version: 4.0.3031
9..X-Powered-By: ASP.NET..Date: Wed, 10 Dec 2014 19:24:45 GMT..GIF89a.
............!.......,...........D..;..

GET /ads/conversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3212534569 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/conversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3212534569&ipr=y

Cache-Control: private, max-age=43200

Date: Wed, 10 Dec 2014 19:24:40 GMT

Expires: Wed, 10 Dec 2014 19:24:40 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 979

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/971710777/?rand
om=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&v
alue=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&gui
d=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&a
mp;u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=
http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&pr
oductname=Sound Cloud&ref=http://installer.apps-track.com/in
staller/thankyou?productid=2736&pubid=1184&distid=3885&c
ountryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&
isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAA
AB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&
random=3212534569&ipr=y">here</A>...</BODY></HTM
L>....
<<< skipped >>>

GET /shared/static_pages/ThankYou.php?&productname=Sound Cloud HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.sound-cloud.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 1526

Connection: keep-alive

Content-Encoding: gzip

Date: Wed, 10 Dec 2014 19:24:40 GMT

Server: Apache

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 8113783bf75b767fb1553c93a854ccae.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4AE0Vbg_vPpcWbbh4CJ1KSN2-NZc7oERMkYoiYDhOz514XI2ZqGwhw==
...........WmS.8..lf..Tw.I8b'.J..N.iB.[C.GB...l.(.......o%9....pg...Z.
.zv..........Z..<......1... .n....8 $1Q ...XN..(YF.n&d..jl7P. .(...
a.e.;...Q.L......|&X.4..b.E.ui....P?H*.T,.QE|F........$...y|...x..0!a.
[...4.<.xtA.*b.K.....u...O.g......-....5[...r...,E.x..T2.MCG.".$..;
..O.1.......Q.'...l(....^. ..........6onn.f> .....W$...h.dq.6......
...4..Y....|7........Q...E.[-....,.AMMYdA.....^.Y.lM....D..LE.L.HXL...
.ai.....&..9..!] .......w.\`...6...a..Lz..mn.......ICZUf'....`...t..d.
B...y.<rs..P.......HY1..R.`.4..,%.!...V=f...../.E.QJ~.........P.R..
2M.U]88;.F<d..uS3].yZs..9..............F?.PK.....0...P..#:...Q?.8.%
"P.yp4...P..4...d.g\T...zVJ1.A.....H.n.BZ....A.I4..Z...Q.....1....xFP&
lt;u....$...0N0c.EP........n......\.@.<.jv....xD...1(E..F......>
...HH.QQ...v..XB=A1I..p.............Oa.J....,..G. .....1.#9b..`.{....S
.!,)a*B...J... [.....h...6jZM.....^....z...$IT.mzga7\@S..;I>.l.....
...'..AD}.k.n.z.......D...Y.....E.].zg..G..:."..4{...n.....y-.::.w...v
.Ejt........gW.^.....k...a.b...S7...N..t....^q.1`Po.........J=!..$Wq..
.O.e;{6.GJ...H:.a,.....f.....A.a4.C(_.k6..(_.[FcYl.h...$s........$*L..
.....,.{.<.............o8..xwyE;_.'.<..._.....}....../...inkZ..?
a.]2....W.5.c.=....`..gwP4..........}?.e..q..R.]]G.&.E.. ...R0.d.R....
|r.eO<.I`.e.......<....b$...Z&..)M._....Rm..BV._...........O^.t.
|Tu..A........r.......w..i.~..YH'".I1.......}.}..;.&Y.-T{;l.6..!...lH^
|e..y.xK].....~...._}M....Jph.$4_..]L.<.f.u%..............C.....vg.
....5.1?y}.L^_`U.*...........eW.....bk4j(..}..$..b......pD..Q.....
<<< skipped >>>

GET /__utm.gif?utmwv=5.3.4&utms=500&utmn=501656&utmhn=VVV.pc-gizmos.com&utmcs=UTF-8&utmsr=1138x640&utmvp=1124x213&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=11.3 r300&utmdt=ExeUpdate&utmhid=2097570333&utmr=0&utmp=Error:0x0|88|WXP_P_|IE6.0.2900.5512_|&utmac=MO-31818336-1&utmcc=__utma=76134676.2829482533.1344257376.1344257376.1344257376.1;+__utmz=76134676.1344257376.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmip=37.57.16.189&utmu=qB HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: google-analytics.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Tue, 09 Dec 2014 05:54:17 GMT

Server: Golfe2

Content-Length: 35

Age: 135046

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;..

GET /files/gizmos/scripts/SoundCloud_Downloader/FF_Plugin.21.xpi HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 7116

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Thu, 27 Nov 2014 15:08:37 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:12 GMT

Server: Apache

X-Cache: RefreshHit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jQ3wYZW7rCcAg_rfQQ_RRscd7aUV8tMt_ZpXvI1iKsY7jkR2NRRPkQ==
PK............................chrome/PK.............:..Q...........chr
ome.manifestK.. I. .L..-..IM)-N-*N..,........R.r. 9.3..sS..........a*.
|....."L...!\].."].. ..PK........O.IC...S............install.rdf}.Mo.0
...........1...%..j/=D...`.....1e.....5]....w....P..e.|...Z..8".]..].x
..L.....k...q..1..9.8.2L(....A.we..T..^...?4._E..s)!).r.o...#.........
.=..Q.wr.z.m.$(.....M.e.....6..1C.:.(m.....B.lw....2.Y...=..._....V.up
..j5..8..=..RNS..../.G.k..9tMy...V...>.,^........5.......)/.h.;8...
/.j..C'wY..t.....s..c.......zO......$!..1J....AYE8..H ......%\L)...%..
 .. ..%K.%|.......4.....-Y..G/..PK............V...........#...content/
script-compiler-overlay.xul..K..0.D.R......i.b.CC.#q....v..v..Ho,...]5
b.6.}8...m.....b/.-:.tQj.&...:.2...q.P....a..x..3J[d.n...DS..m....Z@J.
. ......6[T%.-L..G....ux....$X.....Z e|.....0Em....t...L......I./i.PK.
........R.D................content/script-compiler.js.Y{o........0\..#
.v.043.6....G.$...".%.V ..E..z...;$%....0..%..x...NYe.6l..,...o.Z.....
..k...(x..r.....B..O.......R..........y(.:.2|.Pn6...1..K...8.E1.....hu
O.=.v...J% .M.........Z.&W..D#.'...H...SU.)~_p..l..Jq.5#....R.l.......
.#i.^..(.v...H....4.F...M].G..{...~..>.?......d....Z............>
;-tH....g....T<:T8.4{'".un.{.....h.F.N...X... ..1.v.0..qp...{.b.s..
5.W..t....NH&K........*.yi...C..g.,*..L.^[email protected]..!...N..
.&)....P.............e.....\...0..%t.^..f..............pwP.......E.6l.
.w%.E^l.Z,..G.@......./j ..2.w...5..s,....P. W>Hg..%.4I.^U.....f...
i....{.$..J..RE.t.......3#[email protected]~..'-.#".X{........h
<<< skipped >>>

GET /files/gizmos/common/json2.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 5413

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 08:27:34 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: L9hzNmgIUW3rKBEbEwZJLiNPD0TnxZWvQkcLZxh_pUzPo4DHHWrcvA==
...........<kS......=...N..l&.c6.r.R7....r...S..[X K.z`X...yt.Z/ .S
.aU)lY..O..9}......EQ.............f...y.../r..rgwwkwgk.....\..(.......
..t$.....|:.&.........;qt,>|.....w..rr(.N.../....'q........z....2..
Q..(.A:W"_.e<.3%.Q.....a.)1W.8.Y...../....,Z.~...%...A..U..^.. ....
G.......p..:=>.x..7.....0..H.~t....;....>.........|..HS...|:=>
;..ww.F..A.d.r!.y..d,p.".]....&.P8J.E.N.R..t..E^d.[...0...Jf.....(h...
d\....82P.H. ....x...]&7.7 ...K..e^.8.....4.2....2^f..%.U.........xP,d
....@z.."][email protected].;[email protected]....$@|.....i.......,Uz...T...p.D.
.A.%..E.V.....X...2S..PD...H.Q..G..P..XGq...v..^..u.BR...dR...H....-ER
.g ..."^No....9D)..;M.F..@.`...VW*.!.......B.....2.{.....7|.7..L.`....
.9.(....^..W.@V(...y........,]...-h...P....C..i.....P..3.S..R..#.s.\?6
.. ...h.l.......qa....R._.4..S.j....,.q.?j.D... [email protected] @....JFF
..e...u^...6*...#.....B.L......`...dN......T..A$......aL<.P..f.5. ;
.........U.F...l.......-.z,.^8... ..f.|..7.m..6...S...p....k{..^.S"`.9
*.lm!..jF.d^.[.G. s~/........;b_x;.x..c..uN.oo...t..U.....2..)........
.p/..]g.G....{!v..9..?....L=}....e...0u...GI.....o....1....k..~.N.oiI.
...*....].=.F..lkR..i....;..2.KEn.(..CM....n....j3<..0.%..:... v...
..c&.....-....hBX1.mw..W.A\...8..A.....Bm.55...]\;..8D.&...\.. *LIk.V.
...#.....u..g%....l.......8..#J..`.!..u(u*...2..R. db..Y.A....._y.4..3
.-.1..^c.'.CG..q...}.......8.....J...v...#.j.0..KV4...8....i...m...[.F
Tn.0l.l \Q..rLZ....X>..c.......1...cXX. !..I..0.w.......tp"...H..DZ
 H.][email protected].*(....vi(i....n...q.K.k......Ba......M.........M..g
<<< skipped >>>

GET /files/gizmos/common/xpath.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 14184

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5JQ_xsXNXSLomxQUQoDlT3L0e4fRNl8CP9OZicaeciERhsc93do4BQ==
...........}.w.7.... .>.*).%...............{.....q<.<........
K./..gF~t.~gu.X.!A........$...]z<[..z.....y.;..&{..x..........>.
...L~NO.a.....k,.....l.e...<..U~zY...,.,..*.....V.UR.%i.....NU.....
, .l.P.*W.<..|!......M..N.*............md........<]e....|.W....v
n.so.!>...bV.e..........v.,/.yr.. .y.wp ........,............uV..J/
D.L.!..>,.U....t..V..Y..2......:.'j..K..iQd....Z>..R...Y.#?K...b
^....>,.q......}}.q...vU).V!i.,...&.rvy...H..."....._...D..=Y.'....
.-...u....b.w....v...j.j5;p......KZ...g...S]<.]..............h.U...
.e........K..L..j...~.sM........\T..&......p .<H..g{.".!..8.......3
dV.T#|H.v...z.....h..M...Z.....S..N...v.MY`~.....9.i..s..|.....y.r...x
TgUM..Z.H.w......,wb);5D.....w%...a."..W.h....}|/...U[.4.T..`.o.......
F.....Y._,.$OA..T...?O"U..OYZ_.....o.l..&..b1.(.../..gFh..M.....v.L.Q 
E...>/...'......S.....V....F>.Y0.*U?`X_.>R...:.........[..j..
..j.zk.;........o.....k..A#?....,f....A...o..P..,.$}-H..s.o~.g Q`,5Z..
...'Z.Im.D...u.......h...`.l..|....D.0..LGB.d......-.....C!...V..B.C..
..WvRShGY]..e...Pe.....G.X.c..0..B...dj\.o..}......?...r....Pb.....&x.
8.:S*.5A.Hg]!......`[email protected]|Y<;n.U].%C....b..n|.... ....iu
!lg1.m.... "~..V._.....A.X..._.U.gq.}....\..W.di.0|[email protected]_K.d.....A..
.N./..O....._:..l...~T..9............\....jTr....u.}..R_.u..8&.-)-.o..
..|\...%.G.n...>..........7...P-9Y..y.3...{..d.@...."....."].3.'=..
K....i............E....X.m...J..Lf.B.&....0..r....p.i..n.L0\._..>I.
.B}9...N..(K.2e.Tl...'.......I/....-6....w.X.N..X....=...!..f.-...
<<< skipped >>>

GET /files/gizmos/common/libeay32.2.dll HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1122304

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

X-Cache: RefreshHit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FDJuCes_yr0fA6lvUFGQicC9HVTDJqftjiAeDx_JAykFM0nH-oK6aA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......F...........
.....5......%7..*...................%7......%7.. ...%7......%7......%7
......Rich....................PE..L....-hJ...........!.....@... ......
V........P...............................p............................
..........`...@h..\...x.......@.......................................
.....................................P..8............................t
ext....:.......@.................. ..`.rdata.......P.......P..........
....@[email protected][email protected][email protected]
..............@[email protected]...............`[email protected]............
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /files/gizmos/scripts/SoundCloud_Downloader/PC_173913.2.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 4269

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Wed, 10 Dec 2014 07:38:52 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:13 GMT

Server: Apache

Age: 8

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: a-EDQhMSr4tKoPEhqky2uWW3VxQEEnTwA0sSXG5VQhDMmjwoio8fNA==
............ks.6..2... .H.$R.c..L..hZw.$W.w7S.4..I.).GP.....v..K..m...
..$.X.b..d...~.,>qb/J,....$...9#..$\.....\r.^.~h.,. yd;.<..&;.E2
....O.,....e\..........nJ.,I..i^^^...98.p...r-<.......j...s..~zF...
.n.6d.,.L..7...........\;a..9....<......7e.)W.......3?..z.[..m#..b6
.2.B.|...'.vLN..G..`..s...d....^....p......;g.."I@([email protected]
..<..S/.&.3.Y.v....r.nc...;._.*7....a..!g.kMl.3...K`..$......K.MfV.
[email protected]:..&..8c.f.%F;..\..j......t7^om....(.}/.Z4
.)..1.c...].N.>..l..a.I.J=.....s]... }..GWC"g............{.Y.,-...F
[email protected]. ..>.3.a8...[...{..mnou7.........f
...S........ `.......Z4kOW.1$..g.'..ww.'q.Lw?.......U.....@_.c..wL..?.
Vi.Z.R_^su...0.\..ijf$-H.1...\..8..9..y ..,[email protected].............
...ol4..H=.H. [email protected]........./ %..}0...;..$...~7L.h....v.69...
.2..No....w&.........6....,...M8.`...7..'...P.....)2..........l.....p:
[email protected].|...........:G....o..&.K....%LA..#.......D1.].t...
;.?...Q:v2...V2X.dF...`[email protected]...=.P........m.w7)!!.B.9.}...
...1e..>......8....i.i.t.R2...jvZ.....p.c...D.....0Y......CXj4.>
.Z{......<q....$..S.. e.3#...?..;[email protected].*@B...F.,b.9-..Kr.
YA......`wH.7i...V./0V.Z....9 .X..F)$7..Qj."8K...-.m.it...D..d.....~V.
.J....b.u..R..j...PF..<@...BN.r.#Gtp.....= a....6|.L..vHO,..S.b.?..
.p.. FY.U..f.@.. ....t.=z0K....jII"[email protected]...
.L.:...F..$..g#..#..J3...._..U.Ub.R...(/.CQ&......|.po.>8........#.
:..>a:..I...N.."){..d4..6..>.'....?.......{V.K,.X...&C.V.!z.
<<< skipped >>>

GET /files/gizmos/common/base2-dom-fp.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 17219

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Age: 10

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0hvdAuvFCgrNefPNenrPxCLqPzbKXwBaflePjhwsYxwybuOFePiGdg==
...........}i..G..w..(.R)..$.cp.k.....k.3.. Nm,.40@Kj..._,.V......y^..
.\###"#"#....T.h.. ..d..[.&.m..l~s.n.ZA.e.-*....:[email protected]....
..jP%........*[l...$./...|..{.i...........R/...z..n..M.. ....:..3Zl...
.G./>Dk.j.[D7Y.../...7.......:.g.V..v.......(..&Y.,.z.m.z........&[
G1<..V...|.%[.'.-...^../.l<[di..v>..Mg....6.~..Po...&...A.m.`
0./.h.....*J......>V........;...9...T;<,.GP............. ....:..
...-$..X/w!.|...pqz.^(y..9l......C.....a..`3.<j..'a..OT.Wa.........
..Q....?.....Wac..k...f.3hD.1...A..4.......,qvo..u/........<~..../c
o([.:..|...$..j <.C..l......^m.m.h..............o.{#....5O...Otv...
A. ..&l..W...:......r{.......(.....(..#....j...|).S....W..k.....Q6....
(.....G#.8.#.)6..rI....]h<...m.H.$.D7....JIMT4....x3...#))H...V.0..
.XE.-$G.~.....F:..-I....i=Z..wTs. .#()w.`....A....0H.....g...;^.}Z-...
.$B...!..~..z.H.7 /AwL...5......0c.COM...q}..m.......y...p.#A..%.B....
...8N...<[L...M.........].!.....$.f>..C@=....26."M]Fk99BW4.1....
.i.F]...V....C0.Y.3..S5...k9.Da../..Ead`y..t........:I.C...L9P.`..p,..
.i...o> Q?;...P..^/..h....s...J.Gi....J.|.].N.#[email protected].
.....\[email protected]/.P.9..D. d.L..@=.[.>.|...."p.... X.....Y.
{.XOUT....;..aN~9Gc*y.0.P.u]..MDm.-&&../...........y...t.B..|.y.WKj^..
..!.P...!e.z0J.5.8L.Z..jVS84B.)S.|...f...=...-...P. ........,.....b1..
......!........^0.zhIX...........V.K......,..As. $.H.6.9,L.%).0..I..~.
..... .....<...}x...C.......^ ...Y.tE..Wn.......@K$......C(.H6.X.x.
..X..^?m.Z..jG.....u.(.Q.%.P...H..XJ....\.d.5......|(I.....R~a....
<<< skipped >>>

GET /files/gizmos/common/libeay32.2.dll HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1122304

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Age: 9

X-Cache: Hit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4HLAuEmIl4IqkO-o8Kk5xI_W1rJNY0p2WFIxQkm-wgMojP8OE9Qclw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......F...........
.....5......%7..*...................%7......%7.. ...%7......%7......%7
......Rich....................PE..L....-hJ...........!.....@... ......
V........P...............................p............................
..........`...@h..\...x.......@.......................................
.....................................P..8............................t
ext....:.......@.................. ..`.rdata.......P.......P..........
....@[email protected][email protected][email protected]
..............@[email protected]...............`[email protected]............
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /files/gizmos/common/ssl.crt.pem HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Content-Length: 4952

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Age: 10

X-Cache: Hit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vfaRPHF7JR-AigR1P9ai8UgW8FkbGD1GXfdt3W8raoX2rAs2-FFtrw==
-----BEGIN RSA PRIVATE KEY-----.MIIEowIBAAKCAQEA2rnlHUv1ZC1fFqkvsnKxyG
IdWwkX8v2kDOmH/6Ets6N3ZDU7./ P7AU9o/X4rgV6327TiP2b0Vmauw1XVX9mqH7OGddd
XZzK9U2amXEsMZZ63FQTd.FyE9iELxhwpUiUuE7Eq4r8n9HUJOrgX8gSNWMKwgLGMFuE7o
Wp2fb1zfNjjvPy50.uD3/l6l1n7RKyIbQ9bn9FAjogbksOTsbMJgEu9Eiha0fau0ll9836
5tarB wgmls.FKr6Jq WIqkFoWZOpv2oPybqQr6Kd3fa9ZSkGjy6 OnbeO8QChEYV5FXal
mrfebU. 1jpsnngVV0ddz/YJp31rFhH3NtZItwZpWIJaQIDAQABAoIBAAe3VyXZcCbAkwI
x.pcUd1rfC/lYf1AB2gjsSYgHapcoYkjWuyxcT69739jQ7Jz3BIatWjkS VRBXPwMV.HBn
ti9ricnPlzOePGq6 iE/pNd6/4qWTLlmKiqkr82lYK/NL/rx3RlytO4i0tiHd.hDLqFDhT
Wi82rxT5c6j tokvNZCsEMqksw2sKrJ3mUBSLuAkYABD2mILeT2hoduy.vDjHydawFPlaM
z9xt1AMTzoVl66Zj2wNxj1unno6zji3e6WA2zEhTVXDqkpxd8Lu.n6C7Y/OlIxCml/B3ZL
U/zD3L4XKDvnBn jxErf2uQmi1ZTNt7KgzFMX/gccksjuA.ReaJLqECgYEA 2rAOS4a1xB
0y8lKpKJvEZteUWwPBxvtZpFlSYyIwYXUC/cEwPtb.y226/lkQ8ncNx3o4CyVUe/vqsWWS
m7TofSZBrgxa4NpQkSBINm6TxvZuTHTv5TMx.MtXzDmqe/0XveWEXQFSpb8 u4 XQwwYUf
VdUXX9k0kEw4ZvpEXMEWi8CgYEA3raX.PCmriFjjpIgUsy20hULmczJmeL/Ur85NaZyHcX
EgHXwlpR5ovhDwCs1bQ2y9F1vF.DjMB6F7j2NVCOKbmRHBKw2GiZb3v8cRR5 um4Mo3/H2
XkkeWULsl2JYfmsGDx1r .PHxJW4HExoPxkUVrH6r/hXQ6WWlX7xcPOQxgp cCgYB8QKzR
VZTUNwDR iBWryRf.Oj7p1JK0u7ufFjpNmBO6OK6sXx9NVKxwJEHnFBOJEQeRTzjFYWSYh
c7eb0l hHDl.8PNC1j5Po/VvU9n8dLe5  5VAPHSf3NQIWam FCt7l1EypQYKf83EBfp75
k12Rpl.O7SpJJ2qP6etyETuZ7595wKBgQCScTNufuPoirJc3JHn45TAz2Wit7BDk7exRhE
G.8cLpp/37BUfnk BBofeE0tVAt356noArPwTxG3vsdwXNJIli1QeEA236QnNE4NcO.jZg
0VSONJbQFnobLXNOc39G2O6p/6mgjs4G05tZRxi6QXDn9H75WrT80zZzhfKMo.2uevXwKB
gCChcJ2PWfGx8xvIpZSkKss2sHwTXdJ0VjI8KT7w6kpIHe8By0sJL7Mt.DfWXKYRG3
<<< skipped >>>

GET /files/gizmos/common/xpath.js HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: cdn.updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 14184

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Encoding: gzip

Date: Mon, 27 Oct 2014 07:51:45 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Vary: Accept-Encoding

Age: 13

X-Cache: Hit from cloudfront

Via: 1.1 bd75081a29e72d59e14294b59584c438.cloudfront.net (CloudFront)

X-Amz-Cf-Id: e-N30hrja0N9jTvNqXTcy4N_5y1flcQKBuGytoWwsaFtIhHIT4ejjA==
...........}.w.7.... .>.*).%...............{.....q<.<........
K./..gF~t.~gu.X.!A........$...]z<[..z.....y.;..&{..x..........>.
...L~NO.a.....k,.....l.e...<..U~zY...,.,..*.....V.UR.%i.....NU.....
, .l.P.*W.<..|!......M..N.*............md........<]e....|.W....v
n.so.!>...bV.e..........v.,/.yr.. .y.wp ........,............uV..J/
D.L.!..>,.U....t..V..Y..2......:.'j..K..iQd....Z>..R...Y.#?K...b
^....>,.q......}}.q...vU).V!i.,...&.rvy...H..."....._...D..=Y.'....
.-...u....b.w....v...j.j5;p......KZ...g...S]<.]..............h.U...
.e........K..L..j...~.sM........\T..&......p .<H..g{.".!..8.......3
dV.T#|H.v...z.....h..M...Z.....S..N...v.MY`~.....9.i..s..|.....y.r...x
TgUM..Z.H.w......,wb);5D.....w%...a."..W.h....}|/...U[.4.T..`.o.......
F.....Y._,.$OA..T...?O"U..OYZ_.....o.l..&..b1.(.../..gFh..M.....v.L.Q 
E...>/...'......S.....V....F>.Y0.*U?`X_.>R...:.........[..j..
..j.zk.;........o.....k..A#?....,f....A...o..P..,.$}-H..s.o~.g Q`,5Z..
...'Z.Im.D...u.......h...`.l..|....D.0..LGB.d......-.....C!...V..B.C..
..WvRShGY]..e...Pe.....G.X.c..0..B...dj\.o..}......?...r....Pb.....&x.
8.:S*.5A.Hg]!......`[email protected]|Y<;n.U].%C....b..n|.... ....iu
!lg1.m.... "~..V._.....A.X..._.U.gq.}....\..W.di.0|[email protected]_K.d.....A..
.N./..O....._:..l...~T..9............\....jTr....u.}..R_.u..8&.-)-.o..
..|\...%.G.n...>..........7...P-9Y..y.3...{..d.@...."....."].3.'=..
K....i............E....X.m...J..Lf.B.&....0..r....p.i..n.L0\._..>I.
.B}9...N..(K.2e.Tl...'.......I/....-6....w.X.N..X....=...!..f.-...
<<< skipped >>>

GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 10 Dec 2014 19:24:33 GMT

Content-Type: text/css

Content-Length: 20706

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT

ETag: "ca38195cd123cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 17 Dec 2014 19:24:33 GMT

X-Cache: HIT

Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.tx
t (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Ve
rsion 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquer
y.com/UI/Theming/API. */../* Layout helpers.--------------------------
--------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-acce
ssible { position: absolute !important; clip: rect(1px 1px 1px 1px); c
lip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0
; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font
-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helpe
r-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:
after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfi
x { width: 100%; height: 100%; top: 0; left: 0; position: absolute; op
acity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.-----------
-----------------------*/..ui-state-disabled { cursor: default !import
ant; }.../* Icons.----------------------------------*/../* states and 
images */..ui-icon { display: block; text-indent: -99999px; overflow: 
hidden; background-repeat: no-repeat; }.../* Misc visuals.------------
----------------------*/../* Overlays */..ui-widget-overlay { position
: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQu
ery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://
jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 li
censes.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 10 Dec 2014 19:24:34 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Wed, 10 Dec 2014 19:24:34 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>..HTTP/1.1 404 Not Found..Date: Wed, 10 Dec 2014 19:24:34 GMT..Co
ntent-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>

GET /Get_Name?name=173913 HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html

Date: Wed, 10 Dec 2014 19:24:35 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 21

Connection: keep-alive
SoundCloud Downloader....


POST /version.php HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Content-Length: 152

Cache-Control: no-cache

<config>

<exe_name>SoundcloudDLD-PC_173913.en_83.exe</exe_name>

<resources>

</resources>

<uid>adm_{E4D0CB3A-A1D1-42FA-ABED-98032D0B6213}</uid>

</config>
HTTP/1.1 200 OK

Content-Type: text/html

Date: Wed, 10 Dec 2014 19:24:35 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 2757

Connection: keep-alive
..<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<c
onfig>...<crc>764763301</crc>...<exe_latest_location
>hXXp://cdn.updater.pc-gizmos.com/files/gizmos/exe/SoundcloudDLD-PC
_173913.en_88.exe</exe_latest_location>...<exe_name>Soundc
loudDLD-PC_173913.en_88.exe</exe_name>...<exe_latest_version&
gt;88</exe_latest_version>...<next_utc_update>87325</ne
xt_utc_update>..<welcome_page>hXXp://welcome.pc-gizmos.com/we
lcome/SoundCloud Downloader/?gizmoID=173913&lang=en</welcome_pa
ge>..<extension_page_ch>hXXp://welcome.pc-gizmos.com/welcome/
SoundCloud Downloader/?gizmoID=173913&lang=en&ext=ch</exten
sion_page_ch>.....<resources>...<file>....<name>b
ase2-dom-fp.js</name>....<url>hXXp://cdn.updater.pc-gizmos
.com/files/gizmos/common/base2-dom-fp.js</url>....<crc>368
0354247</crc>....<install_folder>./scripts</install_fol
der>...</file>...<file>....<name>json2.js</nam
e>....<url>hXXp://cdn.updater.pc-gizmos.com/files/gizmos/comm
on/json2.js</url>....<crc>2535207516</crc>....<in
stall_folder>./scripts</install_folder>...</file>...<
;file>....<name>libeay32.2.dll</name>....<url>htt
p://cdn.updater.pc-gizmos.com/files/gizmos/common/libeay32.2.dll</u
rl>....<crc>341026931</crc>....<install_folder>./
</install_folder>...</file>...<file>....<name
<<< skipped >>>

GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Wed, 10 Dec 2014 19:17:37 GMT

Expires: Wed, 10 Dec 2014 20:17:37 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 29947

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 416

Alternate-Protocol: 80:quic,p=0.02
...............F....>..R..1.d...j0!^[email protected]........
....@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............
C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3
.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU...
.T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m.....
.v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D
#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{
=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.
o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..
*8..o....x.;....>& n.... [email protected]/.h...?U.....=T.
EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..
........o.........~.......3...HN..t.................E/[....-..vq..y...
.-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6
...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.
)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L.
.p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=.
.......3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.
......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f
`[email protected].]  h........v..(i....|mv....7.......t......j..j...c.K
2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3.....
.m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........
l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Wed, 10 Dec 2014 19:14:46 GMT

Expires: Wed, 10 Dec 2014 20:14:46 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 88

X-XSS-Protection: 1; mode=block

Age: 587

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic,p=0.02
.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w.
..........IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Last-Modif
ied: Fri, 12 Oct 2012 18:27:19 GMT..Date: Wed, 10 Dec 2014 19:14:46 GM
T..Expires: Wed, 10 Dec 2014 20:14:46 GMT..Access-Control-Allow-Origin
: *..Timing-Allow-Origin: *..X-Content-Type-Options: nosniff..Server: 
sffe..Content-Length: 88..X-XSS-Protection: 1; mode=block..Age: 587..C
ache-Control: public, must-revalidate, proxy-revalidate, max-age=3600.
.Alternate-Protocol: 80:quic,p=0.02...PNG........IHDR.......d.....G,Z`
....IDAT..c.....&.....G0..ed.......w...........IEND.B`...

GET //offers/DynamicOfferScreen?offerid=2&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:28 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8309

Connection: keep-alive
.<html>.    <head>.      .       <style type="text/css"
>.            .ui-progressbar-value { background-image: url(images/
pbar-ani.gif); }.        </style>.       .        <link type=
"text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery
-ui-1.8.19.custom.css" rel="stylesheet" />.        <link href="h
ttp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-u
i.css" rel="stylesheet" type="text/css" />.        <script  type
="text/javascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1
.5/jquery.min.js"></script>.        <script  type="text/ja
vascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jque
ry-ui.min.js"></script>..       <title>2 - NonProduct (
Sound Cloud)</title><script type='text/javascript'>var _ga
q = _gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push([
'_setDomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', tru
e]);..                                            _gaq.push(['_trackPa
geview']);..                                            (function() {.
.                                              var ga = document.creat
eElement('script'); ga.type = 'text/javascript'; ga.async = true;..   
                                           ga.src = ('https:' == docum
ent.location.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doubleclick
.net/dc.js';..                                              var s = do
cument.getElementsByTagName('script')[0]; s.parentNode.insertBefor
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=3885&leadp=2736&countryid=262&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&external=0& HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Wed, 10 Dec 2014 19:24:34 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 7026

Connection: keep-alive
<html>.    <head>.      <title>4 - NonProduct (Sound
 Cloud)</title><script type='text/javascript'>var _gaq = _
gaq || [];_gaq.push(['_setAccount', 'UA-37348037-1']);_gaq.push(['_set
DomainName', 'ppdownload.com']);_gaq.push(['_setAllowLinker', true]);.
.                                            _gaq.push(['_trackPagevie
w']);..                                            (function() {..    
                                          var ga = document.createElem
ent('script'); ga.type = 'text/javascript'; ga.async = true;..        
                                      ga.src = ('https:' == document.l
ocation.protocol ? 'hXXps://' : 'hXXp://')   'stats.g.doubleclick.net/
dc.js';..                                              var s = documen
t.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
..                                            })();</script><
style type='text/css'>body      {          width:100%; height:100%;
 margin:0px; padding:0px; font-size:font-family:helvetica; font-size:1
2px;}   .divLeadpName      {         border-bottom-style:groove;border
-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:fon
t-family:helvetica; font-style:italic; font-size:25px;                
 font-weight:bold; color:black; position:absolute;   width: 100%; back
ground-color: #fff; ba}   #divTop         {display: none}  #divMiddle 
     {background-color: #efecec; height: 100%;} #middle    {background
-color: #fff;} .divOnNext      {          position:absolute; width
<<< skipped >>>

GET /Get_Name?name=173913 HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html

Date: Wed, 10 Dec 2014 19:25:03 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 21

Connection: keep-alive
SoundCloud DownloaderHTTP/1.1 200 OK..Content-Type: text/html..Date: W
ed, 10 Dec 2014 19:25:03 GMT..Server: Apache..Vary: Accept-Encoding..C
ontent-Length: 21..Connection: keep-alive..SoundCloud Downloader>....


POST /version.php?cmd=update&gizmoID=173913&days_ins=0 HTTP/1.1

Content-Type: text/xml; charset=utf-8

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Content-Length: 609

Cache-Control: no-cache

<config>

<exe_name>SoundcloudDLD-PC_173913.en_88.exe</exe_name>

<resources>

<file><name>PC_173913.2.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>base2-dom-fp.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>json2.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>main.js</name><url></url><install_folder>./\scripts</install_folder></file>

<file><name>xpath.js</name><url></url><install_folder>./\scripts</install_folder></file>

</resources>

<uid>adm_{E4D0CB3A-A1D1-42FA-ABED-98032D0B6213}</uid>

</config>
HTTP/1.1 200 OK

Content-Type: text/html

Date: Wed, 10 Dec 2014 19:25:03 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 3190

Connection: keep-alive
..<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<c
onfig>...<crc>764763301</crc>...<exe_latest_location
>hXXp://cdn.updater.pc-gizmos.com/files/gizmos/exe/SoundcloudDLD-PC
_173913.en_88.exe</exe_latest_location>...<exe_name>Soundc
loudDLD-PC_173913.en_88.exe</exe_name>...<exe_latest_version&
gt;88</exe_latest_version>...<next_utc_update>90951</ne
xt_utc_update>..<welcome_page>hXXp://welcome.pc-gizmos.com/we
lcome/SoundCloud Downloader/?gizmoID=173913&lang=en</welcome_pa
ge>..<extension_page_ch>hXXp://welcome.pc-gizmos.com/welcome/
SoundCloud Downloader/?gizmoID=173913&lang=en&ext=ch</exten
sion_page_ch>.....<resources>...<file>....<name>b
ase2-dom-fp.js</name>....<url>hXXp://cdn.updater.pc-gizmos
.com/files/gizmos/common/base2-dom-fp.js</url>....<crc>368
0354247</crc>....<install_folder>./scripts</install_fol
der>...</file>...<file>....<name>json2.js</nam
e>....<url>hXXp://cdn.updater.pc-gizmos.com/files/gizmos/comm
on/json2.js</url>....<crc>2535207516</crc>....<in
stall_folder>./scripts</install_folder>...</file>...<
;file>....<name>libeay32.2.dll</name>....<url>htt
p://cdn.updater.pc-gizmos.com/files/gizmos/common/libeay32.2.dll</u
rl>....<crc>341026931</crc>....<install_folder>./
</install_folder>...</file>...<file>....<name
<<< skipped >>>

GET /files/gizmos/auto-update/SoftwareUpdater_silent_9898_98.exe?gizmoID=173913&uid=adm_{E4D0CB3A-A1D1-42FA-ABED-98032D0B6213}&days_ins=0 HTTP/1.1

Accept-Encoding: gzip

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Host: updater.pc-gizmos.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=120

Content-Type: application/octet-stream

Date: Wed, 10 Dec 2014 19:25:04 GMT

Last-Modified: Sun, 03 Aug 2014 10:54:14 GMT

Server: Apache

Content-Length: 1073121

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
.Q.................^...........1.......p....@.........................
.................................................t..........@.........
...................................................................p..
.............................text....].......^.................. ..`.r
data.......p.......b..............@[email protected]....\...........v..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /pagead/viewthroughconversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: googleads.g.doubleclick.net

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Wed, 10 Dec 2014 19:24:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/conversion/971710777/?random=1489924371&cv=7&fst=1418239486743&num=1&fmt=2&value=1.2&label=q1l3CK-4vAkQucKszwM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=120&u_nplug=0&u_nmime=0&frm=2&url=http://VVV.sound-cloud.info/shared/static_pages/ThankYou.php?&productname=Sound Cloud&ref=http://installer.apps-track.com/installer/thankyou?productid=2736&pubid=1184&distid=3885&countryid=262&reqid=173755632&sysbit=32&dfb=0&hb=2&isagg=0&version=4.0&external=0&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3212534569