MD5: 04cc3fbb1271877d0b178ac42fef4b27
SHA1: 1e0526d4e8a5628a47ba02debcb27e9419f0fcc0
SHA256: 0176cef0bcb2b74e648ac0d6a6ef0210f543ffb062f0d6edfe1c7263d2fbd0c5
SSDeep: 12288:CCPOOOtFePQXUcGwO9F fvBHzzeSFzXzivFbq2qJ/FGgeuPgUw:CbOOTWzHi5XQk2qFGgeigUw
Size: 804984 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: BUSY BEE COMPANY LIMITED
Created at: 2012-02-24 21:19:54
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

TPAutoConnSvc.exe:1776
pcgupdate.exe:2828
pcgtray.exe:2368
pcgstartup.exe:3708
pcgstartup.exe:3208
PcgRtp.exe:2576
PcgRtp.exe:3980
PcgRtp.exe:3448
PcgRtp.exe:3192
RtpIns.exe:2516
%original file name%.exe:3304
full_installer.exe:3400
pcg.exe:2648
realtimespeedup.exe:1644
pcgui.exe:2504

The Malware injects its code into the following process(es):

PcgRtp.exe:3884

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process pcgupdate.exe:2828 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\BeeDoctor\ave\avira\vbase020.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase012.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aepack.dll (26688 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase007.vdf (132823 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase022.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\avupdate-savapi-product.conf (385 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\AviraEngine.zip.download (18080422 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase004.vdf (125103 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase018.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aehelp.dll (10136 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase003.vdf (66750 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi.exe (13368 bytes)
C:\ProgramData\BeeDoctor\log\pcgupdate.exe.log (1737 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase010.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aesbx.dll (38904 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aebb.dll (1856 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase017.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase024.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\HBEDV.key (512 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase030.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase006.vdf (505387 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aeemu.dll (13584 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase011.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase009.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\avupdate-savapilib-engine.conf (446 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase025.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi3client.dll (6360 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aeheur.dll (231384 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi3.conf (784 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase000.vdf (2158261 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\avupdate_msg.avr (5 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aevdf.dll (4992 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi3.dll (15536 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\avupdate.exe (41699 bytes)
C:\ProgramData\BeeDoctor\log\NetworkLog.log (416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\httpex.log (475877 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi3_restart.exe (2392 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase002.vdf (83890 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\update.bat (707 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase014.vdf (5520 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aerdl.dll (23936 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aelibinf.dll (1856 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aegen.dll (15536 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase016.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aelidb.dat (3312 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi_pretest.bat (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aemobile.dll (1856 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi_post.bat (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase001.vdf (67286 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase015.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\update.dat (421 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase029.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\unacev2.dll (2392 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aeexp.dll (8560 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\productname.dat (16 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aescript.dll (18424 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aevdf.dat (1 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aecore.dll (8560 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi_stub.exe (2392 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase013.vdf (5520 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase023.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase005.vdf (219601 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\avupdate-savapi-engine.conf (436 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase008.vdf (68229 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase021.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase027.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aedroid.dll (15536 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aeset.dat (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aecrypto.dll (1856 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase026.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aescn.dll (5064 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\aeoffice.dll (7192 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase028.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase031.vdf (11048 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\vbase019.vdf (2 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\avupdate-savapilib-product.conf (368 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi_pre.bat (485 bytes)

The process pcgtray.exe:2368 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\pcgtray.exe.log (582 bytes)

The process pcgstartup.exe:3708 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\BeeDoctor\0.1.1411.1712\libipc.dll (49 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgnetmgr.dll (761 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\msvcr100.dll (774 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\msvcp100.dll (421 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\log4cxx.dll (49 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\commutil.dll (49 bytes)
%Program Files% (x86)\BeeDoctor\config\commoncfg.cfg (24 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\commcfg.dll (499 bytes)
C:\ProgramData\BeeDoctor\log\pcgstartup.exe.log (359 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\cryptutil.dll (143 bytes)

The process pcgstartup.exe:3208 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\pcgstartup.exe.log (891 bytes)
C:\ProgramData\BeeDoctor\log\NetworkLog.log (1283 bytes)

The process PcgRtp.exe:2576 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\PcgRtp.exe.log (1972 bytes)

The process PcgRtp.exe:3884 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\BeeDoctor\config\nocachecfg.cfg (384 bytes)
C:\ProgramData\BeeDoctor\RtpLogData.db-journal (544 bytes)
C:\ProgramData\BeeDoctor\softuninstalllog.db-journal (22608 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\SavSdk.dll (45 bytes)
C:\ProgramData\BeeDoctor\log\PcgRtp.exe.log (7013 bytes)
%Program Files% (x86)\BeeDoctor\ave\avira\savapi3.dll (446 bytes)
C:\ProgramData\BeeDoctor\RtpLogData.db (29 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\software\ProcessLogDll.dll (536 bytes)
C:\ProgramData\BeeDoctor\softuninstalllog.db (921 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\RtpCommon.dll (536 bytes)

The process PcgRtp.exe:3980 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 (370 bytes)
C:\ProgramData\BeeDoctor\log\PcgRtp.exe.log (509 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar4837.tmp (2784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab4826.tmp (56 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 (56 bytes)

The process PcgRtp.exe:3448 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\PcgRtp.exe.log (797 bytes)

The process PcgRtp.exe:3192 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\PcgRtp.exe.log (1010 bytes)

The process RtpIns.exe:2516 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PcgRtp.exe (1 bytes)
C:\Windows\System32\drivers\TFsFltX64.sys (601 bytes)
C:\ProgramData\BeeDoctor\log\RtpIns.exe.log (10928 bytes)

The process %original file name%.exe:3304 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\logo.png (1180 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\progress-fill.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\progress-empty.png (944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\InstallHelper.dll (6774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\btn-ok.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\install-img02.png (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\install-img03.png (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\shadow_deactive.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\LangDLL.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\checkbox.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\close.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\shadow_active.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\lang.txt (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\install-img01.png (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\DownHelper.dll (14502 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\full_installer.exe (3685954 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\background.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\btn-install.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\System.dll (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\leadbytes (16 bytes)

The process full_installer.exe:3400 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\SysCleanerOverview.dll (19574 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TSSyskit64.sys (3300 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\communic.dll (3370 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\StartupLoad.dat (3 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TSSysKitProxy.dll (6917 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\PcgUDiskGuard.dll (13675 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\RTPTipsConfig.dat.vn (9 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\libipc.dll (22332 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\progress-fill.png (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgnetmgr.dll (17191 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TSKSP.sys (7821 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TsFltMgr.sys (4491 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HipsFilePolicyEx.dat (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\progress-empty.png (944 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\antivirusui.dll (25224 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\libGLESv2.dll (10927 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\SysOptLib.dat.vn (3 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\OptimizeExDll.dll (8893 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\traceclear.dat.th (6 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\MalwareLogic.dll (7472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\background.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\shadow_deactive.png (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\realtimespeedup.rcc (16764 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HPTrojanScan.dll (19578 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\sysspeedupui.dll (30463 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\NSISAppUpdater.dll (2921 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\QMSysRepProv.dat.th (32 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\Startup.dat.vn (10504 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HPTrojanScanInfo.dat.vn (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\InstallHelper.dll (6774 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\SavSdk.dll (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\btn-install.png (5 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\BeeDoctor.exe (14185 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\antivirus.dll (18115 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\atl100.dll (6386 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\homepageui.dll (24787 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\cryptutil.dll (4119 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PcgShlExt.dll (6488 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\System.dll (37 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Qt5Core.dll (49979 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\HPScanPluginInfo.dat.vn (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgstartup.exe (19285 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res (4 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HipsPfPolicy.dat (640 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Qt5Gui.dll (42018 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\HPScanPluginInfo.dat (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\uinst0.exe (1675 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgconfig.dat (632 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\softwareui.rcc (1163 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\PcgAVEngine.dll (4425 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PCGFileFlt.dll (3589 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\Startup.dat (10448 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\software\softwareui.dll (23646 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\garbageclear.dat (1568 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\GarbageProcessKillList.dat.th (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\PCGMalFilter.dat (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\RTPTipsConfig.dat.th (11 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\log4cxx.dll (36324 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HPTrojanScanInfo.dat (5 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Qt5Widgets.dll (62338 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\libEGL.dll (407 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\traceclear.dat.vn (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\nsisFirewallW.dll (24 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\GarbageProcessKillList.dat.vn (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\sysspeedup.dll (15660 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\icuuc51.dll (24800 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\PCGProcessRunningTime.dll (3271 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Uninstall.exe (4641 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HipsCtrlClient.dll (15166 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HPTrojanScanInfo.dat.th (6 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgtray.exe (39714 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\imageformats\qico.dll (1707 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\HPGarbageScan.dll (4087 bytes)
%Program Files% (x86)\BeeDoctor\chl.dat (18 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HIPSEngine.dll (33019 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\software\SoftUninstall.dll (19577 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\syscleaner.dll (25592 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\imageformats\qgif.dll (2349 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\lang.txt (335 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\malwlang.dat (2712 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\HPScanPluginMgr.dll (3624 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\icuin51.dll (34828 bytes)
C:\Users\"%CurrentUserName%"\Desktop\BeeDoctor.lnk (832 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TFsFlt.sys (2602 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\QMSysRepProv.dat (27 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\MemDefrag.dll (3268 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\SysOptLib.dat (3 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\HPFireware.dll (3038 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\commlang.dat (1568 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\ProcessManager.dll (4552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeeDoctor\BeeDoctor.lnk (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\syscleanerui.dll (43158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\install-img03.png (1600 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\homepage.dll (13047 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\starttips.xml (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\SysSpeedUpDll.dll (2955 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\RtpCommon.dll (18091 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\vcomp100.dll (1866 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\ProcInfo.dat (32 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\registryutil.dll (4303 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PCGSysMonX64.sys (3364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\logo.png (1180 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\checkbox.png (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\platforms\qwindows.dll (22459 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\btn-ok.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\install-img02.png (2712 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PCGUpdate.exe (49997 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HipsProcessPolicy.dat (368 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\realtimespeedup.exe (18960 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\GarbageProcessKillList.dat (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\denoiser_info.ini (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\StartupMgrDll.dll (12014 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\pcgtray.rcc (8426 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\syscleanerui.rcc (7214 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\RTPTipsConfig.dat (7 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\garbageclear.dat.vn (1568 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\sysspeedupui.rcc (10895 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\MalwareScoreList.dat (23 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\software\ProcessLogDll.dll (14174 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\TraceClearDll.dll (20085 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PCGSysMon.sys (2869 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\icudt51.dll (21 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\leadbytes (16 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PCG.exe (34403 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\homepageui.rcc (13902 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeeDoctor\Uninstall.lnk (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\GarbageCleaner.dll (27950 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PcgRtp.exe (25655 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\antivirusui.rcc (9154 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\HPScanPluginInfo.dat.th (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sqllite_dll.dll (12359 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\MalwareCore.dll (20183 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\install-img01.png (1831 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\traceclear.dat (6 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\GarbageCleanerScript.dat (25 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\PCGExt.dll (4207 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PcgShlExt64.dll (5844 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\garbageclear.dat.th (1568 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\SysOptLib.dat.th (4 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\HPSysScanner.dll (3292 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\software\software.dll (15760 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\msvcr100.dll (23213 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\scripthost.dll (9764 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgcrashreport.exe (11334 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\shadow_active.png (2 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\Startup.dat.th (10504 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\PCGMalCoreCfgV1.dat (12408 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\commutil.dll (22994 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HipsPolicyEx.dat (23 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\QMSysRepProv.dat.vn (29 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\PCGSysRepProv.dll (38482 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\pcgui.rcc (26736 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\res\pcg1024.dat (264 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\RtpIns.exe (2813 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TSSyskit.sys (4038 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\TFsFltX64.sys (2817 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\PCGScriptApi.dll (6577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp (4 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\msvcp100.dll (10714 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz21A4.tmp\res\close.png (1 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgui.exe (32058 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\MemDefragWhiteList.dat (160 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\HipsNotifyReport.dat (688 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\commcfg.dll (13002 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Antivirus\QMSysRepLib.dat (21905 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\homepage\HPInternalScan.dll (2383 bytes)

The process pcg.exe:2648 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\BeeDoctor\config\sysspeedupcfg.cfg (176 bytes)
C:\ProgramData\BeeDoctor\log\pcg.exe.log (19839 bytes)
C:\ProgramData\BeeDoctor\AutoTaskLog.xml (491 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\HPGarbageScan.dll (163 bytes)
%Program Files% (x86)\BeeDoctor\config\commoncfg.cfg (104 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\HPSysScanner.dll (73 bytes)
C:\ProgramData\BeeDoctor\log\Auto Clean.log (77 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\StartupMgrDll.dll (409 bytes)
C:\ProgramData\BeeDoctor\SysOpt.ini (20 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\syscleaner\GarbageCleaner.dll (49 bytes)
C:\ProgramData\BeeDoctor\log\NetworkLog.log (6548 bytes)

The process realtimespeedup.exe:1644 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\realtimespeedup.exe.log (456 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\MemDefrag.dll (86 bytes)
%Program Files% (x86)\BeeDoctor\0.1.1411.1712\sysspeedup\ProcessManager.dll (184 bytes)

The process pcgui.exe:2504 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\BeeDoctor\log\pcgui.exe.log (446 bytes)

Registry activity

The process TPAutoConnSvc.exe:1776 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"DelAfterCreate" = "1"

[HKU\.DEFAULT\Printers\DevModes2]
"NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1" = "4E 00 50 00 49 00 34 00 35 00 36 00 41 00 42 00"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]

The process pcgtray.exe:2368 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "pcgtray.exe"

The process PcgRtp.exe:3884 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\System\CurrentControlSet\services\PcgSysMonX64\ReportInfo]
"CleanUpRule" = "00 00 00 00"
"AddPriviTable" = "00 00 00 00"
"AddPostGroup" = "00 00 00 00"
"ConnectPortError1" = "00 00 00 00"
"CreateInitWork" = "00 00 00 00"
"LoadQQSysMon" = "01 00 00 00"
"ConnectPortError2" = "00 00 00 00"
"LoadConfigFile" = "00 00 00 00"
"AnalyzeConfig" = "00 00 00 00"

[HKLM\System\CurrentControlSet\services\TSKSP]
"InstallDir" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712"

[HKLM\System\CurrentControlSet\services\PcgSysMonX64\ReportInfo]
"AddFileGroup" = "00 00 00 00"

The Malware deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\services\PcgSysMonX64\ReportInfo]
"CleanUpRule"
"AddPriviTable"
"AddPostGroup"
"ConnectPortError1"
"FilterGetMsg"
"CreateInitWork"
"AnalyzeConfig"
"ConnectPortError2"
"LoadConfigFile"
"CreateIoPort"
"GetIoPort"
"FilterReplyMsg"
"AddFileGroup"

The process PcgRtp.exe:3980 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 3E 45 52 15"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"B1BC968BD4F49D622AA89A81F2150152A41D829C"

The process RtpIns.exe:2516 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor]
"Version" = "0.1.1411.1712"

[HKLM\System\CurrentControlSet\services\PcgSysMonX64]
"InstallDir" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712"

[HKLM\System\CurrentControlSet\services\TFsFlt]
"InstallDir" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712"

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor]
"InstallDir" = "%Program Files% (x86)\BeeDoctor"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BeeDoctor]
"DisplayName" = "BeeDoctor (Remove Only)"
"UninstallString" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Uninstall.exe"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BeeDoctor-Tray" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgstartup.exe -noui -traystartup"

The process %original file name%.exe:3304 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer]
"GlobalAssocChangedCounter" = "35"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2424.tmp\res\,"

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor]
"inst_lang" = "1066"

The process full_installer.exe:3400 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor]
"Version" = "0.1.1411.1712"
"inst_lang" = "1066"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BeeDoctor]
"DisplayIcon" = "%Program Files% (x86)\BeeDoctor\BeeDoctor.exe,0"
"InstallDate" = "20150105"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer]
"GlobalAssocChangedCounter" = "36"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BeeDoctor]
"DisplayVersion" = "0.1.1411.1712"

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor]
"InstallDir" = "%Program Files% (x86)\BeeDoctor"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BeeDoctor]
"Publisher" = "BUSY BEE COMPANY LIMITED"
"DisplayName" = "BeeDoctor (remove only)"
"UninstallString" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712\Uninstall.exe"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BeeDoctor-Tray" = "%Program Files% (x86)\BeeDoctor\0.1.1411.1712\pcgstartup.exe -noui -traystartup"

The process pcg.exe:2648 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor\SystemOptimize]
"normalboot" = "1"

The process realtimespeedup.exe:1644 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\BusyBee\BeeDoctor\SystemOptimize]
"magicball" = "1"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "realtimespeedup.exe"

The process pcgui.exe:2504 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "pcgui.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\Drivers\TFsFltX64.sys" the Malware controls creation and closing of processes by installing the process notifier.
Using the driver "\??\%Program Files% (x86)\BeeDoctor\0.1.1411.1712\PcgSysMonX64.sys" the Malware controls operations with a system registry by installing the registry notifier.

Propagation

VersionInfo

Company Name: BUSY BEE COMPANY LIMITED
Product Name: BeeDoctor
Product Version: 0.1.1411.0618
Legal Copyright: Copyright (C) 2014 BUSY BEE COMPANY LIMITED. All rights reserved.
Legal Trademarks: BUSY BEE COMPANY LIMITED
Original Filename:
Internal Name:
File Version: 0.1.1411.0618
File Description: BeeDoctor Installer
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://beedoctor.vn/dl.php?ch=vnn	125.212.194.93
hxxp://cdn.vn.garenanow.com/products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe	113.171.255.13
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c523613c7efda5dd
hxxp://cdn.vn.garenanow.com/products/beedoctor/000/000/001_AviraEngine.zip	113.171.255.13
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e815addad0f89c
hxxp://a1363.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1363.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEBm+jZUtRID+Aw+4HYShoOE=
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	87.245.202.48
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	87.245.202.48
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e815addad0f89c	87.245.202.35
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c523613c7efda5dd	87.245.202.35
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	87.245.202.48
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	87.245.202.48
hxxp://sf.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEBm+jZUtRID+Aw+4HYShoOE=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
bak.server.beedoctor.vn	113.171.255.52
n1.server.beedoctor.vn	113.171.255.49

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum

Traffic

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=483721, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 09:34:14 GMT

Expires: Sun, 11 Jan 2015 09:34:14 GMT

Date: Mon, 05 Jan 2015 19:15:17 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015010
4093414Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150104093414Z....20150111093414Z0...*.H........
.........P.OK.w3.B.R..9_*..-....][\....5'.A.jL..=.OZ...|.......?..R..#
YB.6q|...'.P..G ..h...I.H9.`G.M.}..M...3.......p.."Ug....U...7.3.?....
...$.._Q.\_./.....|.L..[......gzO'.C..6.....B.sK.D..H[......iPI.... ..
.Xp.T.]..LR....R:.m.J..T...lDP..p....J..d./D.F....2....0...0...0..3...
..../...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSign,
 Inc.1705..U....Class 3 Public Primary Certification Authority0...1412
02000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporatio
n1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1
 OCSP Responder Certificate 30.."0...*.H.............0..........'.....
.Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; )....
.0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p..^|
o....S..v.).)[email protected]#qh...u1T.].G0.]E...=._.....
. ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. .e0
c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......
0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .
....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$..H
......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D.....
......e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=532178, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 23:04:05 GMT

Expires: Sun, 11 Jan 2015 23:04:05 GMT

Date: Mon, 05 Jan 2015 19:15:22 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015010
4230405Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150104230405Z....20150111230405Z0...*.H........
........G..z./....,FS?..1..H.b*.!\..U.X)._...\d.V.....a.....). ......;
..9.pD.o4.....!...........5.O*....Gt...DM'...a.S../......<{;.Q#....
*..~g...p.._WB.:1.....~T....=.1...w'.p#*q..]$.NO..!..e5.`[email protected]. ..v
....~......F.....l.........3U..T...^p3.....q..i,RMX%&....#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.0

VTag: 27948442200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Mon, 05 Jan 2015 19:14:11 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~..HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modif
ied: Sun, 21 Dec 2014 06:03:02 GMT..Accept-Ranges: bytes..ETag: "d2e35
dc7e31cd01:0"..Server: Microsoft-IIS/8.0..VTag: 27948442200000000..P3P
: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR
 SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Con
tent-Length: 561..Cache-Control: max-age=900..Date: Mon, 05 Jan 2015 1
9:14:11 GMT..Connection: keep-alive..0..-0......0...*.H........0..1.0.
..U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft C
orporation1 0)..U..."Microsoft Windows Verification PCA..141220223154Z
..150321105154Z._0]0...U.#..0.......p............<.J0... .....7....
...0...U......30... .....7......150320224154Z0...*.H.............h.~oH
#i.J.vh_.....A'B..g...........F....9c.{[email protected].^ 4.r..Wv.Q.0.w..j
....c9..w....I..%.~.l..F.......xo...._...o...7BR.;<..\R/ .....b.(..
..~..]|.v.u.i.X.B....I......./*...P..A..fi.}& .x.v{TFP[.G......A..
<<< skipped >>>

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 279252244600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Mon, 05 Jan 2015 19:14:18 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=547413, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 03:19:06 GMT

Expires: Mon, 12 Jan 2015 03:19:06 GMT

Date: Mon, 05 Jan 2015 19:15:33 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150105031906Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201501
05031906Z....20150112031906Z0...*.H..............S.X.....3d*L....._.u.
.M...U...#..kf.?yG$Z...g#..=.R.~..#...S=<.;..K..,.......G..%eUb..'.
..K.vBd..u8`..H..4..\..2.........1.....J........N.......'|....}.xq...9
Y..l.f.[..q)DfS%;.}I......tm>O;.......b.0..(DZ.....x{]..\[...%.D...
. ..NM........5..V.;t.l..2........0...0...0..{.........[..I|.....Zm..0
...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....Veri
Sign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/
rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000
000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA 
OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.
-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f
..;]s!.\"v...|....][email protected]. ..W....n..*
..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.
....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... 
.......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#
.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com
/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o
...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo.....
.E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|........
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

User-Agent: Mozilla/4.0 (Windows NT 6.1)

Connection: keep-alive

Range: bytes=515982-1031963

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:17 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 515982-1031963/27347064
.....`B......nq5#..H.C3 ..w.)!n.\_>..7.%...i.(..QR..=....`..a......
s.355*..Z_.f=.s........F....%u.....JB..P......o>..[I..L...@*..~.c..
.%...D.O........DS}y...d`*.eR{.o1d.^....u...$.7.g.....G..h.v..p....W.T
 c.........T/t..*.7.......R...2....3V....2.R...x..8^.X.wq.`D.3.*..m9.y
...sL.qp. .6|..\[email protected])..t..DNWs.I...s.....)....../.,...8....
I...[[..;..@......#..QhO....~./...d.........x........._.[...bo.L....c.
[|.....Y....8q...E^V. .b...p..R>....N...=e.y..T... /.......Flu..-..
.qn..`...Ps..........c.~.=...j.XB..-...M....".IT ..=B"...[z.52i...-:..
......&C..3n......=.._.U..H..#.....|.....{....1....Js..pJ.....5._._..Z
.l...~.j.o..`].d3..w4l.Z..N..e.{._j.z..=".s.<..v.....7........~..].
kH._.{}..?I...RD.....0.... ...&s.:....S.}.x^o..\\.f....W...odGI^..a...
..C...g..2a.Ju.M..t.....|..A0x0.1.@.%.~Kk...t.w9.B.....|n.....K.hX....
.z.!..Oz/..._...e......~....Ez.._....~..g!.d...:....4.!.P.#.x..w..f3..
.*...$.....?....BY..]..HrD..q#_.*@..iH.k?#t.g_.W.v...^?"...-.......h#.
.G,.n..W-g...'.....~.........X"..l.J..|....l.?..} ...xh}.D.X..q.(....^
.N.>#.... ...o.r....U.gW'..WR....U.$u..!.b#.x...z.;.?..!A8W...0..;H
[C.b..t.....[.t.o.....\.=..G.=9.Z_.....0.o..J..A,9./.y.qL4...=B]...^..
0...>.7...[.....h...V.GWp.....D....I....4..6.zi|..C.Q..t.B...l..k..
.&..-P.R./..:.....mw..<$.).....7k..R.}.C|......gF..i...-_U.]).....7
#T.w..........>..^....3.p...X6........ZH?..$,....!,...{...Q.;L.....
 .Ma..'..b.......!@*...............X..b...}....z.'.5.6..I['f.........-
[email protected]..:6..=....9.?$....i.Z.g..f7O......
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=5675802-6191783

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:24 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 5675802-6191783/27347064
(|E...............]|.J~...N..R....tO.....}...f.!~|...c.,2i.Y....3wLi.r
...i\X.Q."../.UM.........C..........9...."!Ukg.|.t;.s.....1. .N. {}...
.._].;.(........k.....>P..0aG..}I.....V5...S.\.4W..6y.x.../*..v.A.Y
.L...bm.2.{C.'.\...NZ8\[email protected]........[..5E....
d$..Jd.....PR..:b....w....J ..e...h..8kkx....'l...?b.s..$.}....wJ.....
(. ..R...X...V..h.u...Y...i.....G......A.W.=...97..>..I:...........
g.oZY...@. "..`"...Y..qt.@..^....h0.....~2..6c&.y.....hb........."S.;r
X..V.2O.z...........H.R...S...D.A.)..i.5;...r......[[email protected]..
..rR.<\v...*S..T....!....U..uL.qE.....?P{&.C.g...a....-6t.0O.V.}q\^
.1%...I....1d...a.....].......pWO.0v`.......2#tw-Em.....([..}..... ...
..Xay..]1.9..!,.i..c0..P.{VG.Z.}..JG.g.#...7].`....m..(5.c.."....$.sO.
....0......950.....}.f}...{......_ZUX...g........\@.9....&'.w{<.._H
BH..l....[w..E...7......../.....u.....vFY/?......f/.q..A2Y._.t......%.
Z.[A...z.T..('...E. ....b..`...E.>........M.] ~;,7.....h.zM..C*#...
....../...@../........... 7.G ...{.b.5......1Z..QU....;r.7...z.].D..k.
p.........~....k.....J~....y,B......)...wka9;..h...(Zq .H.....D...7...
..O..7.~3.....r,DSP`..*.7w..........98.V.........H.....Mc..Uf#.3..}..m
\....s..r-:..0#..............j....2.L....$7..]....f......#.....at..2.z
ji....YS...L.......A$..1{.E....b..>..!Xfr.x!.d[V........... .....O.
......Y.`BV....v...{l2'.&.1G9.......Pd.....T:>Q!..`.`...S'.fk%L..=7
..5......Q1z....v...`O......^..8.<.'....?.L.7..0.g.....G.._F...s...
.....-.J.Pf....U...i7.t..f....*..p.....N'.*.G ....5?a...n%@.i...S8
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=14963478-15479459

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:32 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 14963478-15479459/27347064
`.'R."G..q...'U.F..{...,.....%.(....:U..qD....vA5._C....|......S.B...I
EDab..?.'.E..z.9...h.y2,...?h.2.;...i...\n...bj...#..."..j.S..9.A.....
h.. f.6<j.>$..h......`.=VD9.E4.Wg..w...5?.b}.JV.^..H...O..A....W
L. .a.u....D........o}.";..V_.>O}..p.....J...L..%........u.M3....z.
l....}..6h..[...8.....0/&.....(rT\.oy....VL,..Q..K....RT~...-.~...{...
l.54........m..`...V......#.....F.ho./......-../.F.....[.6FC..g.D..X!r
....I.Sn..!....-..>...7{...Q..ep.n.<E..J..../]..b..3-.6z..=.. .2
....s.,...34."B...iS....<Jt...c.%.5.......k.......)..$".x..Zv....=.
;....=.......,.\..jZ.Q...Z..N...w.T._N:........0..9......R.G_>.....
....(....Iv.X..SW.61..(.?.....E.2'....Y~'.F......b..e....S.t....D...;.
.:.....9j.~y....Yz...H,...).??.9......P.W......G.6.Ys|...jj.b.{.....2.
9."....P...A...,..?.y..A...D...ji...t./....U....]m;.y.....N.......g.C.
J.......b...%.|...!u*[email protected]. Hr..>.-....J.G..y.{B....J.........
...._#t.~.....u...k...&1?kIO.5.1.t.x.^.@.......$ux......N...........iw
.v....m.|.r....Q.....$.YW?....r....Zx..N.aH.u).U%.o...q.U.j...?b;.....
U..Bw.. ......C....B..K........D........U.#.XkB.....#.1.1;N. ..'iR'.1_
..z_....".Kp...}.iE.=R......o.(....2....!b...a...'.,.6........(...i..~
j .D ......8o ....c.D.|.>O..BS.f.n....W..,vt.......j.....5$p...vIz.
..c.W....n.6...%kN[.S..M.6..k...t>.......$..{......._......]..<.
....W..s.fa....i...{...5y?...@.*.m..!..v.j)..4.J..4.Q;.A.v....w...7..&
gt;Qpx...[.E.4(&...h......V.t.....`..mH...-.#;hQ -qH..>@.WV........
.z'.6........v"....5....Rq..s......i...*.......*...7,..p..Y..V ...
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=21155262-21671243

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:39 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 21155262-21671243/27347064
X..S}...l.`.=..'..-~...\..qm..4y.9... BM...i..MKZ!.V..}...:2A.....g.R.
o..0.C<.5o...jY5}.xl*...P.1u.............(..|;.O..R.......n..RS.J..
[email protected]`_V.#.w.^.....GF..9G...! |B...{...6.... ...b."
..[.]j.....y#.E.c..7e.lN6V..o..........H.(......gY..)"....`1...<.l^
....._.h..... ..&2...8..F)....fM..P..b...%...n.3L..".:. 2.W.6.."Wy...i
.x..q.#....RF5.n;....h'{..b2..|.6.4![uA...X%..oy...L....C..V.}........
..C...u. .: v...o.4.z.1.q`Xx.Z..X..`......n]M......M.<...!.m....c.y
.ev.j.=$..L.Z....g.(.....X.rzNs....T.6;B....9|....%^.....L.s..........
"H.. .q....z...^.ry...q.#{8O&..:.,1.-.=.1.....72.ZQ.Q...'..0.....>5
......uO....e.........Uxn ...k>....W!.$.#.P.hm."...W.....\.C.'.j/."
.=..e)..l/"..;....^~...../m...[u..-..L....b.W..;.........Jg..3...Q3.K.
../n....wq.$..4..f..<....Gmw.Pg.H.(.@..=..]5..,.|.....Hc0)|....Igi.
....^*.Q..w..N.$l..~..w6=.....kEP.coH;.5.v...!.Ot...a.o.S...?y.bz.*Mm.
._2.s)@L......w.......W...W..|..-..;/*...3@...~.0j{R1...E...]0.N5.W.a.
.i...Y.S.8.m.W7z..*.I@.[.6..a... .......%.V.!......Q8....a.&..>B.V.
.D".......R;u}.6 7....-...VX.W.m..a.[p...C...kU.R$j.N......J....\...xI
...9.\._~.........F......-..U...f.QI.K.M..m.f/e...l....8=...R.n.y.....
..........@n"(CQi..a{..|....5../K..4.^,.S....c.. .y....kam7-w.........
.G.6.7... .[.....v.)Jl.....sh.w.C..L.M.....b.9B.D...."......"/.n.>.
.og..$5.._....<Q.].0..#...5d...~......i...Hn..1....{.p~..K...Yzl.. 
KOc.O.#...-/V......t.....<.1.m.....vG..C*..KDr..*.P...f...5.....%..
..b....Sj..*.....z.5..Z.....k\...[I.......?...\......Qp..._...A.8W
<<< skipped >>>

HEAD /dl.php?ch=vnn HTTP/1.1

Host: beedoctor.vn

User-Agent: Mozilla/4.0 (Windows NT 6.1)

Connection: keep-alive

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Mon, 05 Jan 2015 19:10:15 GMT

Content-Type: text/html

Connection: keep-alive

X-Powered-By: PHP/5.3.10-1ubuntu3.14

Location: hXXp://cdn.vn.garenanow.com/products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

User-Agent: Mozilla/4.0 (Windows NT 6.1)

Connection: keep-alive

Range: bytes=522377-1044753

!."x..ch.|c.R.)..x}.u3%.*.n.:)..M.n....w...}....}(..}~..~$q.{i.....vL.
O&a....Ch.{]..\VV..\.~....{..8R.T.P.-.......~.1.....#....R_.........Q.
.c....g...qq9'......{M&W-..-.-...gS..3.......h-..<.....i=p9..h.C...
......?..j..8...B@.....~y...*.~g..a..'j}^d...#.j.902V.7B.1N. .=....CR.
..../.R..|........X..R%.`C..A'3H%....>0..y...d.Z....xB.\1..A....-..
..-......Gh$.*h[u.u..{......p.....mu...{....,H.mk .U..f....-N.X#w.....
...o/....9.y}.;...w.....Q..7.W.C.3<.....0{ ...x..G<....?..Y.{q.X
S/.z.[.'......(...u{....g.....'..|.G{s2:.]I.ix<?..0u.d.... ....LO..
._.E........)j0.5.bW|.*...|[email protected]."xUX.*.^..Sy...IF..
.p....MU..|.....*.})R.)...9..DV]n.z...}.<c......9.E........f....I..
....F...9M...{..........z.......J1......:0B.;]An.D>ZZ1.c.z..7.. ...
...M...y...038g./[email protected].)..j$~.=.;...X'...3:O..u.;. .?.(F..
>.X.9*M.l..M.|QS.a.....,.=.xtB;...|Py.........2x..N.y.Ata. ...xk(9.
..w...<..."..H..F/..V>$/V.@$L.......|.05.'`....!............9.V.
.<.H...u.7^.i..W.H.X.|}.u....'...})N.....&..........#.|.si.0._.`...
..P......;.....)<....%.....>..y........!?.._.<.FS#tOn.TT.....
..^.d.^......n....^...b\.R)...m.'..E.lH...|...0V..C.W.....F!....J.....
[.x....S .....xe.x.&/..c..x.......l...\..#z.~..._}.9.....W.O_w..HL..2.
.{q..dh.K.....&.I..2v{....,.rF~M:?..\;.HT..).z....>...\.}8.?.p.....
....w...........\.......3c.=8.7..O7.....>..M..)E..".....`*.......[.
\|....S.J.......!q.i/W.....o.Aa.........q>l.|QS..}R.:...x........zt
}a..z...7..N.w..7.;.......f..-.;....>z.{..".P.1\....Fa..?}..O.g
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=2611885-3134261

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:58 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 2611885-3134261/114400751
..........M.@..:b.u?.l..o..=(..S....(.e.........,[email protected].~...M'.
..V#.;...S..#.....~QO.. ......u.?F...^!......<........R.8@Ci..<.
....2....gl[...3_....H.r...{.|]w...E....Q....8..'..1.n..."..5..[(..T.-
}(.f.l..M....pF..X.)..NF/>A..f.....'M.....u....9...........W...\...
..u:.:../......9x....G!.#N.L..?q.~..FJ[...0}g...:....hWl=:../.W.3.#..|
...*....0|U......u....6...?...)v.. x7...f..A..d..l........z...!.C-.[.?
`.....b...x..........1..bkM....6.b..o...\`..[.....H.m...a..Q.. .T.?.a.
#.6.#6,..&s...._...k^...2..IA...X_.W......c}.......>..p...?...B...U
6...v.-.6...v..a...Bi.2.8%.m.%.T..8_....G}..../...p3>..(........M..
...r00.c.w...k........q"....X.S......,.._.....z{..W2..V..*.C.........v
]....G.6.7..z,..r..G.o.\.}....K.....#.....y...Q.w..8b...=..v.5..9.\.I.
F.3......A4..........'.....~..A......b...3...sz..f...s6.-h=...S.oq..&g
t;......l*.....xt..Lk..L.gq...&Zat....g...8.......}...?.Z.L.........U.
......R.C.b.Z ......u....?.@.}9....u.=z.4.JC....F.....&...F. .).UF. . 
........*...{.]<V#0.....[.{_..!..S.?:.5e...#..x....mq.=.O.hBA.u....
bsM......a..L.A`.:.zA`Y..L.e5.O....)?..$.~(7...,.x2X)d..2..0...0..8...
...f.....[..!....Ke.t6^'(.*...4.*.;s..w...L.tf........I.....<.....]
.c....?......'....2@.."&..T.d.d....4....U..F...X.6.uG.n.{...N.O.;....#
..C...q\......[P........*f......F^..:...eBW.l.g..X.....x...^..>....
..0.cIn..j.I..:.y$.2...^..0Ox..U`...g.Y....Jv.%..F\.{K-....oP^N.'...7.
 1......b.Vb.V.{F|%.j.W..#...F\.....*.*1[.u.W.^...\... O...U........I.
..^*....#[email protected]../W.M..|...&..0_...7...!.....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=6268524-6790900

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:03 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 6268524-6790900/114400751
-2|~..I...-....E::.{.T....g4..c.Re.!..fM......nk?....1.........b...{&l
t;?...p.sc.......KV.O.I.-.V.......{.%..Y.i....-k.^/m8.zd.....a.o.....0
w~..\.Ya^ .}0A......K.<%..3i.....w^. 3.",........J...{8)A..........
.$.Y....K.%..bI3?T..8s...G#.3y..4$A.z.I_..D.2.`.......8........2.E ;.&
lt;.....k.l#.............S,.....t..]..I>.c....".....|.7......2.G...
.9...|...._.......g`..n....r..^..]...8...K...`.:x........cc...8.>.k
.g`9...;t...[..~H...........xD.....p.c6..`..6........*...%...-.=_...8.
..~.....5.............7.....,...Y.|..}.................c`... .1...t...
.<>...........?..&:...3..>....S?......\.....\...I.|.`..6|.`.V
6|..B..D.X!..o.[...<...q.,...m..q..4..m.O..p.v6\.......?..=.......)
..q...u.0..x........z...!._.6c.l..u......K......5.....SO.f...xl.....p.
...E#...%..#..`C.0.............X_?....i9..G.&S..c...J..h....T...T..8HQ
...T.7.5..9F.Q.......E.Ri..tS .......b..._.a..Q......;.?\.....*..)BWW.
U....lN"_ ..........O...0.>........#?>=....M0....~..t.u{....ru.{
...q...ch.;>.>'.........xy'....W_.....F|l..z..n.Zxm#K.Q...N....t
."f.d#.......k..Wm/.q.^.M~'m.Aw........^.:.n.......c...!s...g..s.]...D
.n.t...{.<......y{...O..w|:}...3..Z...?.Y...8.........yX........?..
.}W.*...j..Hx.;..........1..v$,iU...d.....y". ..5.....#.0..*.....G4...
.C4)>...l.4..kD..C..h.|he.&..V...&F..6..m....C.@..|h3....Yd.3.IB".&
@..}[email protected]"j........s@!~4.o.D4~.......U.../.|....Lk$K....>
;....'.M..:.t...^..(.._v.hNc!.....\t. .....P..[.99..L.9|.R.;.Y.....N.^
l-..;...{.=....f....Hv ]...........m.i.tS{....m.6......Hs5..w.[0l.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=9925163-10447539

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:08 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 9925163-10447539/114400751
gAR'.}[email protected]#..DK.G.^..4ou.'.;k......~..>.!..eD.}...Y.&{{..`..[0..&
gt;p....EBr..J..h3sT.WLh:c..)[email protected]. .d...*........1....L
D....Q.Et..d.W).e.........dh.....\.....F.f.w...R..-.s.dD..p{.l@"p....G
m.....m...Vk.>v.vP..#...d'.P%..!...$..q.,...a .MA. 8V.8...JU..f....
.m.D@.....<.-Yz!.X. .H.cM..be....L."8I......7......7?8.R..?.x......
.p....`....z.X..X-V.y{..jF...W.........o_v..qa:.A....,..F......X.C.v%,
..<...W...1|..Fm<#...U...E...3[[email protected]...._..}.%....p..h...y.
.n o...|MI..D..FI........Wm./......<j...9..3......{....Ac...$..F...
...m....m..e..W..nzP....O.U._..3.pN........=..Y.g.........N>....t..
...^.Pf.."2.8.............:.y...(.|.q.4...?F'..s..e...7..-0.|?-$....vD
5<H.(..D.[..{...KK.6..........Z2.e.$}.S.A.FB_.a.I~....."....2.5=..x
...... .D.5H.......de.T..iL..Og <.1...........#b`o...m....B.. d..t.
...8gU..#.~.G[..f&.HzeA......1.....h.......q.4.!K....x~./...*R........
.&fe.AY)|........a..b}QF.S"%...-.T..TQP'.L.....U#z...w.U......@. ..&.#
BC#...^j...A...hJ..Yf....?w....)..y.l.[.B......,.....a.O.M.....e\....S
.b......?z{<..1..........l..yTG68..C..B*...@c9Y49..)....,...l..Qf6.
$MSr!H.hW.....H.............=(.^......IX".$@.[k...k.....I.~..Yys=.....
....~.Z"a...)..L4..n...I..o.-...L.T ..G..~.y..... ...D...=B....j..h...
....}*....pt.w...)..2Zv.3..'...L<.&<.e......j..U.....Y..K..;6...
..K.7..6.(..6.XK.t.?QmX............i=......=..f9.x..h..O........6.!V..
.....Pp..Q._.u..E..DW~..H..J............g4...0.|.....!.....l..,.......
{.:!........~.7.C7)......o...7v.Y.Av.!.b.ET^..\...3........3.... .
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=13581802-14104178

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:13 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 13581802-14104178/114400751
....Q.K.yFt..o/\(.N>.~..11..'#.T..Y..DC...{..$......p....}.......J.
W...._.3._V.!\c..R......x.DsXP`]...^.\.Q..SprZ.2.... C.,........&.....
ji.d.i.j....Q.c.~.b1..7...........P..N...Yz:}e.5'........Yw...K....._.
.nDl.`.zjz.x...B.E=...Xo.z....`c..),.$e.....NF..o.WSBa...6..c..m.....&
gt;.M...aa..2$-pq...4..i..l..`2.U..i.(x.. .......<_%.../....].Da..Q
....l..R[..R....t....C.N$i_...[..... 9..*...c/.l:R..{*.y....B..4RZV.Y3
3.....q'..Cj...........V.sf........Go.........;Q.....^.....&....c.(..X
.....Nq..$.2.:.7..h..>\.,.o..P...k.#........<.T...v........g..^j
.a..K?H]\....e8.G4.>.|.....O...F.!.R.....1...........$..`5x.C.y...g
/?#E.3... 7.e.;....iy0....c..F.....:...#.'....s.up...k...;k....<tE.
....%.}X_.....V.<.h...Z....V..M.....Q..ZQ..9.e....>..-.-.s..l.cS
.A.............J;...d..y...l.._......ue.......}.R.{...C....S2".ql.."Qb
w.8..Vr...v.[.O..X.,1>......=R=..*|..p...rE..LN...3&n..x44.......-.
....-.j..!z.%...XC.Q...9...r.3.y;J.."...qm..Y..q......R..N.Hn.../..c..
...>...R...: AS..H.{... ....m..U../...\i.C.3..b..(m...}...C..S.,..'
.JP..*...z...<.I(...i.on.` .Pc./......>d..gg.W..&.W.t..?U...6...
AU..].;...}...2.co__mH......X.....5z...m....bV......R8..0........@....
....Cf.~.o.c...K.K.q_...l.8.4.Q..dd.... .:....{.....wo.vp._..K.{.....v
0..S...(a1..]...s..p|....0....I...u..Y*...]...SD.l...aNy..{...R[c.T.x.
.#..v..?...oG3...P.......QJ......Q..9!.,......w.N0....]y<.......a..
..m........0.e8.......oA`...T......p...u..... .d....%Qc%[email protected]..=...
H.}.Z.@=.A..............*.....w.......f?.U ...vu....f;...j"..Q....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=17238441-17760817

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:17 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 17238441-17760817/114400751
.fm......%...EI.E.N.1.aj.;...&.....4.......&x1.<>..#'......\....
y..........)~q..^..Q.. .......A.....[......../...2..y.....`.aCcI.i....
C...#..t.S$.]..C...v...v....;7o..f...w=....~..).q|.Xm......H.nR.j.)UhN
[email protected]........."...6......p..[f.A.S..0...
...T.8..K.]#g.........*.......NA.y.......C.xz.%..9..G."y.. .Xo.9...C.|
.... c94..-..8...]#..K.*J.F...J_..=VK...P....R...}....9._.....R.E..O(.
.J..L.4.~.......(.u0.t....X.oMc.ef.r......B.M.A..g...c.H.....R...Lc/7.
[email protected]}.'N.....M.1..B.9.S..U<l..,.n.q.S...\ .R.....(G.
.....yOS....UU...O..7..........v.t..^t...O.;T~E..q.&..@$l.6.....~...)8
..JJ...].Wu..m~. .h... Bq.V....Ya..D..G...lQ9...........h....1}y......
#.Z.^......JegP...K....zy..}.&|;.L.......NW..= .....Z...1..=.;...B.d..
....BT.|..".pa.X. 4.....[[email protected]..{......xh.?..2...
j.".0l....V..?.".......a..J..X...9..0.^..<..V..).{....Fe..1.(.*....
.......1i.6.q.......~...v.1.....dA4(..r,(....rhV.`(.)bW...|u...h..k&|h
.(......w_.*4.R 5...x.....B`..e.Y.Q....Q".....u.x..U...Bz?.....<h..
..hs.o...r.*".4J.>..VW.oOi.Eq......J.9.....nnJ.9....?..*P_..~b-L...
...y.c.SO.:..=...../ISv2..U..v(rlY....9.yzc.9>.,....K......I....L..
...^..K.4..Oh?~.....S..=.zS8XH...V..g5.z.....l....|6C#!..l......c.|...
.3.....J.S.K.xg....2.7..#..............$>."D.hD...j_....o.....O..X.
.(g...L@.).b376!....6..>..%...Pj.)..2.8.6..Is.........^............
.....F...........".4.........0....)..~.YD.#...I.Hl.Kk....:....:-V. ...
..}2...H..t...>..Q..{...c!.....\/..e.,f....@.....?;..].d.y.Bi..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=20372703-20895079

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:22 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 20372703-20895079/114400751
.....F..1'i.*@..;\..MB.tm.p..&........ZQ..m...-[..F`...l..../.!...J...
F.}....2.E..>4....f}<.....|.....j.......y..1........f...........
..WUX.].R. .1.l.U..y..`O.D9.....E...g^ht._.........7I..j...x.q.}.e....
[.Dt...2.h...n.....T9....."...w.q.k5D...G.Ch..2h.=.7..D...H.fj...").xU
.YE...<}.R.k?]....j.w..=.'_L..k...!.eR..........O).6Q...0.......!.W
.'0&#ozUK .V....98...Pt.n..m.y~.l.]|f.]..;...X......hat..}.........B;.
.h.....j...N. .4..E.:.8.P.<.....$`.s.4Ts...}M........t.n/.:a*......
....6..4D..6E.O..Iv.....b..V.K>......t..u...d.#....Brx>..7.....a
...{.b9I.9zYh.^_.....9..'..`.*.%.....6.....B..-z.T.....Qv......t.&....
....,>c.U..ll.vx>.o.go.:.q;.l.x..|..>S*[R.....&[....UN.B.....
t.;.Gi ..h....V..jZ..j.........,.{..!?..n..o..fW..o.0..{>k.O.Sk....
..q.b...yN.......%F....8.........C.zb7.....!.f....v...QI..%..R. ]..x.Q
U1O1.qaFm3T.5`.8.y.Yg........B....o..Sd.}M..<....d.L.....'..3B.0T.P
....5.eMY..i...*........H@.;..tc.P(...UC.^.._.S.G..!.[...s...zO.6.....
..?V.._"C..d3.Y..|.C...f.x...\.].Cc.;?.Y....zF......LWv..M...l..h 4...
..... .....5...`.:=Z......]........Gb...I..t.C....s.qb.{..V...`^w..r.a
..[..&... ........Q.k..x...Nj......\..Ch.Ur.g.=0A/R..1uM..]yrE....O...
...f..Wa0......~....q.=P..........M..;>...h.....$X.M.}P.g....d.R...
........1[....%....p..#.o.e.2......'....-..6.bY...t.hI...LS]....<F.
..*....r...V=..........Vfl....b..........IS.=..]...I..f..........(.f..
Q.bdi0B.....aL%...G9.....M..2J.v".dE.B....?hU*.Z...]..EE...a,1F.t...q]
.l....._V."......OB........~.T.\_P.y...Nov.3..S......E..q%.....P#.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=23506965-24029341

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:26 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 23506965-24029341/114400751
..a.>.v...Z~C.....R.pS...)7'....N.IK];..^7...%@.....f...q.o\...r...
..#`....p0....a....=.....T.OH.....;......dw.Z.........}...1d."@.....G.
.Is...w....9..VU`,(...7$....^......f..`.......m....)....S..0?a...U*...
..V...N%n...c ..N...I...sb].....2h..............`.....3......yC#....y5
..%,n...~qd..I..#v2........[F~n....V..<[email protected]..|.....rC
....9=.[.....)&{e.....z...de...=.Q..B.Q1..\...BA...k...U.8..2.?B,....u
XEc..`.#.-.....I".#..l....9#.%.c..........e#:....-.:.C..C......h.!....
."#.N.,.....:.{m..v..h0.q1.qu..NfL.P..........=....U..c.*.4.J..K=.....
[email protected]...\9..6...G.*.=....R......i.N.T.%.M...*.L.I....{N.U....J......q"
.......g[dZ..... 8...J&.D..1J.A........ ......0.[.t.9..L.*p.$..%.Hs./h
6;..2..} ...}'.....')_...t.J...3.W^... [email protected]@..
...[%w..S. .C..!.....-..xr.z.{...%yV...`...y.......R....y<IB?7y...M
d.Cd..-16......&..b..y..)..w....&I3..|H...n...-.~..j.h..5.79..r.IO....
"LH[7.......;..........]..7,....aWR..N....0*{....RD........h._L.?...#.
.......][email protected]^..f..C.1..V..7.5.9.lZ..S..t....
..T.%n.....M.m...xs.?......X.~... ..6..4x..;[email protected]..%...&...$..../..
........_.rI..V$.L..)..V..._C..i.......#.b.J.r..:A..b6X.u(.q}..\.'y...
.F...G....PV....8.k.[Y._...I`.M..o......0..$....L..._...............C.
.].$.........,g...5.GiR...................f...C...j./.C.r..9F*..4."...
......f..w...Xx.....e_./..}.7r..:c..|....)Y...;#....f....z..B....W....
=i.;.....O.z.Ec...F.E9;.8B......O*...E[.9(>*.O9.U..=..d.V97;;*...*.
|........H.............>we..8a./On.c.`...x..%|.")Pp_%c...'o..9.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=26118850-26641226

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:32 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 26118850-26641226/114400751
>.=..,z.%-. .*......`^-WfD....ENZ.J.P..|....T..<...Xf.d..gj. ..0
...v.0i1...P...)=......s.eQ.3z....G.9.\fSr..v....Q.N M...0-*S.x.Y..;..
A.xs.K^@.3.j... ..5.....z.....T..b.d.._...n......b..#....Y.....y$.(y..
.?d..#i..$..k...e..V`.zc.tUo:......V(..ni. M.HFSE..'.l...X...6G.D.:.z.
Z{P[.I....-....MM\K-...%....a.X..@yA^@.....'.b.b..R.'_...V.o...B..[...
...U..........:. a|._.....2.{..Q....0q.........rv{V..._.K......Dt.F...
.o>..`.h..M.=.....P.........../..`.:....A)....&.!..66...eB...Mx.&E.
.s...%..L&\..:.0......2{z%g-(s...R..h..k."....e.{.`#W.3.t..hEP..}..P..
~.._fR._:.]...x..v........K......".C...9.......>..... 0.v....di..T.
..|.74....h......}./c...S"...?...q,..i.).\B.....9... .y....8).~."a\ ..
...|..!.t...a2#.$g.V.......4A.C....4.y#... ...B.....|.%..q..xb.*..^...
#...VF.S.=.'.J.V(...EYseV....`..K..u.|o.!....?.Iy..o...H....BC=.vO.%..
...|;.=3.i....P..i.BF.......5...SK......H.V........V..(...I.c.F.s.._l.
{"-.O.....G...L.S.L.:.4.22&C..F.O.l.u....Rb.."Y.....Q......-Z?y[7..c..
#.P...Ph.....3...w.>B.....wV..W !....aN....h.J4~.&...er.....PE.xw&g
t;.W....d.t!.y......I4E7...&..W.........*..j.c........D.]r..`f.NB...G.
....1)....r.....S.1..........fG..O...4.X..P.z.81Y..~"..0.K4Z..B.......
.....j...%9j"....!.f!6...aT...G...kxwx.....v...'R.W..Y..K'.tX`.....S.Y
..*`."Kr5...-m....3..<C.n.e.6..E!F.....%[email protected]
..To.7*.i...e.*.g..(8G....Jf.....P<[email protected]#yU..../
w/...i2|l...-.e-\.f.X......(..a.L&)[email protected]..*..k....w.
.J....uS?......;.{.d........9Stm...d?......1Y ....lX.P..h..\..D...
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=29253112-29775488

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:36 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 29253112-29775488/114400751
}...6....Ql...,(..d...B.(B^.0.....Z!.yB..-..nh....z..,........Tn..fR_.
X...Q...G.S....C.........V..1........N.#k..D.........G.A^..4.7U.z.c..a
...g.......i....R&....|..\..FR......A..!S.8>..a.....=......}XK..'..
..-......[1J.8.MLqV.?$.....|....)]e..?3.(d.3..2...k..7..[..F..`..4....
...C...l$.....0.....C......4..T..v.f.Mg...4......?g."MvL.9..h.....p...
.....e..io.....e`......C...@.]......]........S%..?...l.,.I..1..f..G/..
.e~..? ...........h./.}.S4..a\.H.....X..}.f....|Rp.v.#.`$.VI.7d.U87H.M
)9.,.......To.p..]^.... ........}.../....ii9...cp.,2."...._........;b.
..?W.....I...?.......)..};a..[.U...ar!........k..i..%....E.Y..?=s..^r.
a9l..xg..........j...B: {U..e.....w......".........8....{.T...bw..`.&8
...\fs..M..bZ.......5......D.........i...=. .e}FG.&...1.-k............
.p...k.......`....l.u...|.Ru....o......e 6rf>?\...sH...d...j....x..
[email protected]#..*5j...M.$T.&......M........I.z...`......}<t..:
O....9^S....:1.B.y.-...Z....L....k...Qs.{.. ......m..(y..y8..h9.}.Ag.R
.z.z.%.....J....I..?..........lH..Z,;.I..[F........Xl@`.v....V3&o]X...
.. l.&....!`."[email protected]&|..Y...8/>X S.{r.9..dTLT>...k;.....
....2.....s ..............O&g.......5.....I......l....2%..P..,n$>.&
lt;  .......8..........t?X.Xa...o..:(....y...9.bl....%..-:&.x..S....G0
......YA.WK........}^...... .._w...L..}.O.g"....kGm...-C..e.T...)-1G..
.............h^..........G..P@.....,[email protected]... .w.....AzB..b...V.'..
.x...{a<..N..D.X.k1.....[%....A.tl.7C.1....=.>.-........lr...:..
R...b.g....D..~t}G...`}..$.KQ.vv...vq_..{....'.........l..*.R...mY
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=31342620-31864996

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:41 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 31342620-31864996/114400751
K.....1.B4..B...;..o........b.._$.{/.....C...y.. ...7.....hlcS.y.(S...
....d..../......uA..@#ztf.....}.d.}U..A..Y...Ut},.p.ix..Y.H]G........F
....z.'.%...f.f}.L3> Qu0>4Q..3 ...:..f... g.?......X........%A..
...EXg8q:.b((.....Pr.!M.mCp............../z6.q..(...dJ...b.9D......VZ.
.8V..*...A.0.....*v....\\~...//.[i.n..\].i....m.....b......~5.;....X&g
t;$.1.T8o.qj...Z.Q.y.a..$ok.]....-.-6..g........."(...=...4O.....^S.z=
.q..Z...... ..._...Y.....L%)?.x......K....Lv.k...Y3.z...-....T!]Ew...1
..;J......O..~M.7.GEy]e...WXS..;.....B....X.7..m'......0Um72...l...1.4
.........._8....9.I ...J...c..^...H.........VW..&A'.17..D.....}&....{.
 [email protected].)@EL..kY."......x....W...r.......x....=..p..........8D.p9h.Rs.
M.b...q.sQ.co?.i.9.d....O..oP...._..][.NR..L....U..F;8...4..]...'Ps...
..E.0.<^~$../9...4..Zf.A...)[email protected] ..r....f...q...wGVf
.*..1;.q.Q.G.K|!..#..`...|./....=..]Yn.-0!...V..k..n.U!....... ...8y.q
......[.~...>..w..|s...=......`>...v.4..(....o...u)..........m&l
t;...c.&.t..Y$.J....'.N....-......tI...`.L6.U3...1....#.y...].p..g..(.
.%{...,.3.[X.@@....[X...;p....D.C\.2.<.......qt...?.!..fvW.hJ..h.z.
. ...bR..<..U...I.si..,.`o........C.7>.....~.t..wr/..3#...y...2.
.g-.F ...?.YF.]..4T....7.$H.b.GF.x/......'..........4a.....b..EV....4.
.(....Ev...iq.c......o...`k\;h..#...j....(.x.l..."jm.....Y..@;h|.B.2.Y
....\..k......Rp#...........eGB. =.&zY......q....T..-IN<?$...s.^.j.
n..D...0......g..\....h.........8..1...J.I0...a..9.7uR....).%%.v;.....
-TU......Y.F..#3...{.6cS(..4.e..... .. .....!.Y.M....Ww....-..Va..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=33954505-34476881

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:45 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 33954505-34476881/114400751
.......5..r~......p......L.1\[..m..O.m...d3..q..n$b....>...F.......
Q{2...B..*p.,.O...j.u.Ot...t...v.~.....y..x.c.VZ.op.q6......g...u)U~..
.X..D...../..._J^q..;...C...~nk..F..6.......9.qw4...L..../jU.........I
.. ..1\....6......(i.! ...^...a...u7.'..4[...b....7.........7...?. ...
7].Ea..~..s[c....B>M.a0..6^|)C..>M.f.....r..).,.$..S.HHu.l\t..N.
.Q.\(...m).....e........A.`....F `...5) j..Y. m..eB.^. ...<.B......
...Ml.w.R....8u)....vC\r.F....o]9).l./.F.e......bm.........6..H]..d].(
.b..]....mF....1...!.]L.%B..Z.f.....j...h.i...!..o"m.......(...GH'*v.9
x.s3......6u../g.N...aB..<[email protected]$B3.Sa.....<..V7.G.]T...)._.
.......>...Y..&.a....*.Z..o.d.gmoW.rh...A..c.....Zzz.....y.....6..9
..k...O...X.0.e...u..r...,g...b:S........).i.^m....'.}.^:..~Y'.....Q..
..:.._.O.ND..-.$b.*[email protected]@`..~H.HbK......D...(v...v$c..
p....:. !v!.._..9.....6.E.:..P..@-(.....K...... !..nf..V.*>.7J}z.P.
......%~t.<....D..E...!X.M...<1....%..................x[....-u}.
>e.ZS..?....<f..X.Wnr...9...MN..0.R{5a...V..1*}[email protected]
]....y){..F..'R|O"J.E..9w.'.....S......E.z.q....&W.!...i...P.0.c.3.>
;=.=....>#[email protected]...#.M| ..#..f.."9....d^q..........
.A...cL.........&g...T....C......vzucx]R..x..w.t..\..z0..9G..'Sq......
..y.s....n.o.}.....c./G...q.P ....BA.,....6......SW.@..."=..j..v...C5.
...N.........H..# O*&m.zD:....i.^.j..y...2..<..{.{.Vg. .........fx.
T...~.se../F.....S.......iZ...t.E.......8.e...p.#..M....A..CpG...H.vjt
xx....R.I....... b........^.?.......3....){K./r(.. ..BIQ..r..t....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=36566390-37088766

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:50 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 36566390-37088766/114400751
[email protected];....o.....S......... '-.]._.%j.'."<.#.E?o....5...._Y.t
k.......O.....y.s.A...<.x....PX%[email protected].._.N..
.J....&............._%.^g..h...B..]?......UTR;{...'o..,..q;..'...kI_*.
....m..d_*...q....~ .uQ.3..~*.....wD{.ij..i..D.V.e..)...u.r..c....[e..
.Dg.`vV..h}..Z.[}-........=`ly@.&......RKpvr-...^.k!M.!I....D..S....=.
......T......J.....c.gm...m9E....O...W.....P.w?..............>E....
)yH.p...... ...$.L..a.@ ..l..2/.7gJ..WK......e(f.2..p..<:....O..].s
dGc...7fm"t.C.]. [email protected].^\W.. |.xG\%f.Y....B.
.. .Ah.<......j....N....i.{...>m...z..EXMGsP........DG.B..Zw.=..
@..t..n.aZ..3..dD.E..:.....(.....X...Q..e3...i.I.-.r[4y. co..EJ..P....
=.......2m.. ..o.M.m<E.{....$.pC...K.....b@....^[.r.S..Fj..!.c.{-g.
@...5.BZ..o.V4.0k.R..N.Mq..N.......{.$.8.....e.c.]Rv}...].. ...u5W....
?o.Y]M..._{...i.r.sC......_.....?^0`g%'.C.1.....|.$d..0....7(........f
..TAG........u/o,.d..au.,.u.c.9.."[.6.s\.]...lLLp1.....l7..<.[.....
.?.{...[.?.......j.qt.......p.....{L..En[B..z.S..c..).......s,......p.
......z..^..i.vq.t`..]].....aFi...y.b~..SW...;;E...>.2....m.t.bo...
.k.(\..O.^:/,Pd[g...>5....{E....d$...j=2=...../...v...R..5.....-U."
p..e.C..z.5.CU.m..m. ......0...v......w.l.Q......=JuYtoH.07.$.h.Y.6..W
.K..>.C..l..a.4.r..|TJ....(.AW.#.....Zt?M...(.W..Gx<M..2..V.V}-.
.N...L..........K.p.[)IkqKsT$^.).eD..lek..0W..k\.a.OC......{H.7.^Z..EI
A.*.......s.6..1d}x.|f.\.w..#....~.`TL[E..?....6....yo.P."K .[,.^....3
r.....o.......LJ...~E..o....SdJ..6....Tdd..Km&..2.....@`!..r(>/
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=39700652-40223028

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:55 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 39700652-40223028/114400751
.`.....F......J..&..|..3.j...g\h..x|]J.........f.Fjle.r......x.!.b..^.
.^[email protected]\q..Ke.....{)
..v.'.q....r.h.Pd....5...-..fK`..k.H`8.P..k. .x.x....T. E.,x.f$..uHo9$
$...d..?.....zI........u.P."muk...P1.P.....$....x..h....!..~.......:..
5..u....Nc..?....5a". ....%9ZKD........_...... .Ts.}.0..'...\ ..y.0...
.M.T,.0...$.5Z=N.........C]s.z%.F......vW.Fw...`IKx9....&.E.:...F..Lc.
...=..y_PA.........._8......O.'=j....#.%....w|.......J.:.........H..LB
.<.aLE..g...c...jGE.&2P[[email protected][...pUO*[email protected]
...(j.I.,.-.O..H4.fZ)...{j/..eM..}..!.....D.A.pe\.sv.z.D...Qxq.F.-..=s
j1s ...jk.......kN5...V>mx..u3.z..6T.....Z.6..k.....]...J5...8..a..
....H.....*....647.|..o5.QH.....c.....s...*..k.4..f<.W. ...7...._..
......T( .I.u....[.7....H...6V.I...&U.[..~...-......\C..)2....D[..s...
0e....w....Pf.?V..\. ...y..N.&.OR...h..~{4.Q.f..J........'}.....ID..*4
PW.........p.8.{u....U.i......j...0f.......A"B.........[.F.[....w!~!..
.......N..>.:fi.;...<=!...a...[.H...`...K.W.$.'y.....Xt.m..g....
....d.Y.08..:.g....._D.y.B.).O..G.....=......#..oJ..G.n....c.d..,..ltZ
.a(.._.3Q..l.V..H..O.S9.9.6....SN.y..[<.....D..N......?.DG`uV{1.O].
...Ypr..|\...C...Vh2....v..-...N[ .1..).T..h.../kBZLI....)oU...6..'r..
...'Z.s[......^W...^...{...c....$.,=.....%E..n..J..7.9<.3..V_..e0..
@.|.(.\np). r).(.R.!.,......6.(.Da..@0.$Fo.......Jzp....5x.h?.N.T.....
.0..QQ-l.cQ.....w tj.g#...e.m.Z.'.'...!MP/t!.......... .4"..R9i)h..T..
-,.B"13.....T..3...Y.....R&0.3.&:s..k..1c.VO..Bb....&.t....`....a.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=43357291-43879667

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:00 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 43357291-43879667/114400751
....ZS;(q!....'.....*.......9..r|K\.. { ..7#A9.=;.U...5...,....r....FJ
2C".......2...]..'.K....s....L....#..D....JS.g$.k...8..S7.7.C.iH>.x
J."_...@W.$.y.)1Mn.K.......^.m..~.D....v.6.v...qV.."...#.. ...../..1.{
J.:..6...&r.R.Gd......... ....MGpU..s......g^[email protected](1.RO%JG.b.......M$.
..`...27./2..:=O3.. .y?cJe.)... }_H.LF,.a....Ye&.1..3D..{.fC....p.gkD.
?...s2.l.D:...(..F.8OA....m.f...[...5P._rZ..............Q....1........
.4.z.....j..1.b..-..V[4/u,...-jO|...5.N.o.x.jK..V!..c.....*q.X..W.U..~
.< .....}...?........*s..Xl....$..t.=?....3.]O.N0.L[..>.{*.l.j.]
04.............w..n...M.~bO..*.f........O..<...K.Y....Z .,..p*\..{.
<u..!..t....HW.....B..#.......c.....p..NO:...h6d...D?l:..7{.t._.4..
p.....*....2...W0RsO-..r.NY..I..'O..G.....yc.O..O.k..k.A.P..{.~.A..?.`
..v.R....9......l....?%8 ..Nn&...H...G.....O&.v...N....{`!...).W,/....
.V.r.Y.E.....l..e......1.T..wW`.bc..x.~.T.i.h..}h.. ^.D..x1.......7...
.%.......V. .Q.....;.ph.. 7.K.....{.8""z....n.*J'...G4...6..r.B...#...
...eJ.{.yMd m..b....~..(.Pa.-....%.....AZ#..<.......f.%....e.......
ajx..9L|.U.9N.,....].p.......`..t.ah..=.O..=...........g..J.Y...8_;Z&l
t;B.......T..........Y..N7;..0....&}.;4....3U........mmk[3.....MC.?.qD
a.W.V....m.Y..p"..X...j....e...5...kW.......,@.kW.:........R..~...2m..
...^..J.Z.....O...........KL`O..!Qv...`n.... K....-...~.$F #y....m&...
..B...@gf(P!tm8q..S}.!..9.m.{.>.8\...........:.r.uX...........Y...I
....wbl..._.'([email protected]...".~.....*/.m3.....Y..../ ...2*..j.*I`.>.q...
?c...yP.q2..`.......Z.O..9}..i...[z.../~V......=.O...Uk[r.c,..#.B.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=44924422-45446798

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:05 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 44924422-45446798/114400751
..hZ8r...1...h.. |...C.._...... ...A...g8.]4../8T..S...>].o..pI=..O
.Z'..3. o.s.KCJ_.......J.3../.g.c ..PzmQ..T-.......&N.);..m......7..8.
.b&.}.cv..6P(i7..%./...............>.-W...J...&........z)Y.......m.
..._b.9^..J...{....C........S.,....Q...,..e.ec.G.....l..VS...2DB....7?
.....a...,..e...N.P ..4.....\.a..]6.....7.Z..)/.._Td...G....i.j...[.f.
..l.*."....V....>..... ..s.!.......%.'.!.....J."R......K;`;..8uk.c/
...-.j.`......zIV.$..OtK...,.V.#...e...|.z..#[email protected]^.
.Rm...7..*.. t.L....u ...........Z3..P...>o.........59.$}......n.#j
j.....@}.L.Q.U.C......l.Y4...F..H..;)3I3.F.xf......g.0..v.hN.;...~...:
Gh.N.../X~........!.` Q.,5<..A...].S.....y.|.|..9i.v8i.q....4!Ig9^.
Rbm.3.vor.w....'A...pm..~...3....5.WJK.3....[...:]c...:.......4A..C...
....P^......r..*......\.4..j...5..s....4b.OC.......L!..c.o.$P......C.A
.=.....|...N.t...ho...W.....;.LY9..y.D:..t!.....~....#^..........&...-
*xW.P.Inbj.x....A...^.k..... .'S.........Da.u...z...w....f.C.w\..D. k.
.B.:S.k.p@d...!.<....KS.imh.qM8....F.= .8.......o.rL.pC.S....$..nx.
..u...?;"...'.YB..%M-..6.r.S.M..N.f.S..h.....B.NM3Jq/...(]..&[r...~...
.y.2...&..).f}.r......J..a....G..j.1...m%........... ]-..,d..V......Lq
....({&C..h..Q..Q...............m..kV1M.ZS .&l...y..*..[..S...&.......
%..|....)"...*...\/.~...F'..;iE..W...C..~.]c.$.`i......1.B.... M..mI.z
\...#.bZQ......i ...-n}I..b#.>..........(.4e..3.0...>,.'.it...8g
.OT.).|..s.Sw.\..6g.Y3.....mkY..x._...6..0.....%..$.....e...W.........
u..Z.....Y.......Zn.|....z.K,.?^..c...Wtf%./......>...db.......
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=47536307-48058683

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:10 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 47536307-48058683/114400751
xVd...-...D{.3.........7..".,....gQ..b<..E.S./6.......(P.2...# .. .
..D.|.u.S),..l.|g^!.E..NN...j.4...& {C..NK....h..0?.1J|.T..6"D.T.ES...
#........q..D8..8p.jgY........^...xp?Kf...D.i.X.UM.........|.v.=...WK.
W.M /.js...W.g...3"Pn.....o"..9r..jH}:?.........O...&{1.#-..Zdd.aG.x..
p..(..1....<.\[.V..<8..D.Zl*5......~.\..X|...Z...q...R_.5.|..d.Z
E..ec.....m......7......!..sF.H[[email protected]<w.....p
../_........4r.r....]..H.....E..m....U.~..2\\...8...7.....D.......~...
].M...E...d.r...?.m.e.......i.)...5.."i..E.b...^..V...N..lBs.!d.._...*
WD....a8...t.....L....d.#..M.....,...]FKL.. ..P(j..H.2.FT....?.7....@.
..(.]XQ..p=C.......M&...OX.LaL`_.kE.1..1.B.'.....f...-....F..... lng.S
.7......N#.Zk.g.|E.7.Q2.......QE...F.....G............<LF.{.$..3} .
........M..}../.8...m.....:..r..=.K.8Ezr8.......lY|..](.:s....].....h.
.....n.......R...d.b.... }a......Hv..4..n.(.._7t...!..|H.....6,.X}k"..
.......2s...........uIM..8./d....W..N.....X..t......% ...0.......r.oo.
...~cm..X.9).-}.]...K.>.d....,.......h.M.....8....t.Z"Z.....7..Zs.4
....E. .r......r.[f......%/I.A[..9.Y.Dx....F.....).....eO.[. ..P....Er
5lo.. h....U.?.o.`..6.8.A|T..zI./...!.......PR..,..j.G]..!nj.......].f
NKr....'.|[email protected]...[8GnE/~..O.>.d,k.~..s..K..
.,..Tr....9Pd.......0....:.;...Y...R..pY..... (/[email protected]......
jc>........R....9.B.g..-.D...8..3.....n.p..Iwn).:a ..w.o.......m...
......'....... .#0...$[..........e...._.3D...._~.N...Zm...0T....".t.J.
h.m..H....1.....`.2"...'.sU..c..6..#....}.~3...zSD.O..,n....C...x.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=49103438-49625814

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:14 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 49103438-49625814/114400751
...[M.>we(.I\Z...,...)...^_..>.0.^-w{........m....V.....k..;.. b
.R`..l0W.H1.8=....P.*.X.D..0.m.Z....a..]Z .....,..P."..P.....4"H82_~..
...-p.m. )...u.....p!..b.H..7U..O.H..U...~.m.a.......~V.cA.b.$..z.....
..s.h.p..r.....q..X../.......>...].{.7.!1....A....!...1#l.P.$..~.75
H.yStFV92].....0.$0&...X...$0.Ia.9...<GCs.......s......?.p.69.g....
.......3-....5-:....p....~?'.p....(...$q=2Z.t.WGOc5.!......-.![kUg...{
5..[ ..u.........'..T..(P.<...4..Zi.{... ..{...y.v......H.....wk.l.
.#..v...s...v......pr.G...}.._rKI...cE/[email protected]..`..\(.M
..nW..`.)#..X....,.Xb../.>..,.ug..0pl.=.\.o&........&E.Mh.....t.. Y
.=0BQ...Z.xb.HFbn..xJ.p.=.._J*.....u_(.....zx..$.Q...<.`*j..iNm{...
.......A..gni...I3.X2.g\.ne....'..}q0....A.i..n1y....M3.[..#G/dR.3....
...{.|_'.F......h...^[email protected]....
...v..i..7......(........K..].#.cF?R6bM...=.xH.*..F..........c...86.n.
u2J..6.B.n"j......=P.i...h-..M..-:.6.>P....`...':f....x....0...{.o.
....4..b[.}..DQ...@"I:..#.}.k..po..Dd...(au......R.......R`.O...8.K.=y
b..)QC..RA.T<*..........,.kv.........<.......:.EB~Q./.ef..."4.h@
.9...."_=.. ..R..}.x...W.n...^..\..8I..X.6.>....f.......f..C..4....
H.(...=;.e..{.....8.jS...D...Y*...%z..Q%Z...v...2Q...Q}j.V..N8.......%
...J....?..e=....M(..]..q.ec.O..qz;<.u...\..Ia..Dn.7...c..8.b=.....
...*..0..:...U7....ym..8.c."..f.V\..)..>.......}ow..d........ctg{U(
.Rs.5.. .......A.Y.-...".....iR.V.6...9.....gVX4X......?.1.k......5..X
D...j..c..:.oI YT...O.-.F..f=._.....D.A..0..YYV....|...hRW.D...v..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=52760077-53282453

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:19 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 52760077-53282453/114400751
5..C.y.qO...f.V..K.i -..M..." ...J....0.F*...I..{J[n..:.4 L.Q....t..QG
!...w& ...Q.B...R..y..n.EoZ.Qc"Y..Mg.......... .qt.j%..............e..
&.&..NBT.g..=6.].o.........D9..7.rH..rb....V...d.b..A.:]z".zSxs>c.s
..H...*.|k............i.7......k.i..[.....b.(...3.I.@.\...].....Q...B.
<|A.......l....f........?w...O...~...l....i.W..X..-.6..3...S.....*.
N..d.Z.oS..,..=*[email protected].?.0.,jE....#~...........Bh~.f.T...{
......._..C.....^.Xh..I...U x.2.gF...U.x.......E-...=...B...........Ts
Ee...0.$T.2p.]..IRl.U.i.(.....-.....z..{./O.......g..p.i.[~...Q..b.0..
1..).....RB.....[.."Uxc...R...?.E.v{.p...x.D...7....-.e9.t..lK.c..mv..
.......4v....j(.MB.....<...i......0uDC..0.T..A..M7..?""....A..-K...
.....D.e|....MW..%<.b<E...P....O.K..]C..h.>!X)A_.>...&..$P
o..^.N1...c......~ .w`rq....n92.....`..[.-..d.)..N..T...P..]..7p......
.h...~P.....B.B.f.....(.Y.=.....#`..D....j...._\...........K...7./0...
S....M.....Z(:.2x.w./.<1..4................a.... ..I..jQ.K.fu.P)...
./.w.m.q............zh..L{....;.....`...L.v.jt..L=..:5ih:..rS..p.L..A\
l.<gA.....a..i. )..!w.l;....}..A..E...I..l......T0.....x>....[:.
.Pi5.^.....B.N..v4.. i.F....\u[..1I4m.Ocg`u..........y..`..g..q.0..#..
}....B...}.JN....K.. .............sN_........(j...h.k....K...>.(.Eo
[email protected].....[3..'.....D...rv..m.Te>&..
.o.c{.Z.P..y.C....X.`&>.... d..r...bXD.m......WQ}~...z"Q.V.YA'%.y..
..s.0.#..qI*..z....jH.Wh.|~.d......b-6Z.KO^......n.....b1...xY .....@.
p..?1...2m..........S..{.........6s..c............g*Z..,tV....i..4
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=55371962-55894338

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:24 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 55371962-55894338/114400751
.....P.ct.mA-...'.0.~.........X....H.....y...Ln..4ue...&V@........{...
..[.......0...v.Q...3.yZ.oa.J.".....&........./.4....[..*"..*..O.....!
....SOZ.Re...,..D(z0.g..Wb..O.2C...........2...,kK-.........3..R).W4..
...$.....8.(..:..jG8P.AR...s.....nu3...X...<5.!.U..e.....p.......e.
...K#.R....m.-...,.......yK6..p.......`...w....N6.._p...=.. .:BF......
.. N.....i....L{..c......$..5i.3..; .....h..)...v....b.q..~........K.8
....C*wH.Z...s...:c.^rB0.].>j.R......;.....LzQ.H......7....S&P....^
....=....I.s.5..L..p...:....v..>.."...q....]....0.....aF...........
q>..2m../X....W8...H"......t<8...w...."./d}...4z.f-..w#.p} q'...
G...\..H8..).B.Z.......a,~M.hzK..>.....N-....*.....Z@.........=.GS.
z.b..n.r..".......@,.]...(.a}i.....s...0*..Z.}.d1V1.u...0.b......K..1m
h..n..hI.B..k.s.>.`....p..A.D......B..?...#`Q.S!.Si.... 8c..x.Z..m}
#[email protected]..[...Gr........9]0B..?.A..7~.{.4.f.N
...J..6..].....8b...g5...:~<..!........].D.M=yl..V\)ug....8n.....t^
k.........t].$;E.7T......m&W....'.Y"T.......Y..0...7..;....F.;2;Qe.Dy.
.Q.iS.%..%.i|[[email protected]<9.......-:(....q...r...JT...l6
..1EW#...|..s..4S.k.l......].;..5. .....~....../...}.....`...........*
..<..V..v.j...k.sKP......N..t.<..,K.c.M...*......bJ.,j........Sy
...m}..r.T~B.B.......S.v..Ap.......B...m.S.i..0..~..i....7..0@:...?.)A
w....T."..xE.....0...2=f7;..l...0..Y.x4>4.$..*.....X...9.'..k....HZ
Q.7.....[.s...S....A.%R.ws*......Mv..Zy...P.?uW..<?$.G..4..=..X.4.X
..Qt.....A.O`..._.....E6........d%...V{..y..W#.. ..K......xF......
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=58506224-59028600

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:29 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 58506224-59028600/114400751
...^.:.f..!.X........<V.lB.6..G.....z..;cd..X..o......d...L..I.t.dw
g.......?..'.W.....!.......z./......x{.............w.q.....O..TN...A.l
w..r .K...[.c..zY8 U<gn.t0m...%....sT-..D|g..n....^7f...U =......~.
..Q..v....(.D..RF......it.t.....{.M..#.xpT..Wf..b(....3d.96.I..N...;.$
..*4....V.p...3qn.o..........V.";z.(....W ...}...>M...R...bU..$...J
".<09T...y.H....../74/..X...pH.V....NM.!..=..j./.".H..z2..t.#..}kY.
..H...f.....Ky...0..4.C..Y...\&..u.(F.....W....g1....uu...Y....e..E.Q"
u...$lh.l.@B...~%.a[.6...#..~E '*..U.53..H.y.7QL.E.k..&...120......}.z
....n...zNa....j.Ym.A...9.*3...e9\.L]I..wkO..B.m!....Y.Ti>..O\.%Elr
~...`Rbn....n..X.........|..O...L.u...M..W|ps..<),$....I[.[....B...
q.jT..U.......^.jj...p..7.&u.........Z.?..../...\.h.pbZ..x...v.Z.L.c..
..{[#[email protected]...<......Z..].UJ...6..
...yAKv..9(..S..` ..y...>*...HX3....u..R.k..0.......&.....[P.$.....
.....Z......Y.h/._.....E..._o.....s..2...z..u...4P.Z..'.5...p_.i...M.M
.=...N...*f..n.'..S..x.i..V..h....XP.m.U:.".b...6f#..a@(i.r.%.F~....M.
.5D7..r.j.k.B...Z.y.N..8.;...k'..h9.!*..*A7..d..k..T.u..l...(./. .w.".
^58T...}@Z.R......v...U.kBm..........oY..."..`v>#io..Qq!|...2.b.C..
.f...#.\.......\@....H.A...z......#].f..2K..zd.v......^..QFS{....h..7.
..iT.....&.Q...._".e....<s9.Q.,..s....B.vf..v.5R-......MD....h..O..
[..\D....7K..`b)....`.]x.*f.Q.h.# ....Mk...!P.}.w.......XK....r.|.j.{=
x...~bR.d...~_......K..<.M....s..xu.F.. ...Yo0J..X..2...........Kj&
lt;......3m.Yg.B;.R.a...f...)..O..T..P....6..e.....q....!.Q..I...P
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=60595732-61118108

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:34 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 60595732-61118108/114400751
u.....{[...............#...G..V..J.-..X2..*...:.>T..<t..........
=..V..r......HD)b..&..H......6..DL.....I.. 8./?.1_...M.~.GSdHS4Z...K.s
.|././......D..;.!.ps..kS.O{].......&.,.tc....&.N@..)KI.....%.O.zQm.XZ
%.9S..=.P.&;..2.{...i1...:E...d....$.9k....4!.z...8.Q.n.......&.\.....
Vk.<R.....SH....<...$....Gh`H.....u].).....t."q7..l...).....a...
}.6.a99..LX.[...u........w.-.6..'m...\.G|.".._5.......o...U.Hgn.Z..=..
.sM..L......i..i...S.........&".=.}..RA/.......3f;.DUVn$.tv.8a.;..l...
../.7.``Oe...,....5.kdMv.....6...`...J...2.Op...-.... ()3...z/...$....
........?w^ZBu..(.K<....-...2...M.Z.`]....3.W..:..C..F.'..5.....H..
.w....2.x.3...!5..R'#.l.cnm.N....A...;./.}R.3....>..a0.1......y.".-
e..;p.....SFO....8S).....e1..~........S:y.0tM...X.........;.3I....sr-.
....."^e...:....,T.x.n..G.'.`.. ..BVp7.{=. ...R..|$......~...s...[....
........<...J|.o.....`..kzL.....T...........hm%....j.......@.._.#..
......B..x..}J..:I..X.V\...@S.#.. ..1..P.e..ZX.........._.;.9w.BB.9.. 
)...G.>QxIy...y...l..........0..:.T.`.....2.4G v.....q.q.To..6..#.l
.0.b...,...,/ ...*[email protected]......./..;[email protected]...
u..M......YSv.......'ic....(.._.....I.......T.'.J.,...U.LU$#._.<D..
.s.N^/90jP.`...:.&...B..m^f. .?......7.{j.....R&3.^.` ....O... ....`Df
.......4rm.&..........G..CQ..8........w_'a.....Pqz.W..}[email protected].........
....V9s.R.B......q......X%......|.j.....B...iB..S- D8.....Y.)*v.=A....
SZu....*...<^Q.........(9...7s...9iX..b.j.... ....Ib.M..........t..
)...#.,.;Yg....i..lI0..d..........$.7.>.U&j.a.^.I_..&q...Op~.A.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=63729994-64252370

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:39 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 63729994-64252370/114400751
j8....hT.`nSp.LY...q...........l."..../.....f/fi.#(...........b.......
.Ms.-2...../[email protected]^...OO..4...U7.........
..Q\..Mq[.9..lZ.*......YH. !........f.. t.....Y.:........ ........VYB.
...g;..);.?^... ...>.H...cZL....7=...*.......l..pI.}..-.r9.........
.).~>.W......F#/..HD...OY`t....X.n.}Z......f<.._L..]N.....w.~g..
....AY>.....[p....3...rk...y......\;.J.#.z...q|.2.o.....L..P..#<
6B*9.A.:........U.....oeF[. .{.....*....EbJ..n.S8..'......[v....N.....
0m...3...9D.w.......... [email protected].....(.5..L.=.\U......`..{....../..!..
}".c...:.d[..(..F.C.Ki.N.$?.@..{._V[L..Q.........$.#......9yq......|~.
.j=...8.....3 ...8{v....F...{.V#......Y....SJ?3........w'=..S..[N$a.v_
....q{....iN1jH..D d... ..b.ZS.:G...b..?.z&Ao....5.y..?........6s.....
.I:_...C....(.6....q.D......pv........-...L]j[?.m.|.Ha~.Rw.....W.jr@..
[email protected].}V.;..Ni......T..Jb..W..(..CU....Zk.!...........4....P. V
..?..*.......M..]..!..H.....r...5f.=.....T:....M.>...f...... .$-...
.P.m...8j...~.1.`m..*... .......{5r....J.A..6......~Z..~....)[email protected].
.D....T.&..e.........".ln..B..&3FL......_...q.....A..s.F=.v..V(.:s.}A.
.....;.,[email protected]=....3.N....&...B..I......:1.o..[.....>
.zMR...._....[.[9.OK6.z......$.d.5...O....."..C..=......n..2.0.MV[...D
..`w%o.E...x..(.......%w...J..)./..d.4..f.. K....H.\4.....s?...]......
..'..,.t...../.,........w. ..\[email protected]..`.^....Z..lH..^q....hAQ
`[email protected].".)u.....y...o..87.i5T......~...H........`l...fvy^0=.
n.l...*..I..=...<.>.r.6z..<...%..b(.../QZ.M........N.....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=65297125-65819501

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:44 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 65297125-65819501/114400751
.b..-...2...7.....F...i........:..J.B..tW...U.........t.K...y..B...DaV
C...../:...3..U..NNk.(.l.#..a.......-c.....'......T.}...90..|.^...jH..
..#o.C...,.L......"..=.B.~../..V..Ij.D.....9...snd....rxW.}.E.U..p(...
......oo....p..UXJ...'...O.X>.w.. .L..AO.._c..END93N.w...#.*.z'.*Y[
Xp=....V..BD.o...j.=........k.|.7.-..6.1.@;..x........<...zJf."..e&
.~O.Q.........Oh.....!.....zy. [email protected]..
.P.N..A.$..NrBm...cQb..N.Y............4.<....SS..j.?..!....d..C.'r!
..t #Z...o..A.....3..cv.n..f.v}....O;..q...].|1Pe..\;J....:.l..h.*DON.
.-r.)7.........Q6.;s.Q.AJ.*.C..QyD.....Q{..%.f.ruP.hYO...;....3|v.,j.n
V..U.V....Z.JO.7M({...(/`4.....l.Bu........r.....Z..../=.AN.`..o..T..Q
..{n.P..i.(I.b..t..&=.s......UK..l... u..k% ......X.%(...2.w...A......
.EF.4......*.R.=..b..~....N>[email protected]~.......(....x.
..6.......f......}.IP...;.Y..6_.!k.9.w..8....{[email protected]..,&b.;....m..v.w
.Y..eMd.|k..g...Ko0d..... "~=......n..b$.bN.8S........}.n.*Pa.jv......
..9..qXU.%/&.].....K.WQ.Q.iU...?...(;=... 2.T...`JRB$...%.7 .E9...;...
."'...f.o.D.(...4......`.\qu.$C.)....m|..g.b..Hgm.{x[.).P.Nm...J0.....
.......1...&.......$....h<l.z.R......(..<...3Q.....J1a.....a.h..
.S.`.>..VYl..gT.....ki.....%K.$.}p.|.D.2.....Pj.....D0..f.3cn=....9
...;...?U;.`...I....|...!....^.m.FM.*H..^..#8....2............j..4....
Gyjh{.S.....Jdf....;-.........gS...')..f....a....p.....f..$s.U.5..Sf..
..D..B..2...:x...;.q:P...Q../....u.V}...=.|?k.J.x.:t..WL...~>.q..Z.
....(..;Pt..3T':.......X3.^..."....1....-....O..X...9....P.0_..i..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=68431387-68953763

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:49 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 68431387-68953763/114400751
.c.E.v.F....2Z...MIE...g....M....A...qKV...a$....? ..^R....y....MUg.).
O..V.h..n3..h.................._..&.....kG.....P.@ s#~kO.<q.F.H*Ox&
lt;.... .....;.m..M..6..".f...[...?.G.8w....Kg.....&4....t..8t.9.&.. .
x.#D...8.t.Z.....n....2.{g3....6..XY.Y..\;...s..b.........e...H.tu..0.
...)JA..`D@ ......a.u.@.#&Ac.S\c.vZ.....>[email protected]!..h.....b.M'J.*#.Z
.].E.,...Y.8.N.!.2H.H.@....`|.....<..........{w.N..[Z..........Y...
}(...d...B-(..C..._...B...Pb.7.. o....=.S.I..>..y.W.BXi...s...}..e.
W."?.}c...z....}.u...!..a..f=W.....k...S.....N.v...........^.JZ.-.....
..Y8......1^..b....(. .......0nE.ub....J:p.Oz1\{.,nt../.f...d!.Q.d.X..
JJ5F*..H.d..U..O[._=@...!..]`.........^.7.c.~;iu..Jl=..... C.n.6..VK.Z
..gI3..>.L...i....."[email protected]./..`.'a.l{`..?v=4Y.......0..H
@.&.......Z..|.<....q.g..p.....e...-....%>!....&.jj.....N..e#...
^.......if;....kFCe..R'p.....8.e.yE.7e........lPi.b.g/..."..d.../.>
.x.e....".d...l..2).WL(.,o...1...O......f..p.E}........a..m.b....$=...
.}...7...J.h.:.....X\y|.......2.y[.&0.V...Dn....r.."...z....E......8.!
?...Cw....M.&.o...N...F.Y.....i.......k.d..E....O.....Vi..:.l.....Q...
).ks......K={.v-&...M....a..Z.%.,.$....|............x.{.cq...!e....V.m
.ja. Y0..~%[email protected].[...#.L.Z.*e.\.(.C...6L.l.:..... Q
5.SJ<.].\...9e...JA....c.C..Ob.u\....Sp....2}....o.2.He........@*.!
e.q.{.v..|...{...,...z.42.w.MY.g.["..'..z..R.......SR..{.2QU.j.F.-"...
..;..RU |...............<A.].D.&.K...&.$...An.....x.94..oP.. ..H.6R
.. y..Y..I'*Q?...........l...)..Vz..[K...u1.f.......R:.....,......
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=69998518-70520894

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:53 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 69998518-70520894/114400751
B.....>..W.....NZ!..1.g"..\Qz7..N.,n....2:.4....}.........uf....Ec.
""....Ue.....g..k.7.a.P5.....(vH..Z.x.:].6.h?...0...,G.x~<.....mG..
."i..'3p.# .2.ne<....;.K.'...r.h4..5.Q.....0......Y.....G].d.e.X...
neF.$M.T.lZ....0*.i@."0]..>.0U..)....\m~..}.....j...T....4..#[email protected]
..Q....n.{fn\.f..oQ.6Q.X..c.:J-n)"D....M,. ....2....TS..h.cL'_........
....W../W.H...z......P[TG.5.K../c........d.S..v.{\!.s..m....i.G...d...
6.......ED.Z).z.^...5..o7.9..W..b..........Wd..E.2 gV.UUBi...6.v..7>
;.22...v....IM3<..,..p......f$......}>.W....6...w....,...B.{1 .]
..p...,t.If..n..<.@X`s..Lc..}.V...q.\;[email protected]....=t7B..
...b.b...I.5..^......n..%.?..yA..F....5.>g7.pk~..;.5|.z.M.-rs..2%..
.u..~..8.....uB*....y..K.3.Uk2...l.%.P......'CnK.6...ZP-.a..l..e..8...
..%.....?...6.....y.}.......a.SS...Do..m.....r......t..6i....y...O..t.
.P.RR.6........&1..g.........."D.M...SY....n......g$$#[email protected]..../..]d
i.....S.......K7..qW...Uh..`............f.("....H). 2=..8r...NI...R.:&
lt;..Qfc..a...c..M...K..........a.(Vw..y.#.....l.>b..%.E...........
.*..e.}...N...D.......w.&......C.f.C.u.'..9x.5....#.>.........x....
...7.r...8._g#bk*a...k....= .2]\............elI{...Y.u.fO...y.6.....;.
 ...{.p......].h.F]..j..RO.X.C..".....r..H.......#*.....)4=...C.7yB,0]
n....as....VL........>........R..L..u_/..?..'.............<..x\.
.-J.0...`..h!.~!_).`'X...?...O.Q..&Y......`...?.:.....dVI{H.O"?.8.d..r
k.`V.d..G.SoF.. v.`....%]....r.....6..o.k ..G.d.d.]5..... .[m....D..8{
c.n.........B/i...O...i\.-."...h..:v........Z..xfb.5..)........zQ.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=72088026-72610402

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:12:57 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 72088026-72610402/114400751
:'._.....i\ZI..L%..............,E..={Y"..`.u._6.......U....W.....r....
....... .m..l\.rX......e..I..v...4...x......,.M....a'... .-1[2...OEp1.
.~.u.. .....#.L..ss e.3h*....~.........m6..............'...e..p.k.D..=
.T...#..r..f.....k.=.T..(.5l...Cf.....C._..2!.C..t.X.....qd..J.<h..
Y...H{KG...0p9cR8.g.SS....woo......(..".y...w.eJ.|...P..\.fs.../.....:
.....,[email protected]@,..>.>.w..
......3.#".>...4...`....gA..9..k..t..k4..#....([email protected]....)B..L....qu.
.N..t".=*.4l..2SN |...#f%...8F|'vs....8..l.:.Q ..0......f.&>...2...
.....B...u. ...,TX.ah.....N_.*G..u.{..}..o.o'7.(.F...:rqsb<$..`...5
. ....?$.1.d.e........-J0....~k@..<.F.I.C...D.. ,...&..u.I.&.*.t...
v..W.<......].......V......R.&.....h.$'..z.19.....|..G..-...Z.....S
...0&.......d......T.iWr...x............&....Y.n..q...{.0H"..1..HM9...
.......!J.\..K.m.wx#.R_.p.u....e".V...h._F......a.e7....\.._s.......h.
wGC^Q........6'}.!.?.{......o.m(.O...Q..h.1......D@..!.2.....jt ?."...
".E>(.V.H.0.;R...eJ.z.c...[.9^Nn...aCH..b/._.......4m...}[email protected]
 .|...vE.@.%. ].....D.u'......o'...'...k...'..&!.*dn.r........M.....g.
?0...%`.2{dN.....9...60A.L.O<)w.)6.v....C.P.O.e...._.(I7.Ph.....B.;
..L...sj.........4]..........v.M...XY....F=...v.Eh.!.ax......l..[..9..
...3.%..D..:[email protected]...}@..$.h.....h....&}/...K.....
5.Fn....._..%.....}..=...H.eN..GY..=.;=....3.......d.GvO.%!t ....GMC.5
....R...yF..f.e.N....r. [email protected]*.2..b. .)..6.WS..}.Q..u..F..z.q..
..:36.S..K...?1^n...U"..C.....LL......Z.!}:?{.Z.f,."j...?1..K.....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=73655157-74177533

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:02 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 73655157-74177533/114400751
hW.h.... KO..Y....B...!. UD.G.!..y.....2..tO.A.#P.7pW.....7..2...y.&..
l. I.t..0..P......0...A.b....=c.W..i..)X.K).h..&.qpC...,.s ...!.L^....
....._.y.*>.4x..?.o..`..VPru.....?..9@b....}t..NNj.&..5Yw.Q._Ul....
G......K.X..:..C.L..t4g..y.F>....7I.2.uG..v.T`f.D[.]&.R......N....6
...Q...p...?.7*\'.....r...../[H..^..G...I......H.|Y.od"..$...U.E',..@.
.....Tp...........,........&.C...is.m...rp.....4........D.Gx[}...b.]5.
.....q.q.k\1..f.[...."w.~.r.QE)G...gr...b.qrP6#...].@.?.|g...^W.P.0...
...f.U.]..f... [email protected]_ J..1.\.w
j...3.~.A{...}B...Uj...>....QG....$...uy..j N.......3v.&j*....../Z.
......wT..v.=A...FZ.....$..... ...),...v.....{....g.K..H.J.._.kN.....a
.q.Aj..a.......n>.72K...P.S...G.w..xEM..7mcY;.....08...{O,.......5s
G..........p...L8.p.C....9|...Zu..A.l.D..._.;elE....,.|..w/....z.<.
.o..M.y.Qh...:.b....@*PE..#....mF.C..cj...r....1v.lnBD4...R...M"[:....
...@...*.1.......e.$..i{.p..,.%....8....:g..,1i.`K...x5..Z....-.'.....
...L.=..fU/...D..x. %..k6....a...V...nxN-..n=.V..Y...[.h=......j.m....
..z......)......p#kT{..U2%p96.B....3B...b9TS.D.n.9O.W=R....bh..N...i!.
AZKn..~.......c..np..%..e.......8-.....s...t.4P{@p.....Z......C../....
SQU.#K..]..........jX.....n;....0.l.^..}{[e...].@Z[e....g...l..&.&....
.h.D...85......5.../Op.......b.d....(}3......{.hT^.;...C...=k..l...JE.
....kp.........4.L>[email protected][.........-.2......j!]..e.
tN.....b...y....A......."J....'.?.].Ie..".:.i...>.m......;..8../.;#
.d.f.t.......o.~5..dI.(.9...Gj...OY...qb..*.....#.,>.....J.mg.B
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=76267042-76789418

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:07 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 76267042-76789418/114400751
... ..-.x7.........bz.......b.T......D....PaP...P|2.....&rxq...kw..1.7
.N......K......6.2.U....`......5Y.o.......6>.....t.....23(;.:.....Q
.b.....5.t............S.I.kV..Z_m.8......43j...C!..G[.....DS....#.....
..L..CM...2\,$...).../.....k6z.7^@[email protected]$...b[.......cO
8.......!.K.J"..zZ.=w.}..*...1.$8.us.../...-S..j....gO.D.....O ..1.cp.
r..WF../:N......\K..m....K....Ld.....u.....U>...f........w........k
.......c...O.,Ea..rhP..`..,...R.6WK.Q...#.2........1-"....<(`0..d..
.$.gS}.d..h...Cw5X..;.._.i..u`k.k.^K..9.Yr. 7/.... .1.m@..&.~..(\...iP
[email protected]....\.......qI...HP.x...ki@.
'.........<{....]K.W..X.$..X.^.../...F!..l..w.a..EP.......o'.......
.;.]A.R.q........x.a......DtAN..d!a...$..6..-i...8...8...../[email protected]~
w.....vf...........;....,. ..5([email protected]...>J....c.`H`....G..
.x.5Ye.).P..z....Qd. WZJ..RI7?:[email protected]]9....iTo.l
7.....[...f`K.....O=.K......Q;.._Q.`}...2T.."[d.MF..3....b..7*..i>.
.?^F...A.f..rA...r.Tj.J.~..M^. ~..WZtA6.* .F.F....ng....K..O..}.~.....
..?.....HXEi.!..2..F.D..._.....JWJ.Aa ..f.6$.~CA.>....]$.VH>"FS.
.E....'f........E...Uj...w.../r......Z.~....#....m..1P.=.... `.9m{`...
;..GI..,.I.uP.|...}[email protected]~.Wl{.H..G..tXP wG..jO..`1..].~o.>
;........3..........m......el........r8z.w<*...:M.....1.....-2%".?'
0.,...[^[email protected].{V.5......Q...M.2T}.........DB. ....
..x-..&....p .......pS.f.j.!E..'.W..|.k.c....t...8g...gF..s..K>>
...My......G.&...~U...1KhgW..7..:....;~...s...,..GL.(.H{..v..H.<
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=77834173-78356549

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:12 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 77834173-78356549/114400751
.&.k-.......z.....1.{.v.......0....-.."M..5......[o".....q............
.......\..b0...T.?..Z.....l........,....P=......w'.x$S.J....*..iI...Q.
.......}Q...3N^.............YC.E..%..N/..cy.K7W...r...[./.B.].....u..-
>/w*..1......V.n.t....a...X.........=.....L.H....#.w.....<.&..t}
i..s.$.b.'...w.m......q..........gB...S.vq...Y.]m$->.P...{..65.>
F{.n...G.....q.gY/wU..H.5......vC.I?n.....t..fiI....v.Q....Mf.j'1/.P?.
....J.wt!...@...|}>...M...V..$..K_d.....T.n.. i.....8y7."...r....b!
.o..D...u........AA.Kb......hY%e. [email protected].~1.Y#.....'B..E..
S.l.s....).r....u..(.>S1....0:..Wtw..]....._v.?..2..E.l..i..O.g....
.*.....U].[..w...:1..8.e.\....au.~8Xy.....m.\3...bP..%...".]....K.x.(Y
.^..0B:..P.T..d......4N..._2.........a....../Xz..].F.....]....F..q]..%
.U.%.H..Z...M4.H..........G..:.....T...M..t^P..'N*......jgNC.L.D.q.8..
.W.:^...C.Jw[s.`...?..C^!bG...iUtW.B.08.....n..V...............I.:....
.c..^...g.r...Z...AVS..^4I..*.x .4.Y...ZdZZ#..*.i'P..7t]..Dqa>..*..
..6.l....)..mg.c.....`b.y........hu.k.....ES...g..W|.?.G.i.0..1H.@A..=
@.9.i.......z;.v... s...."..>O(..q!F*WIW3A.....3;.._C.%..~4...Pl./.
..#M*.K]...1V...>...q.r..$ ..0.[M>.8.D.%(c.....v._S.c.h`&...2...
B(vEI<[email protected].\.(.......j.J..B..w..f.R....z).-..:...x
#y...C....pdz<.f.2.5..Wd.....vX640[.....Q..........U5....%p.f.g>
y.4..p.Rf.f.|........~|{0..a[".......t.e....dAq......q.=,2...`...y.K..
......,...g....G......z..R.<c... ...k.%....s...6G...X%.w...B.oH~..}
$.E.(.E.QT..*.&..N@n.{"g|...x2.G......N..A....,B....r....^Y.H.rM.0
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=79401304-79923680

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:16 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 79401304-79923680/114400751
..._.G....w.4..,F.!..M..F.Z<..w;......R6?q....u..Z.8.D...0.... .b..
[.W.g.....Z...3....xe...`.(.q..b..A...w...e.7.:.,...k......E..E.l..Z.j
l~.U.....*....I....q%.?%....T$D0.YV.`[email protected].!....X.gQ
k.'L"...J5O.\.K.hs..[..........x.J....p....`.V._-.....zc..M.OW..' B..n
|7......$1....B...".&{. R.z.........{#M7..D=.............u............
..........7t.!3.........0....W.... .........{WJ.5Gh.Q.......R.(...J.TV
3._.......*([email protected]\$..ZI...<o./.4..>.
........2.{........kw...v.zC..lNq...o..Y..m1.'...y.O}h..B%3.....AR..5.
f...#..J..,!...4..0W...P..B..A....7..pX_...3...Q..v....=...Ve.%...!.Nm
...#./s'e...R.n.5ca.........L.z..=.....4......*..(Z.K8.y.2....&..M.S.f
?..7Wu.][email protected].!...`.....!Fq..we8o...N...\.....I.m
....Q.....{y...f.{...b..EC..../%.\...x].....*H......pC.. .;?.h..=.....
...@I=.....5A.. .a.....q...Q..i..{q4.M3ip...3.Q...qY...At..k.rzW.,..5.
..w..akC{...'..l&...5.B.\...Q....Q..(..3=p..:.f.a.6..$.C.b.O>M..G.G
..m.q.?..w.w~f....k....q..W.)....q.VO,......S.r.....z.;.F'2Z..h......~
e.*..64E.e/{..'I3y...B.....d...4w......../...HI._a......L). ...,&gz)..
9........E.]8..-.y<.([email protected]..*.&..K...*J[Nazw..v-./c...<".%
......UbG....S..`....S..y`....f:.)... .......8".&S& ..E......4...YR...
.K.....D,.....P.N7;...Gl..........[...D....f$y..Y.;z.B.!..9_./St.T....
..:.%.}.E.ZL.....E|..u..."'.xA..1...6.T.y.1.).U.%:..V.}[./.F..>...i
".9.W?.Jb.a.s..z..../..&.CE.yo.?v.....! [email protected] ..ho.)..f-.4.#\;_...S
w...Q.A\.7..... .a1J.....}I...k.m?ir....x.E./o...YG..[....K...<
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=81490812-82013188

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:21 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 81490812-82013188/114400751
. [email protected] ._.'.(.L....BDG..g..e.XZ.....bY.....).HQ@p>..
X;....qu.....z..:.7Y.u./........DoK}..Y:`!....mG..[{?....k.....-..]4q&
.V.%.o?..&L......Y......'..u.k..a..=.{%.....%'.<J.?....{......,....
....^.-.N.....LF...e......:bV...(5Rw!..x.....V..<...Q.\n3.,..^}s...
.S.......8..5...$...,/....G....)C...*.d. ....T..j..-..J........i.<.
j...).^..px.....aaz.X....6.-.8....?Q.9...MJZR.C.9.....t.\#.TY.UW....Gs
..Z*2.<...C..*.......i......a .=..u..2/.......c...?..~:..j.Y.Gs*X..
Gs.....6.K....^...7.d....V5P_.4.......H@=.......oe"W%...P(.y...i.<.
...w..8k)..4.g.g...C`..... ...6D,.....b....a....h..;...;...e..b.Hf..h.
>... ......%E..0.l......\%..M....!.r...;..n/.n.l.Q\..}t..F.....d.I.
....A.....yX.I..R.`..(G.$.......7..5.m..l...l..#.......K. a'.:.9...d.5
:.\S..|..*.lP....O.........C...r..i8H..0..=;...w.M./g`...m......f....Y
.......aO.(...~PL.y.Gj..3WY..0...1U.xeopU....YIFy.J..v....z..}K._}..P.
C...H#....SgS.h.AjzS...7..0....UU..-..O.[..7.En....d...I.=".d.,^*s.2&g
t;..FV.G..T.q..s.>...~....r%.#c.58`...k......VB4.Xd.J.j^...T.......
U..b...._......F.|.).L...z}94.........NY...B"...iA.>..RpA....`..U.S
^...=..EX`...##.eJM.~v...r.<.#.'..P..h....)....(.......e. ..D.....y
....}...Z.jW....m....... .?.H:..?.......a...Z....J... .;)-....V.d.mV.b
.b..*......G.A....3B......D.....GZ....Q...k..K.Ov.@*...I.b.N[..a.-[.h.
..'.t.|.JA.Gj...C.:.# .Y)....\Is.f......y..D.......oO-......T....s....
..2].K...F`R.C..B...2-...c2W2C..Pz..n.}L.%K...x....P.fsmugQ.......(..0
............,x.]...<.GE.%.......v.(.].Y..W.i.. v../3..9..%..^..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=84102697-84625073

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:26 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 84102697-84625073/114400751
.gCu`a.......c/...f.g [email protected]_.1.....b>..\..i...<.........
.*..W.!.0..E......<.\..~].=.d.Q..zq6..#..... P..F.f. *$.a..G}.....i
F\....W.k8 ....Y@%.=DF..=.-D.......v..}O3.....-...".*)..../.o.'..,...&
&.c......!....{.T.(....d....t...7....m...`......Y.y..</.%.W....$.v.
W.j&..xr1./..5....!7.. 1........Dv..vMx...M.g.Y...!x.....7}..5.....(..
..s...:......q&..[. *D..bE...._....K~..q.usww..nJ..{...-c..U...MPz....
[email protected].)8......(&qc.h.i......6-..!...z.(?.X.P...uja.z....Z. h#p1T=..
.b(..}....l...V.e..N.....`..j.Hg.r.~..I!.c.E..S.6.y).>[email protected]|$:2.
.(.y..:..*[email protected]..=....#...........N........S..W|[.:..U.#.[.
..!.pD..b.M.,..U..*n.O.~F2.<X...\.^O.((........P.O...S8......z....`
M0Q...<.jNj..e[......@....=..M=......#.{.....N..o.[..B8.O...!l....\
I2y...x.T<..f.Ln.m~..=6 I.'.Q.3..9....BFw.U..g...h...'.....6.N.....
T.:.B.}..<.......t;\-........W.X1....>.o._.."4.. ...?._"...H.S..
&.....W;....-................B......R.N.E.5C...p?[}........Q........l.
.9j}th...a ...$)R.........:CL..#D....O....f..k..x....~{..j....3}......
.m.......,:JU.v.G.d0..G@~....h..N6.a.H..{k7 ..F .-.........r......no.D
.K..{<....>.P..&...t...V..U.....8.T.I........v..5.}....S.m..R.8L
.].....#s...4kF.fp.-....g.W..]"..J....\-e.W._.9.9j6.o4*...........~...
.K....c...w....`y........W.dMy......K#..Q..q..t...?'...G..Y....Q}....Y
%.:.t..h\..To..u..$........iWo....J..2.{.k]..!.f..:m..B....8n.x.......
t..N.... ......`......B...\..&.r.>P ........5....^.`..... e...p]W..
R........'Mc.........c..NG.}...0>...g....$.w/.....x..I..6s...NV
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=87236959-87759335

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:30 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 87236959-87759335/114400751
-$.2..B....L|.!..Q..G.{P.N..b...T..H.=.....M...MJ?5..............A.*=.
.t.....I.....8d..yZ..!P..:...................|<.Li(V03.}..f.k]NC...
;K..\Nw.....-.'.7N...~.X. ....rf../<<.?..J."..... .^.%.E.i...x.q
...wF.:..[._fH.?lfX.J.e........C./..6.I......_...{.:.....m.S..Iy..m..i
.u.o.Z..........nT;.e.r.."w>e.C.]%6lKl.%P...e.S6..............!....
y.....s.k....i^..`....F_.Rd............;....g..e..=.vi7:8..A..".W..J.#
|v%.....@?#V....{zN.F.k.~......I|....Y......w...]..Os[&.O...c...aZ..[.
..I.G.....9.mk..........1..../....7,....`....f...J-...<....(.nv{K.F
..$...(.1.......S .p..D.[.^.1..,...,..w..!rL-..K.?...Fl.s..R....#..g.M
..\........#i.J.5c.U.R..F..@.........}..W.3}......O.,...N.tbM3..fz....
..C..R.{.^n..R...=D1;.....X....2m..{.....K`... .=...[..$...6.e...J.]..
...c:....u..q.Sn.!.|OiU!~Y.Q..._.n..aR"..p....x.C..I..h....s..]/.}..`D
..9...?..Vq..j{.. t".Q.......?*[email protected]|.$g.d]ciQP.U.
.....#.o.X..^..bP.x.. zs...EqBo.(...O...2.?..*.9..P4..(][email protected]........
/.@{._r)..mw... ...h:..2...2.$..".O...p.../7....|...=Wkh..].Ad..QU.j.[
.......F...pBr;.7l...e..b....{...Z......^{...D.m./.dQ......f...2V..F.L
..8....-sU&..wp...cx.....%......je.6.p..~~.......s}...v.......2...T4..
.F*.9..l([email protected]<...x.....J.;.....pE....9.K]L..
..7...M...tMF..w.U..D`..Ry.}......zh.w..4.\....I..U.....y:&TEV....s3.^
.0.&..Vd..8r..#'H..z}....T.:..c.........XUb..Msv....../N;..!.kR...:...
...O..C.y....ha.Y>.x...mQ{............Uq..S.X.j.aa.5.!.<f...|...
..'.`[email protected].%.9.7......Q/j8a.A......6MX;...(..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=88281713-88804089

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:35 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 88281713-88804089/114400751
..)....e...^..w....BLz>!..j"L.CT1Y...".cN.H...N...$,.........(m,..{
6mN..v.i.F......|.N ....D.v6$.x...5.L..h.6.....QW.h...7....2..v..!o^*.
t6..Ww..B.=...\J...jo.J....5&..-4T..._......L4;4J.....I.9....?.^c..>
;.U;=........_..e.2..,_..M....e....,.k..W..ob..\.]k.R;9Tlr....6...%.. 
...y..^Pk.........Y..*x.-..[.L..\=...........2.g<Q. [email protected]..~ja..X
l.....H&.N..%.......D].OF.h..L/.{.7r......N~(......n..L.sMv..rFz(.O.i?
.gB..'.4u>.../..9...M....A..K J.....".A.7.JQ...?2...._.'t.sT...E0.*
.%Iy.:.j5.....).....E..}1.$..%..nx4.. F.~T..U...g.%I../......Gn...XO..
>f..e.:........i c.......3.....}vl.jfO.1n.......}..ubmC.-3Ui..>3
q.z[..se.?[.%2. ..9.QQ.....W.7_z...[`p6....S.(...k.....]s.em... dT6.:.
Gq..~C3....t.Tc.<..Vd ..u. {Gu..R.mQ'i ..6.....ZX......:....A.eZ..(
.6..q....=.(8Z.m...4.O...Y'../..T..|...i\1H....:....."[email protected]
.<..ro....k..L.K.8.....7....l...-P....1.3....... tng|.hK..y..~{.[..
.o7s...y..T..1..y..iNe..D...RIOy....f.....|]...Y.....3!...J....%.;...Y
.L.Z.Brs6.ezN.3sF}...C.pN. .z. .Kj(P...... ......?....s.s%.6... .1R.-.
.g-..,... *......$s?.Q.`-.">!.(.....,..&....X.!..~U.~V..6....s....w
'.&./i:.P..G;a6..t.....$m=..7.}.U..7..>b.....'U~\y.....v..vO..'....
\...Mo.Y....Z.b..0r...[..."[email protected].....,...jf..
#>HQ.{[email protected].*.......F...).....G.56I.'.....eG.
..$*.p8`!...0...'..b-....D*.~...pO...;....$...}P..M...Mg...w......c.3[
.....`O..{CT....)...s.(.......[Z.X..^_?<I...... ......V..$.~..J...N
O d...S..L..N.t.)g_..m;0......h....bEeB.....s.....z..^d...........
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=90371221-90893597

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:39 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 90371221-90893597/114400751
.3~..>...o<.j.g]8.....|!..%...- ...N...../....].bp.g......q..`..
X..../y..4q.e....|...8.c.n9G.2./.90.../.z......`..0..E\*.o.....V.?w&..
7.....3}."...C.'p...~....Y...4.S......8..&.~%.(,......-M...C.8F...P...
.....S.:@<...frYi.. ..]...t..S.....T ....&...z.E$A.[.&..a.w..k.~.2.
{....._...h...c..|..2.NY.........L..9D.9w.........b.`....}....E...zn..
....-.B.M..M)|~T..i.B.R...........G)42.^"... .R...q.SS/../.....=.!]1..
....d.t.xU{........'...2.T......$...Y..m..6...m....<.*1.../....V.tS
*.y....L?L.. q.e..............D.#$a.I9..6...t.@..;%.Q...4].E:.....U|..
H:...3...C.b..j.A...)..V......F..p1..T...A..A.".,...r;76........j....I
h..I(.!...YB..le....M<ZLe.9L.......2;.....C..q8}c.R.>.sWN....E{.
[email protected]<.r .|(.....>.."Z.(LM.8c]u..;..,..VM.r...]0........r..
......../..y...u!.4..>.......\O....B...,.........L......./*H.=9....
;....L....$..A.....M..~....."..yU4.{.............zNL=gm....<wH.Il3.
..>n]'..`H{n...yVn.9&....$B{...E..\.c`.6.?B.8Ay.....;Fl'....f.5e.N.
......O.F...q.K..<....bOH.....Y.*...yHV.`.......Bf!.$c...._..O...6.
..gY=.d.,...2UN3S.kGK.......x..........GYZR..H.x92.....k.....r.......T
.0.....'y_V.~vt.............k.......b.h.....,...^.6.?[P......l.f.9....
.(.T.bC.3z.!?....X.".;O$>&.......o!..).u.g...}...4..`Z.Y..V..Q"0...
.Tw......K.Rb....../[email protected]}...."..#s.3;..A.`.w..G2b...."/_..o...
.r5e!.t.Y...2*..O....Mj.z..y.K.../..1.|YE.......d......8.W.`V_g.{fR...
........m..."..............4.p1.JsL .E.q!.j....,.N{c......@[..X.).....
kf.l...].!...........&iod..b .O..B.....wG1.\.. w...".....8.Ma.v..4
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=92460729-92983105

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:44 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 92460729-92983105/114400751
[email protected][email protected].....[.{....:.TK/6..;....N....!4.r.}..I..!D.\]..4,
..>Y$...?SZ1h...`w^..30...;.#Be...............$?~.tK7..oj.....2..2Q
K...t.......X.y..d%.J.........O..A1...(?...../..H...%8...E..n.n.h.2l..
......n....G.$........L.....=.w....{.th..Q$F(.?..`^:....w-........O(..
..F..M.?b.Ak._.|.4@c..?..(...W5..h?.... ..tq..6...oZ.U.&.rA ........T.
/.....p....b.@.{..d...e....$...*..a......Bm.0...CauD.<.zb......:...
M?q.?d.V........9.8J.w.>6....p..1.g\....(......Yo...S'......&e_|.8.
.....Jf.;z..IPy.KI..y....:...T53.P.=O..Xr..&../..5^..D|...B....4...>
;bq....h*....../..N..M..&..}.. .~...Z.;.#qh........WHq..D?tY.t.....ze.
...}.q`F...j\ .......Z.q..(......d....`.b..........g...n..G..JEE...v..
a.y..#F_R.h...0..Hnp..4......".H...1;..?f.$=.2z......T..P. L.!...Z../D
/...eU2!...C.b.{s.E........F...2.JQ.5.&u.......h..jv.......Z...Gw.3.(1
..^>jz...'.N.R....s. ...p...b{.'.;v....vS?...6:.w..M.w`.T..u3D{B.b4
V..h.....a..H]..{..yS...W.t..A{........$....'...j~.m......>...{...x
.......B.]i.j.S.O6N.w....Vi`Z...,...7b..-.;r..=-_..0.............N....
.4pNr.......qQ"...ls..)...v.<.....W....{.l......W<..E..>a #4r
.......j.Ce..!r.{.8.....F..4a.y..._.........J..O.ojw?!?....&.c./..Fb..
..;*...cr [email protected]....`.. ..{.P.....e........0.h/..a.....X<.JAH.`.
.......T~....C...V.a.....C....w."e...3>."..S....|.. .WJr...........
(....R5...rW&.Js..I....!.d...A.[...xx.u".O..'.Y..8E......p..\.;c...>
;L..$c.p.n!.......KD."8..jy.X..w.y2..F......8A..<..U:.....sZt....s/
<Hu.-..N...Z....t.....}...................Z.....d.#....H.....^|
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=94550237-95072613

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:49 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 94550237-95072613/114400751
.>Q...D....}.....y...=.J[..........W.......V8T..69.6...)../........
O.8]i.......2..h..*....J.%...t.l.....e:.Z....xe............sX1...6....
..[....C(y.....r.......iE[C..j..(.K.?m!....|.1.8...Yd6..2..a..a1...fHt
..S.U..K..JFl.o..S.<....WK...b....!.#..xd........?.......}...v.d:..
..9.h...O.<....[=...8^..`..-.^.p.D.....%..!a....cn....*.$.......v./
.T_DF......},....eqQp....r..&ES....e./U...w......~.....'/.^.5.Y..../IB
-3........=..IlU.w.\.7]&,]....,J1..$t.`].[....N=C.Y..n[-..Q...;..3....
.C.........)........X(A....Y...~20..mT.......N..i.....{.......=.%..ltW
C..o.\.2..ll...?S>..e.M....*Z.'.5..2...X.R.x.'>...5~.0A..a9.&=D.
..d..*..d3..xm.=.ic.q...8.....':.7K.H.C.P.o#(...G....k.q.....k..".O...
;.O..$..Y.l.........(.....?.y.9.zf`....6...6n........]....\d.pn"...a..
u#.*\F\..`)."...t.[.3.V.\W}..^...M~Z...Cn.n.5].&0.1...a..*...j.q8![*L.
L0...........jm..C...2]i......6.a9..hT.=.EcJ.4..1.F:..no...iN.........
..8.y........W..5.b.\....h.).|[email protected]...%. ..Y..Z=
......n..H.J.......}.([..<..&V.l....v1....9u .T.q)&.weZ..?*..t.....
..g=E.:....Y2.a..SjK.~R..FP.4..b=.3"R./..J..4|.%.....ud.%.O...[.V{..YR
.>[email protected]:.f.....5$..&i......l.l..rE.vz.7...m.
N.=...E43......tY.W6G....#[email protected]"..Y.R.........0.^.'...|}.
Q>4..#..Z_2U8..Be)\....R...D....(U..`.i..-.O......6X.`......>...
....O......Mz?...I.`.$g.....S...6.Bs..C................E..O....m...M&g
t;....}#..k...#....iq..U.:.....q.....Y.....#..s..............1...=.qg.
.0.?.q..B.t.......0........T..t..XY.1n...6v.....U.J\uN..z....K...R
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=97162122-97684498

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:53 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 97162122-97684498/114400751
..FV.i.S..!q. y/4..%.X..C..j.....b.F....;.@N. .Z.P.S:....q..gI..D.....
4gUo......A7.a\..z........Y.hA...7....,....1.w.GA.....4)m1.5..o.j..._.
%%oIFRY]V....1....CW....w....'...F....j..|;`z.h..I.....2G...x~.h-/....
.v....,m-fj.....,.......Rf.|O......._...}..4.....D.D0u.8...!...dN-.Tv.
<.<5.i....qN.>[email protected].`..pG..G.....yk......P..
....q0.r........n......BL..%D..dar..q..>Y...Uo...d..i..\B.T.z%....l
$.......7g...r...I'...3.[p.2.~.\X0...ia....#@ [email protected] ..
..".~)..zs...m.&.f..R.\~...l.......D....,.g2.t:...df.'.&.x.g.D.:k...p.
.U....<........'....n..\`......I....'l...|p`e....4.0...V........<
;G....|.}[email protected];..e4};......z....E.W...v...*j...C......E2L.....kG
..[.6.}....^...S..G.....C..N....\........H..#..puL..... ?..a:orP;....l
ZsU\U=..~.}[email protected]...]z...LV.._J...zc..n..2...yukR.c..k.N\....d
.K...........,..yk...........!`.....~B..t.N.....:.D..5.r..o.3.5%.Uo...
......,....z=..V..g.V.........hG)._*.5.u..5...$d.O..4I..wO..........6.
... .Q..u_k]..^..y..l..:......!.4..tY.r.... ... [email protected].
.J....1=V.(.. .R..s..@?.C..~F;....5..Y..u.......*r.S...2....'.T..%$.u.
.../..<.Y.|.z.......].$..?..v.8*J...X......D.F.>..,.".F...l.`.[8
.eh.q.<....|.%..8..&....(cV..w....w..}.v-.n.|.?M....*.w.w...k-.."..
e....}$.z..U.W..R.VB.o.~...O.....)Z.......z.{. .X.z.R.-.j.`.....M7[).x
rW......l.#}.............Z.^..<8..2...5.............2.....f.z...~(,
b.`O#..-........o.....).~...gQ.&.Wo..v... .)..8.v..S.,...KX.......^...
..n!.h.Z...q.....~..,UhSiF.:u#...(...A.X. ..gW..u7..r..n.a...dp..i
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=98729253-99251629

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:13:58 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 98729253-99251629/114400751
N...........]..xk.p......iF...3.0..a"..g.ZBS.%.....}..I..'..J.K .U&.P.
o. ..<.X$...<...-c._.o\.T.a.^J/.............u)...q_....Gz...6.4.
.N.e...f.fn6.pN.EI._.4...=_.20...n.-P..0.k.........B.l..h......g$.<
......c..K..nCbWj]..k............m....ne2...G.[..V......)_E/V....m....
...x;.{..mlR'O.V~...Y......JXV..<....... ....HzJ, ...>-......q/_
..2..Tq.........^o..F.......s.BcJM$...G....w..]...)..y.>.t1..Y.....
.i..:GmU...~.`.]..o.....o..T..T.....hN"`.....V........tk,......qG]..~.
..'....VnZ..........1..4........5X_.&.]....R3K..*...g..8w'q...}.Wh...\
.N...*N.)?y.<X.(uvy.A{'.....d.?.U.........6.q..ua.4V...<.b.Tt..i
..l.@.=....J.r3....B...{.....?.....?Z\..B.?Y.{....ub........&..@[email protected]..
...o5.....e=..~l..;I.4F.y..M..&g...".h....?y..a...).h.....h..c........
J..r....R..1..B.u.X..nY)...aD......|P;.k.s.)..R..:D..&.i.....FS8{G..um
[email protected]\.7...[...h ...6.....
#..5..s.K.I[]....o..P.{.......{x0..#......{;./.F.7.....]PN3...`.../..=
..> .....B...n.<.h.Qu...>..?.MW......./...!..I"1.....^.{.4g.u
..U.....Nj#'....9`..z&A..?id..l......./l\$.....]...N.Y.Pp...]..X......
.......<....7.<.3.v.u.b..=....\.T..#.#.b...i.(..A.f.m.....z...F.
.....D>.z.....B,...y0.C...3...hxz.......b(.5xkX...d=7.4.0.D........
....ii..)..i.%..s.3..D.h.o7.&..m.HN.......#.H).....*.....e.....Q.2. ..
.\.|}.;`!.P64.....2..)..X..........y..Ua.....5.l.X...U][email protected]...
4n..x...bcXb..]S.u.O^..)T.{.us....Q..K.......(.......J;x!L..J..rJ=.or.
..:.[.S...e.................3...a;...~..[u.~|...[.....Eb."8..B.)W4
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=100818761-101341137

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:03 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 100818761-101341137/114400751
{......F...F.UwQ..5..QpT..........LO..,.T5.}.p.....$.y..%.._.L.......&
)........=.<..,.Uix.X...~.o..~.O.E...d.......mN......:.Yr,H.dX.. .V
.JcP.v]rMA../DDS........>.M....?..n.w.&wez~.B. ...nh.Yy..b.6.g...pT
...MR...7...........`f..P.._.Yw.Vla...4....K.......2PRi...&*z...w/P..0
.I.*R....0.r.k.}W.....Y..A...3o%....Sh.e.....i2R(.....H{.w.|...y.z,#~.
wD.`N.N..fv.{...Yb.......G..=...Z........#P.....OBEl.....f.81.`..Ai`..
[[email protected]../.H.G.8.....HG^*..b....p!9..W,......L...y.nh.......GADbI
.....J.).un.....$>..v.....m../.{!....[..'..@Q0.;0.Y.0i`..].=...:...
.9.)...?......)YB..u..%%.v....0..e... .L.~..e....>...`.E..|.~..x..U
...#..y.b.7.q......EoK.nJ.\...Z....<..S:.o.U..../B.P\..G.ux*..).=..
.T(....a8...;`..4m .&d......U][email protected]:..3...<...
.k...3..^...i..rhaO..2...dR.S.V...P....%.6_...j.JA .........0.........
...T...=.>.W.f.f.RCn=C....H.3Q..7b.U...El..L{g......Q.D..:..k.h(...
..=h.Ke8.5...Z.*.S....w.%lc.U......*,$0f...........5T.'.m.&S...^..PUo.
.p'.....NLje_.F...j.%...ZM.....:c..H......5.c.,...y........D...v.>:
d.M[1U.3.x)..F.....vt..t....l.8!tT.....^...}5..8aE.Fj.H.c.?-...._..0..
.Nc3.a{..'..=..g=.............<.g..Y...CO..m.z1....<..... .s@..!
x....C...B]......C]. ....U........ I..#.[........[q.CjB...EO...vy..z..
.....D...8.._.5..xr.]..5.....x........X..=..'..y.>.p(.~F....c#.sZ..
..*.e.t...R.-.Xb..#.Ac.....=L..xVr.oa!.#...V4"yj.\......hA...W..:E."..
... dU..o.p......c..()....;..... l.V.7?.........s'6....C..^>[email protected]
.....7..I*..."atrl;.....Tq;...D.Z.\..V...'[email protected]......
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=102908269-103430645

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:08 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 102908269-103430645/114400751
..~....;H.......F^....0=>Z..w.d........:v....z.K..R.<..7.R....G.
{*..xu.Z..T]..a..-{.S...d.3G......a..U"....!c......6Z...h_.c...G...`-.
...A.bn..l...w..S...?..=3..j~8.Njr.....*.H...qT... s...YQ...e......<
;..h...I..A...(:...Nz...;...qa..?d.:.jk.T5_.4A......O.8x.........Dq..7
a.?...o.=....-..3.|.......dT.4b60..n..q.....r..........*......D...5T.,
.Rr.... e..=.q.1.J3...._... .pDg..y..-l.........0.....5#b...U.....@...
..]V..(.....O....w.^..8Bx..~..xs....oo?u.../FA!e[...X...~3A...x.......
y...oi#*....K..0...0~ (..y.z".U...........j.I^.?...zg.........U....O..
4>....I3...u.nWr...eK....v6..|..Tl.:..T.....%..J`[email protected].
./Ji...w.........:b.k._2...xio.A.i..U........P.3.li.M..S..B..&.TW..C..
."[email protected]].-.OU<x"..'....6.w..H6.}[email protected]\|.......9.....
.`.OR8.Y.Q..S.V..Sq....3......o...YL....X.I.....ze.5.jK.k.<o?1KL.Lc
V.Q.n._;....WWb.]...F.....4.8.. .e.7K.zU.4r..E.|xh.>......8b.....K?
p.v.\e....M.6....CA.t..I..1..C7.CWTz.....K........Y3f5.l.-..O..4.ILvS0
.=.r...`<:......gF.........g......r....w.3a,jc.....*.T3...w..!N....
3.L.......d..6....6.n.z....=;...M"f.F.....N..,3g........n.G...sE.d.B..
,'&.%.....u!.QA.2..._....P.....P.3...'N..x. .j......s..g...CAP..).|...
\T......US!Z...e.O...Qz.#..u..B.....}'.:83........U."~..........'..CL.
.Zrq.....Qky^........1r..x..D......m.n....I6!vD..X..Q..!..^........_.q
.g......S5.E.#..1S.......e^...}.R...z..#z.Y..|.j..i..."X.~.2R_.:g....0
../C..R..k..r$X$dAR.....ydpW.k..J..DF%.........F..r.6.^..x.W..W....5.t
.....:-.W.....q.O.fM\)..W......B9.*v\.).Y>..N%...o..U.......h.1
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=104997777-105520153

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:13 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 104997777-105520153/114400751
a.a...[......>V.q............s......eO..e.<.<.\..k...G-......
..|d...s_o....O...^..t}...y..H..Q..x....fF.y&<.!$H.,x....aF*]..xQ.^
...[.Q....\t.B.*.h.......!xvS...yY-~......6.`.Y3:W.N.c . 8H.=6.......~
...4.S..vK.h.......Xt.S.iL,.fr.,.m....!E.]H..w.=.w^..\E...l..[..I. .1.
.iv].~.0(..................rz.....b......#..m..u.'..#p..)b..7R........
.0...I.8P.>.n}....a.Sh....L..,.....&....g......G.T....ua.k.....k`..
e.".....8.'...>........L.PbJ...;.{.g.....gT.......-..U.}..C...r*V..
....$.. E....g>@.gK&...X.yv.L.vR.r.<..!...0....*..%%..I.#...c.1.
IY...i....F.v.p....i.pas=....f7.`......X.p..Y.3.s.......K...</j....
o.A....e.....K.?3..).@...~0.."....._..2.c`.:.... R..8....'...........s
1..q..8...%...A.#.......j.....t...!o.!..Uk......hR2..&..U.p.........C,
'....^*...t.{........%....C!q.U..c.....W.B......;P...........=.6...Jw.
."L<.j.%....Z..-......1.4?Bu...<..........:........ ..}r........
v.bx...f....A.k...o.^...Y..-..Vj.X..|..z..Q.B./.\...IX.....9^.9JQ....o
..s..c.\.<v-x9.,.(\I..9. ........w|..v8.R.h6f.m..s.W.... .V.. .oj..
x.p...B......7N..%j`..j....|n.~h.s...Y..i.>E7.k.I./..9...fu........
.x....?....c..../^G......V...w..6...4)grZZ...c.4 .b...K<...YF...#..
........^y.gJYGYS.l....K)p;([email protected].....:....;a.xk3..9....o}....S......
.f...4.....@@Y.....z@.|..l.t........_....W.b..pIT..8.(.S.T.Z.4...s.D.Z
...*...ZS..&.c.<s..w....A&b...W..B...]........e...%.r... .q.~_.Ow#.
[email protected]...`.4&.-4.E..v.}.b.N
....g.*L...Hg.....I...>E.........0.=t_.;......c..N.!.n.,...~P._
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=107609662-108132038

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:17 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 107609662-108132038/114400751
.io...r.qe7.p..B..c.c.8_m........@.#(...........$wT.!8...V.m...0......
.`8=FNBxE..2...p.........Up2.....%f.j...<Xq.f.c.\Be..c'=.T.........
..O2c.*.[l......D..W.. ...(`)..A.b....J...$4......Y.^[email protected].
.9..*(.F..s..........X.l..x...V.&.FU......??..v1.N.....J....c....WY~..
.HHt..u..?../._...qL......I.....`.2.:~....._xM.v.P....ZQ1.]..ed...cI&g
t;..8...E.~p.j..zEGFme....FT._...(...#..^.^3...J.A....\..M10fH~....M|H
l..b..1.v..0..d..T.1...y..~M~...#..B.^g..kG.....>.!.G..hU..........
..F....8xV.WK,{.$..R.2.....RG.h.....]....._.].....v@toy......'..7...^.
.v8"g....~....A..,O...K..!.G2..V..>....j.1..."p.ySFJ..eIa.....(...m
.6...h.....}I...3.,lW'..D ..:..../.."d........`KC(=.... asGsn.....'.N5
....o0.......k.|.i....y7c..F'........k>.&WO..U<..T.k%.....p\....
A...W#bA..g...D.. YZ.9.a.;A...8|..E..Y...s...S.=...:.0......r...y.....
a..A.....?.....C...p....oU.K......2W..9.tK.$9W...`.S\.6v....*..q.R...]
.I8#A..?.......:.3.f.O.kRf....f...S....U Kf..........~|.Rd..~t.RS.%.u.
s.]..b..p.&$..Ks...P..W..Z/.....w..-...~:..E5....SY....<......n....
.$......(.A.=.o...TA......L.\..Z..~..r.........a.-H..._..9{c......\_:.
......C.V,W.e)......'....9.d...oL...CS.......:.3.H1.e.e.s.z.M:w.\..8K.
(...*A/.*Da...^..).C<..S.]..f../W>.'NH.S..2ff.xU.......M.|......
A.<..?X.....Z.G.......9.$9...1's.i..!..9.N....f..6...hS.9&67,6X.T.z
...-..........ntB......R.8^......Z}.Q?..t-...xlA..`s.z...1"!$.t...{Id.
......oQ;.;G..=p...x".a.OT.......k....2sJPn...a..E.#.m...G..b..a.2A.88
......\.`........\.A.4j....[.-...P.(..|......d.}M#'...Z....87.....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=110221547-110743923

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:22 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 110221547-110743923/114400751
{..m..U.u..).EI3s...>Ms...P.....<...c...p.L...$).... ^.'........
.B.`.....-@fvEF?".,.Is.C|....B.p2xO.J.^U#.*.4.*....(r.P..h........1.&g
t;.!3d..mKdY...W.]{../.......X-...YGo_..........M..V............i.C.T.
.......w...$6..#r....&U...oQM.U....b..V..#.....b.mS3QS.8....e...q.<
...C..d..u........MieZ...h....M........>..........b..)88S.I>n(.]
[email protected]....?.%...S..*..c.V....`.Qi.....`....m6T7.Q.........%..-R..
I6....|..v...N.j.... ..~<.i.....F..<`....V.8.c...~..(...w%....\m
y..}..R^.>...^W6M%..O...(.0.o.;.*|..}......O.*[email protected]
-.)........~$f.8X.....F0.x.P..&&...4lDk..e.."..~.y..B.*,?PK..4.....$..
.t....".....>....:....3:./.pz..(....Q.]..un...A...4(.x.#...e."8...)
....(.U>.S...U.H....K..q.4...Y9..2!...BXJ.....c. _..v.EC...v......w
x3I........CJ...`H....y.Z ..!.3.(...4.=.e't...P.o..7....[`.7......h...
...G.{}...5TL.9#[email protected].?a.=....5....NB....3nU....f.....V.]..D.R
o..k$...o..tb..A.4.."G..a...-.S..\gk...-.N.1..j ...r2........I.."L.b$.
1..,hn.t.6.....y om....nY.;...#z:v.cc.X.R.Q......N\..../.) .s.-...l...
..Dj.[..==s..n...7-[..;......'.dpc..,.......W...f...1.m.CDwVg.$P-49_2.
n......p..-..d.v...[..5.....iytv....!..;..1.......`8........Z.........
.O.RTj...;.$FG.......j.......u.Y....;v.......i....3..q/.a.....Q....Xs.
.{y..X[..V.X...|...;*......*HE.6-".....$-...G#.T..i....=...Z52([... ..
t.x...*Xt;O.B_....=......YN%.L..,..J.d.n.s.k.1Y....."g}......$..x..aMs
...mU=D(...iOx..x.....N.... ..N....h.d.i.-."..cn..oc .n..8pU... ..T.(.
[.V.#./0...m./"..]h...H.Uv.M...iP. ....H..}8.X.(../)..veL....0.EJ.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=111788678-112311054

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:27 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 111788678-112311054/114400751
....G...$...A.U..Y.0...."Q.*n...U .92'U.....R.u..B.z..}[email protected]#..i.F.
&...{..c.....s.......jj..|..........fP8pa..(s....{.........#.fq.......
0.H.m.Q.UxP....hD.S.'.0p....7..........{..c...w..z...D.V..>~.t.....
K.........[..p..`..S....$....n...[....4A.r9V...)j.!.:T..g........sF..{
..t..`....1[k.J.*.....Q.......E...."R)7?...1.|.=O5.@$.|l.........d.S.T
..._.<E........ w..{.>.'!L..Qk.3J....v..B._..<....G....u|.@.?
.rX."...z3m..v.XnM:.....j..X....-;....B....t.......X..i.i.......'....y
@..oz*Gt.<...K..M.o\.hF..rU....{...*...a'..O.sk....Q*.w...vX....q .
...xA........;...L.......5.W..0....w.....".K.i..).....e.....j....*2...
m$S...Y....w3X....2..r8a.^P50.....bE. .U.;j..v0B..%h.Sg=|.......Z.D'..
..........l.....4e....zf.7..V....\...`F.N....#..w.....>.18...S...1.
J0D!.JW..[Q.i.8'^^...,....0...n...W...,eI..l?o_..2.O.W.a.j).u.../.En.F
.A..y.-G....]...a..q..!..2E....p.O;.w.\.].=.....Lo$..8...'......s...Y.
...Lh"Y.}...U.....C`.e.N]..Y2H....=....Mwp.J"... E.....5.o.6..3g?xf..)
.p...X|.0}`...u..`......XI.e.......).a.M.m.n...D.....%.R).5'9...z.....
.....dg1..).)E0.{........?zE../.../...f..?.....8.......kC..V&m..$q.e..
,..Y7...A~.D.2...D...y*.3..>A..X..tz]....A..'.B... v..0.4 E\.'."M..
....#..p.0{....l.2:..kd.]q)...w..UHy..._.{....k(.b.....cg.<pv......
.g..b....;\.=..uF.[.......).4...;..h.sj..[......[...x..\..J.}....../..
 .......E..VN..9.7...a0..../&.....Zc...<.......?.>.w....N....d..
O..d..&,.2.G./...s.|...?....g..q.oM.*.|..D.v....1.N.5.......ht...."m5G
.^...J..f.....c..um...G..%j.....v.O.1.c}-[...r#v..."..^...._.%.. D
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=113355809-113878185

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:14:31 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 113355809-113878185/114400751
.............q..7.IVd.v....c.2W....Pes.u.0....H9...3.I.Q...]h)..0..QY.
.a66..9JYW..!.B.S...Y^b@x........~........L.W....F..<.&..n?...u[..I
..).......Xc;.~.....9%.ZM.. Mp...w...)^.\}R(J.I{.xvR..H.....ds..PS.l`r
fW..uZ%w.....Z....f..9.......h..P.G.d.<..}...!<.*{T.*b/.e;<..
.=..7#...$R..J..2.rI.S.E.:VS...|...0.E.!...&....=..p.c.jp)c.N......(..
].jn..Hw...."...,..q......ir..{4..B...i.W..g?e.8.X...`...k..q#r[......
.8.Ir.....O.l........r.lY.Yr....t....7...Hq.D&....T#...w[A../..D......
g'j/[.F.gk.b..}.Q.#v4'..|ag...J(.mw.!*...1a.......i.s....3.~..M.r...XI
CutR...R...U...M#...]NJ.......`...o.Z..,@(..ou.gKtep.s....p>.. ..0:
.....|.'2..h.~Vhri.'t.....G.%..0 |[email protected] 6..}.r....F...
.G.......k..G6....j...7.,..L..G.... ...........x.S.\..-.ls1.......d#..
..,?.<P...th.......^<..b.s.>fV.q..7.?.I.Z...$>d.....].N *.
......Z.....e.~^.A{....Y..tJ.3.....nu..|...O..WR]..|.C.6.. ....[....qG
..YuO./.|Nz.z.......{\G..$..-#....i!.....5...K.B..k.....D..9.qz.K....F
..s..t.<*~....1...\..7Vc.C}....v,.>-...>.c.8/......G:9P..4...
P...a....}...F...=F...%H.9....S'......Ad.J.M...g`.c.<.c.'T?v.....(.
:[email protected]..!...8.DY$B.z...s.._E..MJ..=3x.s\`x..0.[rd.
L...2.._..Pp_..z.bgr.......cg.[k.l..|....M...J.O.IV..?l.t.(}...4.... .
Q#.z.....S...J4.4K.t.L... ....[.DY#J....{..f...m1.&h..q.)....C...KY=.A
.....<.........W...E.{8M.g53R.......l.../2.~%..:..UM..o....%....h .
|R....{..Ch..ks.2...f#}.../....4J..K..B.yxE7>.Z.....T..:\].....}..3
.^`t`n....L.5.9b$.....o.@.&.\....~...<a...Kn%..SR.b..'l.V.*'13.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

User-Agent: Mozilla/4.0 (Windows NT 6.1)

Connection: keep-alive

Range: bytes=1547946-2063927

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:19 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 1547946-2063927/27347064
.%.A..E$K....6.- ..r7.$NQ....f.)..,._.I......nx'..1....`.vI.8KnZM`....
|..9.[N..*l.2.Q..=<...S.......f.fW....\.]..4....6......OJ.B...h..*.
5.&.....iT.....PG.9........].$...>.. $...K.1&]...6MM.u..Q...jA<.
.O. [email protected]...].D*]W...k...LT[!.uXa....@...)..b9.3:yz.
..Y.y/..Y..@...\..vh.;....^}iw..L..j......0sY.....V ....Q .6.Z..^R....
..I."O..Lz.A..y...h........."@f...K..3.......WZ..u.GtcDZ....s..E.%.T.'
..F.../`.|Y.....).>....':j.....&.....z..........^_.........h......n
....y@n~]W..n...c.:..........~g.........(.e.. ..$....;C....~.6).......
:[email protected]]..T.t.dt.Tf.....zB U..D<S{.i>UI
..%..&i.=.-3a.......3.!..\.L..O?c...a..lu.U^..W...)X.........&g"....0;
G...I.K.....h.".<..wp.r...3...Q./_.35......O.A .k..`....w..O.(..?.H
..rX........ci....j...X|k.<kd.yp.L3..=......z...*.EK*[../m.}p......
2....^. .^u_...a<3[..........2.h..\...../...d2...C....Xo X....G....
....x)....p...fr.......yF..AE./!Z|c.R5.BLh...M..iF...%B<...oFS...d.
..h......3T......v.0pS...T..A.c..... .0.5..`.......E..=l.\-.:[email protected].
..7..F.c;.r...?.w..O..J...[AT{.z.B,....D.w.^..R..&"<.m7<.....c.,
...,G...ph.....U...9...-.....!.Oo...dy..8..C}..,o..'.!..Mw.=.j.8.E-z..
>....y.K,..q.x...u.n.'..;F9.JA.,..{q.Ml.G..<.......a..j.1.l..z.h
..../..:.'C...........b.L. f....].!......E.......q.........V..1..;...M
[email protected]/..K.{..W>...]@i....|.mW1..nr.y..A..v...\.y.go...^.
..3..... .#. ... .=...2...o;).3..P.a.T.........qa..o.\S....h;Y....;.4.
~.....L..3$.S.b-<D..T..k....t.}S........5x.~..H...R...,......r.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=11867586-12383567

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:30 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 11867586-12383567/27347064
.(u.<[.g{u.g..*......n..x....%.g.Gad.....^.AbH.^...{..7P.G.......pR
..,s..^1...b`......I.......r..%...d.a&.5S.E........X.62V........0....b
...e.9 ;~a.C...a )_K.e..W.yo....%w........24.L..r...L.S..z.^)u...pN#..
....1PMl.,..Wn..&..D...q..l.~k..b..33........e..@...|.#..`..i.3S...W_.
.fU.....v...,[email protected]_VP...}...../...*W!.....H...9.M._^#;*.S..
7.........%G.i.......!/.A.=..#.....d.......F.2.....7...>."Mw..$I_..
w...  CA`.`....Gi.:..0.n.(|.NO..... .:".`.......K......3.7..{..(...c..
/..v..7...NA<.x..kV.8....d.]..8..D..^=w.:.5.G......1....b$..[_..7..
.....Kk......1Ci&.P.g./.jg.(.M..~....{d.DN....0\x\.cI..H5...d..'3....{
'....w...!.2B....A. ..c3..h.7.&..9.....L.z.#..D..1..Z..H..]7.Z..cy...E
4....Fy...bb!..V..HF.u..G3.........U...... P..E0.......DQ.......F.!.X.
)......"..v.."..V..V:..g]...9B..):.3..Y....8x...nY.c.f ...s7.|;.....G.
..:Jv......U.5.......Rq..].3.J^T#....jNa..........G..8.....{...`..Ba..
$.4.1?X..O.I.....~..j.V.U....eVu...F..Q.N..F.....lG.'.*[.....9e'.z.i..
C.....[.?z7..3c..UT.O.TY...3..g..;....o.k.P&d......D...Z..........Y...
..w.\..M.#&.............C.....|.(....<....z...a...E....)A..;.....Y$
.e}lgC.=m--.G#W...b}.yI5b)..y.\.C...|c..y..w9m.!....F/.,..F')6.|3.MO..
@......S....<.Z....1..YEV.p.K.I.L..-Y.Gw......e}w`B..!v...U....Ws.s
...a...P..9/....w......?....k...Cv>.Y..XL.n.S._..}.h..{..Q`A....a..
.%.....W....Oe.....t.._.F....qE.l.r..^]..O.t.6....^'.}.l..^Sb..E.nc..z
S..6*...&..H..,rB1.}..^.U....[..4=.k4?.....H...`T....d......\6..&U_3..
..!.-F.... ?.k.....t. s3...F......}...K.r$_...Q.$.\.{J..d...5...K$
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=24767136-25283117

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:43 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 24767136-25283117/27347064
..1.h.L.\F.m..9...>,..F..f&02...m...,.6.'.c.[_p........9.._(l!D%4.1
.Ts..$f.....`.3.......0.o.....S......O....">..P]..t.....#k.....s...
..........~>..U.1|.1.'(...'....d.8~[..T.#=...4~"&..4.tF.....?3..^..
..0..n..;H.......5......C.B...=W.#..#..KA*. ..>.........t0.Y.s.....
^.......x7...e\ .r......c.L......7/.'.Ux...v...=..Am..xLK.Ef.. R.....3
y....$.8..-...K.^....q....7....CT.O..k qNPg...c*p.D.}.$]....276<..J
...O..C...a.... .v.....*.L[......3..4...B.U........_....U..O..e....l..
...J...K.E|..mxK.[.3..2!q%......5....n...Z...../......j..6.YYX&...T..N
&?T.AH~ND.VA.....D.z.z..H........-......u...m>S... {.6..x..H*......
J.u.-.z..4D..(H^$&.Qox.}.....$;Gc...`E...q......q1.^E.V...[mv.3*..>
F.V.>.p..B=.Y...,Z.}Y...=.[..(k@...]R.C.c...#G#RS|.=C..(".yd.4.!.S&
gt;G;.~|..A.f..I.......9.......?n..%d...:..K?.Q) [email protected]>...=V.......
.......:9B..T....x..a.T....s.vG......w.mo.-E.....b. ...A.).*...-0p....
...X.....Yl..9.r..Zx.%.......>u.{.....|.7}...{._........4Z.v.......
K........C...I....{MO.*.4.(..l]l..tO.qe...... .r...x.!.r...P..K.....~.
5.`.u..{.@E..?..V.....e.....u.s8.:8....5......iZnppE..).^].%D.._.)Xq..
....Y..Q..F..6.."i..ge....:P9..8....1n.......n...........4.._..p..k.q"
=.q..Eewn.w.$.B1.J......?.....e.C...!s'5..jb..O...q..%SP.....E.....'^.
....J.KVe.O .......*[email protected] VaW.........F.0.;&U.k.y..`...i..&l
t;.. ...4-.N.......z..%...G.R..*tN$.................(.H.z..J..B..].R..
.Efi.Sa1....Y.A.U.d...B.>. ....z(......o.....?.f.8.....\...*.AD....
'...._8..a...4..u......y.........)<.:.........Q..........y..b..
<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Thu, 23 Oct 2014 05:05:32 GMT

ETag: "a2f3ff97eeecf1:0"

Cache-Control: max-age=900

Date: Mon, 05 Jan 2015 19:14:47 GMT

Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Thu, 23 Oct 2014 05:05:32 GMT..ETag: "a2f3ff97eeecf1:0"..Cache
-Control: max-age=900..Date: Mon, 05 Jan 2015 19:14:47 GMT..Connection
: keep-alive..

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e815addad0f89c HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Mon, 05 Jan 2015 19:14:06 GMT

Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Mon, 05 Jan 2015 19:14:06 GMT..Conn
ection: keep-alive..

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

User-Agent: Mozilla/4.0 (Windows NT 6.1)

Connection: keep-alive

Range: bytes=1031964-1547945

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:18 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 1031964-1547945/27347064
lkvER...J..:....I.=....4.k(y..G..&;.l..:c%?s.X..I..u.....*(z..PhQ]...e
..]. . [email protected]...} .%.5..Z..Ny........N...b..
C.[..<fB.....I...&..U..G.......id.....w..5 ..|.}%...y.)[email protected].."n
.....#b..G.{.@5.....:..Ts........7N....w.c.4^.l...L_#...7h.g..dEp..6.M
..c./*i...5p*..........d.3.rY......9....X.6 p..<[email protected]%.b.l.!.....4!
...B.?....Bc(5....f.P....g...V....*....d!...:..N.kN..XU........9*....!
.....4]..................&Eq.|G.....q....8..ne....Uo.W |i. ...<6M..
........L.8...)..&...:.8..._.......6.t1^... ..Z 4^HO.QI..l.2.K]=.-?45.
.k&.,......*C.].m...U..LD.. ...O....~.Q..J.....)...B.{.N.P,...!.Y.r.@.
..4..*...-.|r.X..;..$]..D./-..~Y.-.8.wE.E...70.&S.._P..?..L...OK.&.]j.
jV.;.hjc.h.........R..X.......)...A..#B.:.....mK.............J-..f.>
;.-.n....4...n........!.$"V...,....M.>?.]...u...e.g. .........bi...
.%.......$.......V...Yy...{{...PV.%....'..M......7|>..d..i.!..!HC_}
.....t....zKR.G..."...... ..1.Pf.....r.|.^y....d.N.p.....t|..lQ...i...
 ]..I.M&yxQ....y...y...qI.........,9...$.b....d.8....Q...H.....A<..
Ls._.;....|..c...........9...eP).1..EvfB..-._%..x"..%.P....0...`a....I
.zF....Z=...*.;...!#.U..Aq...LeX.,[email protected].....%.b.x..b..x..9.y..^.
..O...X.y...#.K.-6~".3,.Q._....I..z...,. .mi=OZ.0.....^v.BfA..1..&."y.
.mL!..u.&.....?32.N..c.Z.....:...^......)?{1/Y.....x..k.....az.R9.."'.
..XLC...rf...Ge...Y..w.K..3.8..X.A..|..r. ..3.......3..N r.7.>s../.
.k.....B..,....r dQ...A.3<p.7.0..m...Tf........j.8..W...kz..Of....`
...v.8.8.w.~.p*7..j....'...C....r...fD....DjFkq....c..\t`..xh...m5
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=3095892-3611873

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:21 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 3095892-3611873/27347064
N...-w._C [hP...$..b....m... ..&....FZ....../>;.c.....\V..p.W.xT..[
V..iC .x.c....2........ueTG.50M..$vw)....^k.e ..!...iG......<.!....
T,..../F..l......7q.....>...a....9....) .m.NO7.7x...m....$k.@./...Y
,bb.ki....."/...?.\..................A.xf.|.qC....{Tm...:.L......%q...
zG...q=f..?.......H..c.....]..a..h..,.Q.....b.Mp......x..~qx.res..pV..
1.)..h...q..vy.(.........B]...{Lm.1U.I.......a.<......Rn..o..... Z.
.&j,y0:...Cu../p....t.y...........-....4S[U/cs.F.%d <...A>...4. 
X(...`.3.#ob..y%.7-.].Z$.......ET...a!..z.>..3...&..!`[email protected].
..xk.Z .d..{w.X..{QA.._..-......L).v.w.=..R.........h...7<d.....yd 
..ih....6.}.,X..hJo.....)3.a...l..,.>e..{.K'..E....K.;ow....G.....l
.$..},.H#......f.........).......(.....S`u..f.........G.GA.!....cx....
.f....W..]..Xl...X...I...;/{...vu..><..]..C.h.......]v.fA$2_.B..
[email protected]].Y.....fR.n....M3....tE..{..C.F~9v...z.Yx..Wc..[t
.3......a&Rt9.h...rj..B.~,j...\...$.9.C...u.......f.....3$cX.........f
.pS..=!.8zLd5..C....*[email protected]~.....mM..p6S..8................zx..
......G..;.8.d.Hu...Gr.B^...........l3U.E.,..VED.38.T[|Lt...q.s5.0..1.
.[....Ljl.....%.....V.G...*....D.X...aem....b.e.b.C.D...Q...w.?.SNr..2
....qc^..r...5N..g..QB../.t..}>....2.[....?|.......5. -........a...
v< >j.8..5.......].....2....{.UX./..,....e"&'.....x.z...^..i.W..
..9"...;3..C....U........~{V..4Qv..C.....SfD..TO.......C%...<.F.z..
........YmQ%...../.D\.M....f.Q.................y..;......B....X...L...
zh._G............<.."r..~.....v..c...oa.y.3.....5.l.,.'...3j...
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=3611874-4127855

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:22 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 3611874-4127855/27347064
......CJ~....4.....L.~....Z.......v7....dm.....b[.....p..V..:...).-...
q.P>...*X..Vx.0V.bq.......r...o..V.l.V.j.#E.l4b.ay(*^.l...:7.8fOvI.
.5.P.....7W....%u..z...4.k \.]... ..\[email protected]!.Ui.a..ibgi.*.p...d..D..
..e2.G]^..l.k).E..,...^*j.r7=Y<..|....]P..{....3..Wp".R.BBHkQ...db.
..........&t......o...h-C.|..D...8{LKe7..YY.#E...!Z".3R.X.!.OS4.......
......U......Y....f/Q..c/[email protected]..>...c...&
lt;....v.?....3...G.|.L%...{.n.7.........c..../.s.V..k..@....(i...4ag.
.....3...M.. .r........L....c.$..L9..#k.T.B.N...;. .x%...6..../.5d6.``
...T.l......R..8... ....s..L#...,.Y..t......jRz.....mf..y..a93...YA.c.
..... ......d......I.......O.B.Gy..#......1.LS.(.9.l.{.....D4...c....m
..m*.F}......n......>.y...>.x.;P.rEes.@}.5.........y....k.5BxV..
 fU.&w_.Y....e...SSb.....c;*VL..G.....2.......&(t......\*....G&.u>.
'g.....[;.Jh.h!{%,.=..s...b....b.]8.....*....iA4).....T..<l.p&...[.
.....2.x2.D.-K\..... ...$I..Q.Nu$y..xw?(.......83x..n.M.r.t.$"n..\C...
&g...%C.OP.fT...<......oy...\.j...*......<.....>_>J.....'8
.....?.. ........~O..t..3#.c..(.b:..T=..4].A..5m....!..$ .-S...}.y....
o.(...n.w.SB<f.........9.....`R....P....:5........o.........~h.[...
..3i...78.p..O....6F?z:.5.....g..=.U.<.^.O."....6...rr.../......iv.
R.i....;.{|[email protected].}.....:2..*. M.4.!....d......;.m.
W....0:`.M...&H.}i...(Bt.Q.z...I.l.E.KD. ..y..p...ZtJ[...:.Y.|..o..YdT
......... ..(..1...W[g....c.7....]..._....'..d^eu.:kSp...x..........E.
....vQ.Ya.Y.....Y.z./..:..=y...w8.(...n_P.?<... G....6A<&%-.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=4127856-4643837

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:23 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 4127856-4643837/27347064
..ui..%.....|_.....Z.8.h^l..VJ'XLg.."z......g.6........6...]_....5....
.5x.P.^....%v~2............L3v.S`2...&.i........*w.BT....v....U....>
;_.H.{x._U.:..[.$..))T.....!/=..G^..@'...%..xj.\....tb.w...G......I...
..<.=%.=..Gc9.t#...`....h..P..o.e..c'........s....R.s..6.)9......._
.t.pw...f.....h..57.......O.u.. ...R.>e../...>g...b......1.b.#..
\T!..$z0.tj...>q..........D....r..>45A.D}...].O2:L.r.L..O...n^{.
....F.r..=I.?.\h.V....y....k..^.....1..\g=n.-.>^:...Y...7..=J.b.T.U
.....@@...y...Sx.m.....t...m..-...P..6Y.....F...2%g0.....K..dt._.uc.`R
R/.....C...11...H.....q.?>[email protected]|i0!...#.......VJ].m.T.U.Z.....8..L
7a...h.....K.N...RW..Z7g......~ .~%,...s.b..eicV....l?.;9.NM..<Y...
.$.Y....j....^p..v..O....V.0..d.1...E,Z...?.....}.MW.s.:.}_!..A..=.;..
..?...-......#..f.........C.YN.*Z.N.by.I..f..JNA.o.C.....2...9..@ c\D&
...Sx........{.M..<.......IA...ib;M$...V_~.6....j..#9..9Y..~.'.....
}.9.#. ...TZw..._6..0.o...xG.q..\.F......i..xf....b9......8J}.U?......
.&....4...N.)...*...E>...rr.6..f..T.j.b...4..T(8.'..t....we....|1..
R.k.%...i..........EU.;...9.....eKX.xR........v.0..4.{K...-"s4X..R`...
.I..W..0...4|=....0r...........E.>..>G.&....iW...}.Q-...L..Ei.=L
....yh....g.A5ad.........?..]...8...._ ...{[email protected].. a.....
./.XV.0...5.....KfS[..o.{..QB...................OeH8.6.~FMU.*f.f.j=..5
..............7J.K <pfL....J.|.c?.;....^.... ..n.{6].h.y.U..I..RQw.
s..TU..pw..kN3._......y.y.....'}....9.<..}..8}.e,.......mX..k-.h.Bb
../..k..`Ki..C...#..&....lJx..7.8.I..U4..N.zyTg...j..g...ru. `./.'
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=4643838-5159819

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:24 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 4643838-5159819/27347064
.!....3a.3t}r~...!.a..3.5...._....[......f.....ck=eK.k{.a..<.....@.
 6~...w.Rd"]pt...n....7.X..r;....Z.:.m...[_..../~..c:MT.Z.`E.o..dVT...
.^..|2.......*...l.......(.;.g,.#...T.Rb....9.w.x{...%K...*..R{;V..!^.
..x%....(.......o.s........j.).Jy.|...Sr...Pw.zPj.....`.t.L....!..~...
...^...R....J [email protected]...;>P.a-..M~...6...;\..p.^X
'8........... ..1F....q2[.p9.[..h..&.. \.....Ut...p...s..t.#..41_..4..
.B...AA.......DX..X.b.m.E4....lIT.B._..r..W..;C......$....j K..--.'f..
rLJ..ij.v.W. 5...h..~o....V....(..0.E...-7...~f/.b........WM.B..&.....
.Hq.."(./;LN8....... ....p...'e...<[email protected]&".K.k&g
t;%.2......X..-0$....pf........&.2. p..8...Q.e...7...iX;..M...=(..n.X.
..L)...Q...YT...f`.C%....Mk.....t:v.v..r..'..K,Lt..!K.@...,$.mH..f{...
..x.....#?r..R....Y..Ny.<.....=S....]d...K.<..#}SX.....:.....eGG
.>..U-..[._.._wap....#y...K...<..P.SM'*.\.f.$eL.&...L5........n.
P......A^!>4...3.[qcl..X......../.d:N..R.a..A...z....H...=H..b.kR.j
....&...4a.B..X&..G.Mt....~E|T."&.i.Z..5i.7l....=l....:.z..{...9..5..y
........=. .-G.....c.....M....d.Dy..a...(...,..f2...j8.._...C....L..G(
lA.&is..g.......,..K.e.*.{.d`B .R.X.....I?@}$;.G$;../...}u2.-..#..AYO.
(<[email protected]. ........ ..j..t%...B-.V...i..
....2....,[,_R..d...>n....U..5G.i.U....m.-.a".`....&.5.]%'1.X..|...
...%...l:......|.U...8m..[@...../a*......D...Y....e2..).k...(lS..%..&l
t;_..^..h...V.....oA..xf.:X.....JV'U......U..3V..npD=v..`c..r.#~......
.K;.6....O|1^...R:A......G.!......sT..j.}loJ.M.A8.#..0u.Ts.#..e..&
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=6191784-6707765

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:25 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 6191784-6707765/27347064
5.G...3.].~...U.2N...B#....D....5@..!i..b....N .RX. K.j.T<q.o..<
.........X.]..9y..b.p8Y69.p.\r. A9Y..Q..{.5.j....~.5%:U...f........;.7
,X..D..0.-<.. ..Hj`...nK......zC....E.5W.eX&-.o.X}.....8* .'~..M..`
.?e.|][....3..."~g......o..........r. .%....]....8...*.......8.-..yL..
" .Y......./.b....$.....-Z.o]3."...k../..9g.\6....*g...v0f....([email protected]/JI
.-.)[email protected]..,).....:...7...]..[./.2f.m9..'..S......\(..P.
C.~d^p...3.m....(..a.X#w.l.......A$....-.....O.B.^2d5..T4"....w..|.i..
.....n..m[.=M.................w ..*/.1 ..X.m..^......|?C.5....K..h....
A.....p..B....c..l(..m.%.......{[email protected].,....*z5.....!.~ ....W...a..;
4...{J.{45....b.b.F.W.}....0.O.~..ER...E.p..]^..pR...K.KL<... .7...
[email protected]...!.\.....................q......?.#....`..*5...<3.?..
k...Bq..UP6...?.-.W..W.......!....Kr...y.}B(!...R.3.L...d_IE<......
....[1K...,........1...(..qj. .}.8!;[email protected]..:.. [email protected]". ...F..k..Q
Z...e.....4.UC..o...).......mY.Q.a3W..Cn.e5=g....tm..-..V0P_.".0y.!..w
...2$A.p!......yG(..DP.H.,<..< .........n.*\..e."..e.....08Lp:.r
....v........<)F...._....N.. n...&. )<....H.\5)5....::....%.?.*T
../78T..gGr.e.'Fs..r.._f.o.<8..8....JO.7...l ..x....>..6...,(.s.
..}.......u..PL......t......7(zw.....T"...g..&..B...C.1.K[.C2........V
.z.q..^..8.;.u._3..r.&......R......2..n.....}.t..e.T.r.sRI.....L. ..M.
.2.m..Q.....em.q..G..(0.6.2.?..06....?........l..A.F.o..O...VW...X..s.
....n..v..o..Y.Z.\M~.....9.9T....L.g.K4..1^..)...n........G<..i...8
.....6.c..6.M.....b..n......%.....,:.....h.5......S..{..R..&..R|..
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=6707766-7223747

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:25 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 6707766-7223747/27347064
<.4.5..J....G.....s..[..y.L&L]..4i.p.."^[email protected]....
. ..Y....!..>T........p....E....L......".e.A......M.k.&F.....A..2.9
.,x.r.w..l..-.L.n.M..;O.:Yb.".C....*.zo.X~.s.}....vY3{.F...E.fhL]rS.cc
2...%...#.......!..|.w..........].@...\.......5.@.^...uj<8..b2..vCw
...b.v....<.....z...d...)..bs.tNR.R0......?........R..._h..........
)Z..7....o...y.@M!.z.1.D*..!....k.....*Q.:.(.....,....D..?...[.....'.,
...O..(V..80.(7:.M.N.?....f.....8.........q..C.)x,i}....._..9}.e.r.r..
....^wV....'.....{/...?....J.....~.....'.....c;"7..0S..v.o .VB....r...
. Qy..*T.....yY9......"..FO....9.......Y.........g.9...]..a= ...1:..9.
.e.........&%...%..S.v.....B..?o....b ,.u\.E..C0...A..\....a....zP....
np.=Zi....._u.J[...A.......]...9.Nw/.:V.?.........z..Mklk....,..B..{.}
W..H..Xk...i.G.......(j.>.$.]!*.u......{...Y~}Y.\T.W....?.h..L1/i..
...d....b...,c....Ro......<..=......x.o..j.D.p$...f.....s..).K..n."
bo...z@.......(..U". .P.[...f..b".......4%...l...].R........r.."~{i:..
._.....D..L ..0...v.|j.<0........U......F!i.1....f.:I.p....<...I
..U..`.....q[.G.........6..B.R.|[email protected]#4?..p..dN.2..R.N..y......0..
K6r.I.PQ%"......6].7Rh.^.5....H#....uJ.^..._~',7...E.I.w........NM....
.x.F....7.gW...Z........^N.O..@>D......-h..{M.S.M...v...).-.5Y....&
.....v.C.1...6..".K........\....l........s.L.......kb....VK.S.T]>..
5.9..wY.Y..8'....f..^.q.(.}.R..2{.c......l(].1){.k..S...;.W ,.A~......
.W...O..r../.e...(.L.F.....)_..;.=W..J.......}.2.`..B....xZ:.X..D..s.]
9K.R...o..#..^..).h....N.....%[email protected]!P!....p..:.8..[".L.!.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=7739730-8255711

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:26 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 7739730-8255711/27347064
..=.........zRN...qf=z...E.r...2B.-.N.....<s.o....c/r..5nZDp.......
..,2.0a.v<....7B.=.:X......G..E.R?-Z.L...<......z...R...eO......
...-/...'i..........3......G.:T.Z.i-.Q3.Z.D.W]P`)_M.....$S...I....#...
."[email protected].!...i!a..{....9e#P.[..Kc$........S...{..P.
.U.....!.:<.....j..8".G.1vcC...3.T...........;_G...)R..Q5-..>.k^
e..zb.;[email protected].(.j^._..>..*..;9m9.3.......<.ez.@..
.....{.. .n.\.I.s..:_........:......y....`t.=.....^;..L........}.)K..n
..-;.C....i-..$..e..X.K.qk.D].1......m.n..xM.2.x8#T..6...\.....X.t\T..
<.{%p.......?.V....O.>..Y..vF.lx.)...0.Z.......m..&....;K3k....s
.nG..>.%.....2.S..R..........i..%ui97.Zd...k...3...w.:....."....(x.
....vT........ .......>T?.3..k.>...S..s./.0....z...t...de...X...
.Y.z..<..^3]9v..f......;q..i...EB......*.=).Z3Z.."zg...B...*....-..
..y.{b..B.../>.....9S..*.6U.Z...m.7~.F..G....D....I0%>. ;.<..
[...B ...X</dV..~.(.......B...%.N....x..:..Y.x......zkQ.1.Q....E.K.
I.D..f.^J.4V....... J......E..nI..5.).x,7.g..z...S...c.).5.....E..h?`.
.......A.....w ..Z...w.... .n.-..._.-P3.)~6.. PG..Z......ik.8.&iN.."(.
.E)9...>.`..h"\.%y...|...r/..U......u..W5..o....^..O...H..,bk..J...
..W.b..*N..B...(F=..!..#4.S.q..;...PI........|..`.........OH  .. ...V&
.w.IRhT$...`.;.......0.9-.}S......,..#yBw..tOI.2....J....H4.~.B%._&.q.
m.p0...U..K..M_......Zc.....1.r..D.].d..A.!S9^Y..y.-.9......y@"...2|..
....z..z|s[E.Q..e~.*..gY.B..BAo..I..us..Q..V2KB...pK..}...tS`.. `p..Y.
.-M>...)....N....W..k).s...E.7b..!x.......:dE..~m.v..AF.:zZnSc.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=8771694-9287675

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:27 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 8771694-9287675/27347064
..:..e<oft..6B.G)P.T.....!...[\..[O..X)h~.{...>..w:..W..J...L..'
...D.|... ...........K..2.w.z.....E:L=.......:U  5.g...|s4.I..T....s..
...)J.t..v,..5..b.c..D.>.o.%....Y.EWd...w.......-Ds....#...S.......
.....3u..:[email protected]@..O._m......$...jn..e....M9.{.7LwX
z.jG....`.....,..-.....P..Tz.......`..4.....r..,.[.)W...eBw..9.kp.=...
R..7a( ......._..W7....^.c..JG......,.........hPy.1.0ZeKv<4......xK
[...T...>~:Y....p......b.z....0Rk.D..#..'.Q.)....]...!.X?;.S.._..N~
.....Q`jt...._L...zG....7... .b....a...$..W.....W9...............y.0..
.s....'.s.....T.._......4......G.....!.o.....c.c....7..........B....N.
..Lz,....T.2.....................h'0..!....R.*..?...'.)...&O=S.....9 .
..8.H...^......h..Ho..k_..m. <.d..<[email protected].
...A........`..".(......;.......... . PWu. ..>.v.._...._.^.s.....pA
Z7.<g....~..UB#j.ly.f To}a/..T...J.u.f.q.........u.yu>.......N..
.mT..6."-........w..0tk.$U.8..."..x..S..."..M.....N....Y%*..6.......n.
@.f..{S.AZS.Y..|>W.,.a...............38.Y..%[email protected].
.3..!D...O.......r....ik......Ee.c.b[cQP.*.bTk"p...D...... ..y..>WD
..C.f{..%.D.p....k......s.^MQ....].'../.....'.-.BA..7.ku2.......R.?..@
...s...{....t...L.T=...3....p ;H..i.O..iyF.....P...byz...%..B.....H...
...*. ...!..le...a.s...v...U hgf..P.~.L:..V...M.o0..m..}....0..._.l...
v(@ {).6....wG...f.p......[#..b.uk<..i.}...r.i.z...8S.......i.UX2BF
.T..-|.. F.7.......e.S..Su.8=....D/n..L.~ .Zx..*V...gln.....k...n....5
R..n..:./..m..?.{..._#...z...*r\..W|.......N...Ap.....;....&..N.a.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=9803658-10319639

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:28 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 9803658-10319639/27347064
...BZ...m.9-....._.-....k.l..A~Y.:..z..x.........%j..=?.2.Y.v....E....
..Y........."..<V...'...Z...s_.v1.J..g.x.*...P....#.U.$........5S..
n|)=..`..y.(..Z`( [email protected].!A...$........./.!"..'.Bm..c...kL.c.m.1.0:Na
0....x.u....."....<O........c..>......9q.Je*D......yc3...v..M...
....\[email protected]`....4%K..6....}a..O;.& .p].0]. V......q.S].....&..Hd
../> ._.....%,3...W.yQ\[email protected].=viV..@,A."w.\S..(..UWS..<... ..yN
.Q.t.=W....;M.... @..Q'.F5...n!A..>[email protected].*.......".'K...c.c1z..
.*.R...Q%..7k.B..q....b.YIc....OyP5.......]L......0.a..k. .BZ9a=W..E.D
_....9....w.7.w...,.....(a.....v.H.........L....m.....>M;D.V>.'.
..@..]..A....(...*..\q...9...\.|...KY.....J..=o.. ...._qO..>......]
..\`Q.H....|_.....-.,......;......v..!<..J.2...a...U5.Nv........F..
.U..e.J....`F{$|.Iq.....2.q..R`..Cvk......\.|...[.... .5..d....a.p.G..
........$.....WVT....g...{,.....M..L....([email protected]
'....l...7..f..B.q../.R.Ct:...s..*d.{1..`].<..B)....4..c8.zs. ...tc
..R....ab.y.T....''[Ng.3."...<l...w......_({.}"0O......5..%.~.<.
....>8>;p...z.d..{.x...1.R...=....G.U.j...n%..v..;...O......,.8.
...1[..4....%..g............zB...R..C..(....C......1r%[email protected]..@]...
..j..:Q..p.e.....O.......n....U..K.......6.fZ..E[[email protected]
u./.....=M....Ak...$....[."G....?,.rh..........%...l...S..<..lBGl..
5K1..@[b..~X.g-....a.....&L8rp....i.............mn..&. R..s.....hy....
............|....)1O;4..5.RC.- 8...-$?..:....M..w_m..\..)..........3W.
[email protected]..>[email protected]....%r.:J.gT.e.p1...H...X.whR....
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=10835622-11351603

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:28 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 10835622-11351603/27347064
Z.f...>;.F.f.*3|...<..n..Gj....\.......k..K.N.8r\..l.T..N.~..g/.
#.....R.Y..[......T..s...|.^$.A.r./..]`......&....Q... .T.x.G.j.{F..%.
 .....r. .'...m....c.q..S....0;.a.a..a......Q...9.d. ...._.=......?L.H
.9^5.{....Z....0.c....x......E../.S..oZ.....S K.7D..........,.nVp.b.%.
s..p..d5....R.:.}.V.*.z.....F..E?4wNQ..OG..aV..k.b..;..<...?..8.A..
f...w..:;uhlmc.:$...-.....N.......{F..'z...j3.6C..2......T.o..I....X..
./d..M...]..G.RL..9.~W..s.).c>yG.t`..4 .t1....... ...6~QM...B=.gh;;
m(/T.WsL..S...l.w:.&..5.Y....P.;.~...4D.b......!.X.<....Ef.j.Ov....
#'vy0k.Q(... ..W<......0..7...^...kUN..FP."*..rZ/g!..f|.Z ........E
:TKO...H..v..y...aW.2..{cq|&.O....p..../H.'.U..N..a1c..C.$..R.I.J.j&..
...m.V..l...7.\...........,......^..!,...j9.'9.%.. 9.O........a`n>.
.:.....@..".n.&}.i.,..S...m....:....gk..Y..R.V [email protected]&.U-...U.."c.
.K...L. y......._ .......;,..>.....^nU.."u9....I..<...R..`.9pc'.
....M...u....=..%Q....&.....uDD.4q=...A.0.....V.........{Jt2.*{...4...
je...."7.m...q%.,j..`.n.&...~.T...gW.m.5]....T.x..........0Wd..,..P.cB
%..2&...'.pR6.]..y..o%m.*.^.;....3..........2J}..,...fmC..bw.D....:Gg.
vA...aC..q.*....FJE..J....yz..4....K.G. ....^..X%v^r.)../.6 d.....#.l.
..rp...#..\..#..f5#....:..`......}tj..g(.....s.U.I...s1.)..&5.|$E.G...
.C.~.Kq).<.%W......|.\U....6;.\...9..).Z..-..!N._q.v....a..0.._.q.S
...:'..!S.<.!d.._K........9W...5.`.."t%.....)..;Duw.........O...VO.
.......PO....p...P....F....\......E....#...G.ltGb"-.l.cR..d.i...;...K.
O..D....:...C.YT....-.L.L..Z.;2..q..\..Zh..=.{..T..V'.......X}.TRo
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=12899550-13415531

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:30 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 12899550-13415531/27347064
?m?;9.G.ue4..\_...A.5>...Jm..k9J..e...o..E...Z...4...,.Gb..h=Y..Z..
..t..)M..Q.lkQ7V.w=.....,9..I832..o4w........`.....Ye.h......".N..\..'
....$.|$[.Qk..;..0Z7u...O.....pT.....f..K....H.Y.67....m.x?.......).w.
.].a=...b.m.......l. .#...a..J...6{..3#.s<.6.6.........0.T...A`.kQN
....=i~..i..a^.@.*3.Y.~u%U(g..>Be..q....T&.8.... i....1..m..=v.#'n#
......Gv.rH...n.p4...B...Tw.8............QMLcc..<....&f.....R.h....
:Rj....a.@g,..(g..E..WLg6`.BWP..G~..s.0..=,.6.C.~W>....PT7~Z....o..
&..vpv`....G.Zc..".p7..7..5..l....c.a.&.&...d.......x...@9.$....d7uf&l
t;..N......d.%.......'C.=ED...x....=.v.p...oFb%....~.wg<.}....v=...
.R....0..7q..............N.E=R....d.UG;~..................:.n..S.....i
"X~R.8...ZB..8......>9Z..^f..Xuo{-.0...@...&.}.......u6..L(lW.<[
.z.8.*D.s.....;.'1....5..>..... g..X....>..3*.5p.&...,...F..9..j
.p.L..L...~.4.w..m.._.<'..a.O..^.s..).2 5-....*>.....A.T(9lt.&..
g...OV.8.....0v.......8.#D..G.....B\.7..ry.Di.....X....V.Ngm....t.G...
....O.._..b...W.A..ewg....x.......I.w..K.._;.AaX......l.........*.O._.
....aI..DAG4a..p6q...#b...7..9..\..n.&.<...=......K.n.K...;.(_.-...
.:...n}.|j...k..J...V...M.....;b.c.f...2\%...G...P..gs1..B............
f...a...5../X../.....1C?.~.p.W:...{u... <.A 0.h.t........ ...\A.G.-
...&....T..&....(abK/n......x6N...20T..Wmn}..6..Yu....P.v<....2b..U
.tl...........1.S.R...B...0.&i0.k.8......^}..,....PC8.S....."..hsaY;.a
..$ ..L.....u.-,./.2....}...%.c.....4....[.5q..T...R}u>.X.7*...j.zm
.M..u..c.. .0.;geH.Ec....1 ...s..K..vB4Y.Az]..........#.......*M..
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=13931514-14447495

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:31 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 13931514-14447495/27347064
S..T..............9Nszg...p6. u....J.x&....L......eS-,-....%2=F..^u...
d..{..d.x.V...~.-......".R....Y.....(...*...............a......|.^hf..
.]...4cr..H......H.k. P.........g..z.r.^~..0......s..E...5.8q..D...i`0
Q.D6.T.. .."......s.K..6....-.....V....]...J..........y:.D.3......[../
.ix..........{}.....d..J.}......!..]..d..._...=i..."....2...C..qJ*.!._
....mF.........M.....1....z.#t..03,.......s'.!...........M5....J......
[email protected]..../.7....~6{....P_l..yq;OZr.....U..U....R..W.8.6.Ro
...L......O..._..(U..| [email protected]...}.1..w.......{U...>U.^h<..u..
.8.......Jt....u...G.t.-...#.........lV...........|.6....'.\D'v-..w.dt
[email protected]....."DV.!..z,cs5A\t.ky,......J...b.p?.4..[..
..?&..t..qhM..o.N. OG...6\.Z.mr..4.CS..T......0...3...........{...k..f
5.. ...0......^"2p".u..G.t..b.........[n.X....../.|y......2i.|.v..D..N
Mj/..../.9.7...Z...K.ej.;....&..). I..EYC..8.,[M.m7.......dj.3.O...R.&
lt;...]...M..*..5s}.3Y.'._.,z.g8.{v...w..`y...DRU.tR.')t...Z.\.J......
..V.N.8.,........N.BT.EY...d......}[email protected]..]....<...
'2.:.UX.|..Jh..'^..h..Y.<r....;.:.....(...6 cL..`.b...)...VR5].7..&
.|;[email protected]....
q)....2...|.[..j.......z:H...t.B#.c....;q&mNz.....(........s|./..'....
....m_....*Y..J.l.D...)w]q..j..:...#.d.Q..Y..a.DZ.......lIr7.^........
.;S....s......3.....HhaYMQ";..q....8(.s;.].(#.....N...Hsu8.N.R..D.....
L/G,EZ.zT..|VN...N..SJ..U..> y.....0.k,[.A...OP..."q.nF.[KF4...N..C
/...K.e\..cu...SYP.T..b..x&.5.7...`..M..!k.l...G_tb.4.Z8..n7bz.u..
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=15479460-15995441

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:32 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 15479460-15995441/27347064
....H6...0..68H....W.....0wU...4Ce ,..y...1....S.j=O?8...vB.....i ./..
 ......h..0.....iJ.H...... z..5T.?..Lr......D....................X....
9E...J.)dGt...!=..k.-R. Y.A.s..o.@{ lmpV.5..n.....{..1.........c...|K.
....aw [5...TZ.b.;1{8%@:].......RN`xF......2J....\...`...W.......B....
J..... .w.._.|%..*.6U..d.....N..X_.Eo..I....jQ.S.....h........U'...i*g
|pc.N....j......3....X....W.3f.=..25......2!u..mH[.M.A.WuJ..=....=a...
.F...........E..R:...$&Se..t* }.p.vk.g...c..z...!..P2...zX_S..`.{....5
....pCV.uF..Z..........*.%s..a....5....I..5{K.*y.b..-......E._.7i.^^^.
..t.{.1.R.......L.R...h.|i ....tD...P..GD...}./...,..!..I_....[!..^...
..g..a........F.yz].K.h......;...RRY.....O....4.N..].}.N....N$.:Bf. F.
.p..R...8..?T.Q..r-'[email protected].}..fnE..~..V......y;7.....x.t.^....?=g.
.3Q.}...B...hb.1..(. ...XX..;.p.Y.......,.2..i..:.".1O8...v.\.....DT.]
.....`.-.$....j.J./.?-.....`Ie'.........T..k.?w*....DY..]...MK..~=.-&.
.-P.c.&.....&....3....B.....b./..{.o.rp....^............<.d.wu.dy.=
DZ9.......<.r/&"X.^q........N..../......S.0..U~f.~T...2..I...:(...r
..2...%C.;...:..{.R.6..b.WkJ~..=....C6.`I....5...>.#. .*%../U..|.C)
|..8./.x.'..}2.!....o..Z&..}...|<.......9.tJ.<G.....V.9.}m.Y^...
. s..{E. E.......q.....j('^E._..(.L&...e......0.-...GI...<.k..o.=.a
).U...J..j..1...N%.s.[..(.Vx.J^ 6..a.........>..'.?...e......G..7..
.x.....!0;v..D....`.p..!D.h.z.$....c...t\....s.......0.....oni ...k.t.
.s...C.BF..x..OU..z.@.}cV..P.....^..y.....xo.7...j..uuRs.|.,OUK.f....j
?..rk.V...c5B..i..3..[Ds...u.....B\[email protected]^.N./f..u....:.a].Y
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=16511424-17027405

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:32 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 16511424-17027405/27347064
....eE5........._..p0#z..k|.h..).L..|..G..tJR.p.$!.iN.B.h.Ga#|*....qv.
....."1O.^1...>....m.bT1....O...-.'.s.^...`....|..E.O...`....V.....
............y..d8.FJ.$.F.....;.p.........].:......"e........=.&...Z...
.G..7..:[email protected]. [email protected].......**....w....n.)
eR...L...$-.L..a.?..q.x?....e._..{...u%c...or.b.M.t.w`.X..W<.X..R..
~2.[....IX.[~.q.eC.Pof.....9_l.........mu>i...B...1jOi...A.T...I...
.2.h-J.#.......nO..f.^0.......zY.h..9S,J.s.......xJ].........N...).H~;
.. ..1{l%..\=.o~..9.q..@....)U .....R]DU.b....0'...l....!.0^>.....]
b9.?.J8Ir..H.O......_..k.6...(..!.5:...i.....A.Cq..._8AT:#}..5E.$.d.n.
.....vgQT..Sl...fE.......@...=...tC.u(>VmM..[.1.....b.V.(.z{...(;..
.y...m...Dj...Lt.T.\>.v..D9....m..T.6..SX...|U..`.h....._..........
.a.iO.Xq|..f.......=.O4(2.yL..O..e..W$f.*...X[.>.Q=....W&kGa...B.p.
..uG..,.5...o.ffj.d....d|7q..r3]..?v.^..K.(.u..a.\"........s{F.l....9.
. .{b..!3M...6.=S\w..]gr8....d....w......7$S.DN....rS."q.0.6d....m.s..
..C..4..vC[.....D...b..$.L.I..3.,j.bx~.cX.( ...c`U..F. .1..)...c.{O.`.
v.o..m....XU.F.T$.\Y....h[.H.[...B%...H32...ok...p.......k.Q...#.u4(|.
.s...n ...O....X.[g.RKr8...........j....y*...?...8.TVm"..b-FC.b....q*.
...R...S..p.#|.....^.u.e....3vD.n....l...hO/.x..reF....Z......,......S
....3-..L&!ku..A.|[email protected]
[email protected].^.3.]...Z._./6.b.k.....4..q...Y..:..
!..6\.J..=...sA.^2 ...S.Rq.C.}r..a....zSw.m........).(^...eb....y..z..
......<[email protected]... ......\l.R..W<....
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=17543388-18059369

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:33 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 17543388-18059369/27347064
.."....o.CI......R......>...N..:|...[.........r..J4.-.9..8q.....,..
..wR....2.<.x3S...-.........m..........I5"~ ,.V.Q.....V^3..y.kM...j
......]....6.k..Iy....<...I).2lOb!IOjdF1S..u.$...(F..u.!..>.t.b.
..3:...T....j.[..d.&.`....re..y.%hY..x"........n.HT..0..].=....Zei..%.
......h...r:>7...^"..!..8..'..w......R....{.|@[email protected]]`}wM(.~.....
.2`.c....6..Q...0.|]....m..g..*.V,Lu..?....]_R.D.....NHk........Am.ZOl
b.u.......*j...1.b.....v.lM..b..S}......P|.?=.....H..).......G.#w...q.
...v.S...|......Jf..d.........z$,..9 .Q...R..f....~....Q.Nk.r...,z....
P.......P..PS8.......X.mw.1.w.[....*8.9l.........x.....k.i.p.rz."^!..-
.k.^n*..We......L....GU..4.=Q..>_L.E.9o.78..aL ...L..K....,.2.=..mI
.{4...T..$....n......1..)..Jr*j..B...k........#.^.A.....3.-2.yz.5....y
5..s.&.|.t......Bn.h.$..z.}5Z{%...$O..t.}.M.D...L.4.........nM.|.s..ab
Bxw..;vJ..j.;G.$.mpq.pXW.x.."..../p....c...V.zY......sr1.Qi1..gR..P9..
......B...p>. QFjS..#.P.........y.I\....as..:e<....N....&x...?..
.V .<..Q.......H....I./.C..t.....NC/...u...6........A.0.0..&.;|._..
.1.3.@..... .(.1.._...la<...Q^$#......K...,Pt.Gp....w......}....-..
.IC..{..Ep.w....Z.'!c.....d...^.}........3............Yi.x..........'S
".......^.o.=.Y.}.>i.<.."...tE...@..}...Et........?..u/......)%(
.g..YO!....8A.1..1......8..^LV..`.(..@)........;...f.d...Qt...y....Jz.
.5...>..`...t.!....gm.. .~y\.6p.4.}.<F-.'...W).....C..R..\/..[.-
...s,........j...7e.N:."[email protected].....:bL.....(......)(F....D.r
.k&.xO..b.B... yRW{J...Q.....f...z.T.u..B..V...K.b.*..3.DC...|.!..
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=18575352-19091333

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:34 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 18575352-19091333/27347064
.H.j...#.!...A.p.Z..V.......].U."..!...x..2..y.....I...(......&......o
....,bV..f....g?....Mf.N.P. ..[..t....b...........k..G.Q....GV........
....Ub.#^}s}...T9_#....(.O.. ...........Tk...yDn...K....J..1.b.5`.]..`
bk.>......z...c._.]. [email protected].@...<...*..L.9.z..\._.v.j...}
....#...\...}#.]......[x_6F..P_.]U..F./...sT.p.5..5......!...%...gBR.i
......IO.....8.S......1Q.....1.o >.,g.%.$..o....~..).$.L`..L..t....
.'w....F ..(^....H..tMH.,....j........~..|...x:X..f_....5.e...J......m
.....4..C....P^w1<(.e/.l...0....*[email protected].\.^..M...(.4.O.h..Y..Z.P.X
>x.[,O......$`z....:.....g..$..L..V.i.>.h...T..G.t......*.'.....
.d#.#?L.\.3s.T.=;....u.9.....sC....aI..V.nA..................N/...x...
..\.t.5TH v.R....D..=.?.-..h|j.-.j.v.C..2...H`!\.0J8. ......%....C1.0.
::.~...-q....H>......#..S)6.l.......O..X9H..I.%Z..Z.5...?. (c....i.
=wJ.................z...".......:.M[...dC.m-....../g...v.|k1...n,.1Kt.
..L.....L..<*..."Y.YYV...w.M......../&.:...v.G?M......*.H.\u.Ik|...
....t.._.i.by...c..>J~.&........Z.K5.%..S'.M.........,.]N..yA......
I......]...&.............A..Q...N...WA.a.....d:k...S..5 'bL.1..S!. ._.
[email protected].<..&O\.U9q..ek..n......g..9.{.nC*.0..).......&.......b.
...X,.G.!. .'......n.....V.....N...U....&).*..pZ..}..W......U......>
;"...L.iN.Ufb4.x#"..<....*.u>....&..>n..'...G...}.wTUQ..)..3S
............v. .j..zG.f..... ..x.~h..?.&pQ..5..0W......X..x...N..".F..
...r...B.~xDe..s..y[.G....p(.....N..[E.P...L.%...$......f..=..c...D...
ZO..A....F..... h.q ..NP.Q.P.Q...! c........ {.x....:...kR.A.N..iY
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=19607316-20123297

.......$.......;...........,=#.R.w.4..W.......'.q......r....N.>{Q..
.;......z|<.q. .....'...0Y.......{.g.....K.=vQ.......yX.p..U,.a|..Y
...(..i....R7.S......_.....V?.qJ.^.xE..x.......x.eLK....E..XI...c_....
..T..#'..1.b5.>9.....O....`....:.R........r...y.`.!..O:.W..P|...3b 
.Au...4._H.z.h..[.=!..A..jI...G...D.0*....i.Q..j..3.`HH.._.Ut;...c....
).Mc...~...Ib.....$._.._j...gba....f..r'..Kx.$.s.u28..........=..W...5
..8...x.. ...J8...%7.HHq6t.,.B<..t..Z.5..T.4.......R0......,...).rY
......4y...8.......6]....d6......3&...g..6r.RGY.!....p.H.4.h...35.[V-.
m.{..U{..../.aO..a.n.....n....;[email protected]|. ...0...J
.M ...P...>...k......r..zX;..Y.q..qD..."..b...v....4.B|&z CT..,....
...4.B,h..mJ..M..t......D./^..gh&....y.\.]...Z". .|...Dvz...]...y....%
..0....jOsV5.2....[.....D)Z>?.G...(U 0...........0H....e8Pz. ...V..
$..X 8.E...>jA.(.'....F?.*[y:K..~y.6u.bW.}BZ.....7.Gr...f?a...AV/hw
.V.rS...{.A..W.Cs.a......Ll.g.$e...x:.l.......#....H4/...5}..{..E.e..S
[email protected][email protected]:.....}.A....Sz...e...n`.?..$.wB
.......ZKI....P....>.E..y..N.q.CY..*.%g....3..|#.....7(.P..2.8...=.
E2.c...J....".LUn:.......3..U.&y.o....*../...6\...n....D..../..n..E../
...e.$.[.......7.e....R[m;J.;INU............`[email protected]...
...........k.=m...zg.,....9...q..j......F......p.YzEP....T....la...'H.
$..o..j*.D.g....5..9..t.....{.Qej..a4.93...>...*.Z?....x)....U..S.}
.J9f3.=.....6w........T.tW..-...)v..NJ.H..$V...,....f&1E[....S.t1.....
..S.......`....tZ.....X..ii%.........\..82o..5(.......O..~<Cb8.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=20123298-20639279

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:38 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 20123298-20639279/27347064
.o..=2.[(.F....j@.:.OA....M1.X..1..$.?r....v........>.O?.HA1Mg*"..m
..%.[5.h...t...RD_K.......-^.2..CoK./.f.E$=..Q!....o...S.,.8..>....
.........=..5iM.x.L.DU2..p.d.<...:.o..N.V".?t..UC.........2.V......
J...E..6U..E....d.>.8Z.D.....#....%...G.'L[..'..;...S..J......!.k.|
f..6....S]T..AJt.G.&.7.l.L.`.6...7y[..]Y'.c. ....s-.<8..~.....>.
t....t...:.%U...M.......g..E.I}m=........h!8.:X.o{.......{.8]q...?_.""
.{[email protected].,.....j0d#..(a.<..Q..B..^....d.;>>.K.,.......
..C....,H..O....<@.=~...e*' '8....$z./d;.st....t...T.I..4....M..>
;....&].b..t..gg...5...t7 !.(-....H"bW...T..K..{;A...x.j..W.....%a...?
R.o.*x.].....x...F..w?.1......vOe5P.....t.%..Z...1...!...1......,..q..
5.G4.m..Ur.....w*.G..R..d.o...........h.. .l.,{o....aP...!..~.....=u u
.H ....=..r.mt.i..,'ZL....Z..#..hf.~/..kv.......s.XPJ......8!~..V'Lm.{
.v.s......}.1=...R.YB....3.3.....e.=...:.fT..s.i..).r.........%3. .p.M
.9|...........,..yb.....r(/.Iq.c..h....q..........'0N)..!..)V..J.f..}6
.:"...*...h...O*.F.|.GC.@|..M....P"..z.......:..T.E.8A.4F,.....}S...,.
X.ZY|.........2.@.~bhy../..`..ZZf*.....sI...r.B1..........l.)...Qx....
...[Z.B.QI.....1.G...6q3..v1...Z....l.0.<.{....P.....W.N..w...c..?.
.-..._5.H./..rr].9...............~.`@.`\..r." ..EY......:.T\.B...a'...
....m...Xrg.8b....#....2F._,.....o1!.EAxx....z ....m-.gE.<....&u...
....U-..mA.&Z...?...g.P...v..qC...d....~.......\^.....8.K3.....o..19#.
ZT..9..;...........W........./&....X.....0V.:.?....w7...Q5<o.......
.`...o-...6.X..o......4......0h.....#.._.B...l.B...J..N.!...4...B.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=21671244-22187225

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:39 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 21671244-22187225/27347064
..l7...mt)]_.s.o...........y....?..9.u3M-f.V...IS..($.9..^..r...vn..u.
........@eQ%"I..v.X...yu..%[email protected]^.$j..:..{]3..45S.3N5'...7...u.f
r.J.....&....JR...J....9>"!...5.7..{.j..J....4...Qaf.P..n..ZL4..k|$
}.../..Q7Q^'}i...rK.n....;fb..^{T.......9...2....:....bn..ZY..#Vt2.:..
s.`yH..W.C#......B~h..:.J.(..W.......q.n..]_K..e....1.xs..)^.x./.....%
...//.DS...&\J...... ...E...7.........X.g.......P..!....nr.5'....;..?.
.`..2....8.......l4."Y71gn..H@edp<.....c...2.-m...,..%.c.p-P..E.)F.
.M....Xw....br..........|A@g.]-i.u.R.7.......SZ.F..('.....uov=..,.\...
?so...u...=....H!E. ..8<.wV.&....lq....P....:.t......-..6.h...&..D.
3.(..w. z../......u....L.....y.\Nf.......U0...... ".....9J5...........
.]P.a[&.0.....e=....%3 P.!....aE..6X8.Y.....jf.E.O...Gp!.@l5DWv`.).4.]
..G[.....V.?.<W._.....}..........=G.7../.z.oO...>.............w.
.Y......m.o,....|...>|...)|...z.....:k&...0.....>..w.}.w.....)6.
....L"=F..!...~..7.V.M_\.....i!.c..R.=...[....'...../TQk.of..<..;..
=<..{ax.2<|.{........--.O......~o.........6g.~b..#..O....5<J.
..'....:.........|..o~..G.....>.cgi.._....~6I..[/u..a..g...........
....'....k[s.T.%.....n.s.1...>..{0.?Wvv...[__ZZ...;.G......2...I...
...r..#.[}..hx.c......>.....$*..]_.:.y4<8<..w7.....yXI].Z.G;.
...<.?....`RIZ.Z.?...>...z....;.-v=Q;.....O...... .....k).....|=
;{c./...g...y.....N.~#..u.Mv..<%.#^}%.....Z.r...}N~.....yn.S..;....
Yx...={.ss..G=,.O}j.Fg.....J..1....F..EO.6..:<x..9.......2.S'......
.z.....>l..ac..k&...=l,.x"sq....{;...aO..Wg&...X..>j..Qc./..
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=22187226-22703207

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:40 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 22187226-22703207/27347064
...2......z.4.....x..zz.... ...|...8.o....3..[.p.nY....?.@...>..40.
x|.....A..'....P7....}...8...].....!.W\..d.&.q.DVc...* .h..3...H..!]. 
.._q....S..V..,b..D.M....b.dBf..{.HVq...H.gb.P2..{..D1*jhm.L.O......p.
........^.$1.E.;..w6J8..y.c.j.q..|.../...G....TG)A.iFX.c..J...h..u`].=
D.-. k.........X:}$oCnHj8.71...B^.=B.g..g......f>2..~..'....?......
O~...Zn....#...5....u{(....}9.........<..4....2vq..n_LuY.y...C^.3,.
T.]].[....]...z.(.]_..zh.....*.U;Lm.uly..u9.....n......j.]15C.M..r.scl
u..].M.}Q.v....y....7.n..m].<.vcl}..}YwC....n..v}...q.....R.[.6..I.
;...P........nn......5....[...}S......\.aE.......m{.7...@..&.....~.Z.p
.vS.....wCY.n.<8.e.....F...L]5C[...O......}...../....bW..r...o....}
?..~.....C~...~..E}h.]./a.j...f..'..5.!yM..../}.................w1.y9T
......?..y....UW....O........|m9........T.E?..p.....5..4t'....3..8....
.?...,rX......u.f..o..o.......O...)..._xP.o..k.......?...B.(Bl..%...l.
.^.. ......f.h.|......n..zpms1.Ek.)...%..v......YBn^.qB..6.P.]_.......
...-w.i.s..<.D...............>.../..!..P.W.....`A.....v.g}..q..2
..]v.>..|..i.....D47.}Y....r.y.o;.O...?.._............=......7.....
]...R..&..bWO.p..bn.....".8..a.............,.......r..G4..............
G_.....z....`.k8|c5.-..........g....G.x..EQ..4O.C?.....Z4.a.....f.o...
...f.................6.<.n.`5....9..b..C..f....N...H.....-.2.......
[email protected];..P.Z.`....x.&8.9..=~...w..uy..#@.......
....|..{.xe.....x..........|.............^D..d.........j<.eQ...j@..
x......'?.......?.../.m...\..........M8u.q.."S....(......\k.?...j.
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=23219190-23735171

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:41 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 23219190-23735171/27347064
9|...=.._..uE..-{K....h...&..@.>k.T.yYX..;N.vT.B..\..1.|/h..k!.Y..H
."...E`.9.......ma.uR.D."3...kA(.^v.. -h......zpV.;.C"..a..U.n...B&K^5
.... K.;3.S..8 .k.}....>..UD..=...."|.k.._......\1..e.B.."..$PQM.I1
.....z.!Yj...H.B6D..e..S....#.C...aoG2...4=..|......B&...r. .C..p 9&s~
...[QkJ<[email protected].."...q(...,.'...4^.}.=.....r....V..)w.......F.2p
...j}.6.X`M..<...$A1z.cVq1i.H{...O...H.e.J!xyI(.................T.z
 m.......YCe..2.g..R.A.0i. .....CF.T...<.....a".Qr...F.4.1...x...g.
.#..|V..9.O..F........X\[email protected]["|[email protected]..
N...D..:..e@.../....s(.~.ON.c...#.u.$.z....e.s~#.a.=.T.............Qf.
....o.......%......].....l)..?.....Fs"{...t.KF.W.Ajy1...V.` .o..P.%.:.
H....A.........w..%.".>.....BE>....&./;...Y...!..]ex.e=v~......R
...!../...... ..|....N.....E.~. ....i..Y.nU%.....J....A....T.....F...r
k......a.(.,~.....fRY...v...f...C s.....l..'.^UG.dl...b.o..71.P..o1...
....=.b.}......S.L...p....OQ..A.-=Y.5..23.a...`.G]%b..O..DB.Q=...D!..o
X;.../............D`..d.)h #]...#}}L\R....}..$..[.Xd.......k.....f.o.t
Dubp~..pP}.reG.C8....m.......4.J.>p.x.!..T.m.c.S.~...._K.......v.z^
...4...2.f...b..w.E...g..MG.....tNu7<.....O3za..3..F...S...Qg..*...
......~.........H.........).r...[..1&H....3..........P.....G5..C..s..!
.........xLo.J0..8.K!.k...x.x...s...s.Y.^rx..?.t".K....fY....S1Y.&..].
K(..IG.{wS.(0Uj.C?..&..O..,..|.....m...r>.9.E5...v.T1..<!...-.o.
.HQHB...FQ....V...$=.....v.@k.....).......7...d.l...5$...w.\........pi
;.b..&....{.Al..$\...nv=.....bS....#Z......... YB.Y....l.e4A...)..
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=23735172-24251153

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:42 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 23735172-24251153/27347064
..C..''1.?,B..;..,.../Q.|Jp/...g...eP.^..ht..{."e..f=.\[email protected].>.[
`^..a.k{./.@\.......h....x.8...)..."...y.4.a....y.`eYU.....e.z>....
...'%....C/v..a.....j/..:\...1.s..z.4...{.v.....v....7r...q..S........
5h..c......7...d..B&kv.T..T.mQ.T(pX........B0...!=.1. ....]a.,...9...z
.)z...(....5...j.B..wD^?...._.....c.................!PU..9B.W..Dw...b.
..A_t....0..(~s....1,K{7D.T<.U......7..9...O.....N...C.>...Y1h..
.......BN.!a.d.,..&.(....>/p.w.Y.W.|g.8..T.B.........r.. .#ma...;..
M....3M......L.....:..#-jL......{..`.n..X.wQ..Z....p$..u...:.Q..s`.Z}.
...&...."K....Q.0h......k..[$.ry..h...<g......7...l.r....L...R.l.H.
...],..*<..a._.N.U<.d...__......b~............*Q.....v....I...8.
.I.....S`}b.KX!m7..ZW...l*BqUh.#n..3;v.Q50c.&..[v..s........'...4.a..2
[email protected],(.......Z....Vi.&...>7M#&.wl...<{8.&..C..;l....9.NK
.....D.....=.....<.O.<......Fm._1.^....SN._.....T/-.$.J..F.k....
....._.[[email protected]:{.k0.*..R.pH......F..41dv..F.............1 o...6...E...
...[........y.(......:......Qp...J..&.....;v....)....<."oV{........
9uq..f4..k.ik2...p.(Z...........Dod..q}......v.;....C...E.wZ_s9#.UT..1
.g.9KX9.w.q.v...* zW.3....(..hIP...{.qz......... .[..OE\76.....V.e.#.S
zkCj..zgPe.P].g..I.2|....0S....e.Qaku.M....D.$.................@^.cw.:
dU.M....?...F.i..x3;.fA\W..S./1.S`[.d..V.!.........w.*[email protected]..
.......v.v>.....*.rG.a#."[..$_Ir...`..........._...j.........T-`...
.v&.:.8.:..q.......5.&...q..`.."......X.p..k.mP3.'...l.'..)...........
.....p.C......../.....Eq....-*1Z.x.E~.a .\.v.....H.%.!.N..@y,#0...
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=25799100-26315081

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:44 GMT

Content-Type: application/octet-stream

Content-Length: 515982

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 25799100-26315081/27347064
.......(.-....4>....=.dFC..Q3..^...S8K}^'-.`.......`U.z...e:..!..l.
m......n..s}..r:.B...z| ..(|BS!o..S.....;.'..xN5..O.w...t[..g...#..h .
.4.....o.2@.$M.?...A...%3./..~r#.t...x~....%0..,Z..=.H... ....e.u.SV..
..<.&VF..BK[....r...9l.|....lI..6h.B..i....)....~..>.C....._....
.1U..?.B5n.'.E(....;........E...w..f.U.\..yi...K...a....9}..F;..3...&g
t;...^6....vj.8..rFT......P.}.?,..:<x$.i .K...Ok.G.W8j..TA\......a.
..i.L7..C...Alny.....g........u.4..........k.;.....h....)K.......o....
.et.8....A..... .....c.]..Q....8.0f;.o..C..y.}.;Z.)9.).....W{Rnx....c.
....k.(.?eO.<............9z..."[email protected].......:..
...K.w.4#_.G.......*.iT....mq....& [email protected]....!:...~!....
...LC........@Y...<o..?a. .2..j...GU.J@B.;...C.=.....lC;`Qn..d(....
.....(.....e...Y6..p..[j.......... .b.g.5.z.....q #.-..F........W..S.k
5...{..............p.v......Xe...........(....5.'m....4.........DQl.G.
...M..5!.QH.V..U.De...'..U.;...c.N...,.A..Q6.P.{.....@... ..I....0N...
0T...I......sM...q.R3.V..O.!@7R}...O..O..H..H...3N.g....5.....]..L....
.b....r..=.....a..-....=....F..XC/...,E..g......M:..m.x.TF...,........
..8.}.....$-..[...s()_.T....T..uSGU.p..R [email protected]..>/.y.KW..nk
.....T6.V,.[[email protected]%.#..F...sb....Ch..z...E.#..e...71...7..., K....
w.[.\.{6.%$^...H..... z.~.l.m..<so. ...&...=5\[email protected]:.....t.
,.!!Y.......T. .).....6.V.W._.8..Y..^.......}FN}...".l`.:7[........H.D
]6..K........A.Umz!.q.S.p.y..].2.|..........5........g.J.^.....&t)N..*
u=...=.n./7*.. ..<......-..A.........mw..B...VB.HH............a
<<< skipped >>>

GET /products/beedoctor/dl/vnn_BeeDoctor_VN_v0.1.1411.1712.exe HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=26831064-27347063

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:10:45 GMT

Content-Type: application/octet-stream

Content-Length: 516000

Last-Modified: Mon, 17 Nov 2014 05:29:55 GMT

Connection: keep-alive

ETag: "546987d3-1a14878"

Content-Range: bytes 26831064-27347063/27347064
. ..........85.......$"3..3c.....}.0..V.......i.z.}P..v.W#..-...Kt.2.c
.(N\.%/...]d....J.m..n.O.J.?..............t.H......,......W..g.0laG.. 
Y.R5! D...K.>....rxD...> .,.,.&'O.t.q...T.D.O........UCM._S!.!.Y
..5m.?......C~.O.M...h....A(.{..o...~...N.>.;..@.}2.I..%.(X..M.*.H.
.....4.$[......Z............q....O^.......C..yw...$..o. Y..Y0u....>
.|[email protected])!..V....=..&..{.{..F.zgC.V..?.hgL.3i.\.8O...Z|.S:G..)..]..=
b..lo1...:.H.-...y3.S.'...a.....8........{....d.4).*.BW....o.|...d..H.
......6Z.N......-re.<.5..-.%..={...on...?....=J.NV:.......^....o..o
DBv...g..O.....rn.!.z~;.....'6..J..e.k..."....Pj......g*..6.Qv..$.. t.
........(.{.$F>.J3..a.z..)..*.7.h_........g......8.! l.Hfw.#.Q.c._.
D. F.....Xz>...5qN.9...j8...e....Zes.E.... <=.._<."..g......8
fL9G.. ..].._.^4.<.0.&....]..`..5..;>.D#..F....Gy..7.". ...Jg..4
.g?.8.R...gO%.[D...\........w....n][email protected].\..
.{.2Vt...vk..Or.........E1...v"<..o...o.c.T...c.X;(.}.Fd.T...}H...3
...x..F. ....M~^>9-J6|...!.7.._......We.gu.B......Xw8Wq^..vJ=..`...
.Jg.6.........Q...W.>..`........Y7.....Sq..V......m...8g'..}9..6~.T
].%.e...*,.......B........8L..T..~7=.n.DVl.Z.[X...e.^...t/..E....V....
....j...6..A=...][..B.o6..|..].]&O.....i..^......=....E.quX........B..
...M3"[email protected]....~*]....T..1$`.....-v.$..pi.....T.<...Gd1....
Lx...t..v.N...3.sg,._PORL_.o..."wh...v.\.......~.>$.d.0..`U..lk.s..
j...H"[email protected]...#Ce.....n.i.G...nv.4~..20....ip<..n....15...9..L
...D..8..?.1.74....;3..m.6..T........p.s.~>.t........d9h.$B(.B.
<<< skipped >>>

HEAD /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

User-Agent: Mozilla/4.0 (Windows NT 6.1)

Connection: keep-alive

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 05 Jan 2015 19:11:17 GMT

Content-Type: application/zip

Content-Length: 114400751

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Accept-Ranges: bytes
....


GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=0-522376

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:17 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 0-522376/114400751
PK.........I}A#..H*[..s.......aebb.dll.\{x.....N..l....B H..X.]P.%... 
.7...!.m......`%.:.fr......m...V...jZ-.......*..T......$.%............
|...s.=.q.=..;[|.n..b.Hx..bi.........g......Kzvz.u...W.o........|....|
...nW2>}SF.z[...e._......7.NN.....e......_.=M....S".}m...>..k?.e
.x.m..~4|..GE...;Dx.......G...bYa..d.....uX.......&$..y..x9......LK.:.
Pe./..LP.?......X..f~.b.E.A....7.<b.\.h...s.<r.L:{...l..m....(A.
Dx._.z?.f...O.....g....\..6.,.'Q.b.. .....5..D....=.7.....v.>d.1...
..n......>........>........>...........W..._[|....n<...B..
...g... ..e.r)..i/c;$%..........(..\.!..f7.V[.eo.qL;.D....f25..!"..>
;...W.ER.^hw......D/..J....m.7....v.....TR..L; ...z...-.z..%...K...P..
..j{e.... ....m..7.J.[..l8....Ri..d.a...Y.*...Xq......(.v...w.._Ie.j[.
C.....JY/t.xVf7{..Z.L...a.S2..^e.7..uD@......[J...x.h..[.D..yXA..g...-
u.....!.(...-.0.h'..T.L.e..MLc...c.....C;(!...8..VU...s.:#.0..>....
 B..N....1..z}...m.].X..4c}...)..y..`......k.. Z[.k... ^.#....".|.....
. .o.Y..'YE ....;..t.6;.U.....`...oEk.7..\%.Rm.f...'.DV$. %.6.Q.|...{.
.v..E.H.[...:e.].....%...%[email protected]....|...Bke...^6...&.a...,...
.[...O=3T9.T...L`.Na.2............R. o...#.......yJ......G .o.o..~...~
....q.......t..(..\9....`7}{fJ.c.6.iAk.I./.@`......{.J.<....I ..\Y.
.}....K1[......t.h%".*..g...E.....4-..<.V ...S...G.....~..>..#xU
.....V.m`.........".BG..k-qQ.o.A.9.....%D..Dw].GD.......N...jg.NV ..v.
....".......;.[.....<.k....e>......=XY...U.]d.......t.io...r.G.}
...j...s...*......a..22.d....i"..6.\.^.x.xf.mJhLl*.6..6...o..8....
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=1044754-1567130

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:21 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 1044754-1567130/114400751
.>...|.3..B...Myu.G.8.g.gO..Q"....G.%.........K.-...V..D..p....X...
.r..E....2..r..E..3;.|...O..O...n.>.....H..q..'Z..*.'...b...f.P....
.........G..Q.aG............t.I.......a....W..]....q........B.......}.
..UN..Z>[....W...&...(...o8.\.=.dW'....JM...0(UaP..-.~44..7.P..(...
...k....L.[.t.,.F}G....Z..?.S..C..P..8.....1....#..|3..UW.o...H.T...U.
or....CL....@G>...}..W^#....W...5........x....:D.WS......o.@>...
{......yy..<....l Oe.y.i.. .a.....P.%..l....;L.....O..=...3{[email protected]
..Z.....U&.....4.....Z^.|?......!J(..}~`...K...%N..:....3..m.../......
1x...>..8...S.6......W..r...W...O...ml.o`~..M}.o)......#2RS..'M4...
(...F.....>..../[email protected]"[email protected]!...dc.s6.?0
.....q`....3..gKh...bA.3.h.rK.h.......(.G(n<H.....3\B.,..f.Y..W.Ir.
&.r.<.(.D..J...."F:..b..`..b./<kqN.2.^e.(..d.[.....f.rK.p/Bzr%..
Z..2;....thF$[.)<.y..Y.A=,}......b^..Hoi.N.EA.IN............L..w...
V..nI......K..th...K.|P>J........i.....`...#.Z...6.....Zi.^E...y.".
<..i?...h.#.|.....|.... .r@...`tO..S.3.<s.v).;..Oq..?.L...`N/T..
 ..X9.G....GN....r^.......AZy:/^.?I.i..t............m...c..e...{..BdCS
..5i2.... .Jg..B.;6....<..q{W.....P.z..X..d. S...3L:.Pp..v-..[Sg0'.
[email protected].%.!J..'z.8.A..,.E....5.0........_......KA.Q...Ty..
...<A..;...w,I....o....o<.:..0.....Oo..Ev..ad.q..q ..I>M.OR#E
.q>.q...Q..%%8zB....V_.8.`........$............Z.......&_.!^f...a~.
.WvC/...e7..4.....X-.[nI(......}[=.!.....M..g.T.....a.v...1..).ALWb...
...9.F..,..A.a.}.B..6....c.......@m......=.h...........)W.....M|..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=1567131-2089507

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:22 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 1567131-2089507/114400751
..<..$..t@7 [email protected],2....i.3.......8{...N....2......,...
...Z...H.z.d.t.Tb;)...gs.H.Nsp.D).......!..1..I.{K/ey."I....M....w.r`&
lt;..T.ir..3..Xy.2.:.V."....Z......R....!..mBM.a...]..N.5...,.'..&6R)[
u...].T6r.&.l...K.U$..u.6.qn...wc`.......j(iXa...a]Z..3..n....y.wD5..!
[email protected].<..xj..T....W..e.B........4.
D..c.........&.`B .Q..........V.$...(.f..&.BC..L'......mC..........U.=
...sK........s....m._#..k.........Wx....s.........$.hh.7.T......%.0...
...,..cx.^[email protected].(.....g......t..{...n..)wK.....c....ME.*.l}.)3.....
.....Z.N.......hj.....kSm?..k[....:.e4....\_.|>rh..,.J.../j.P.s....
..DDH.A>q..5w......?o..5..... .N.....!0.....D.c6W>[. ....7. K..,
.......F.........0....:/....../fk.......B....s.....i..zW!s>[email protected]
;z_p...j.x...~d."....b _]..e.#......7....:..|[email protected].&..$&...o
I.....Z...7..$.;H.j.....-%....;FXc...I...(........#:...<J.a;j..9g./
....H.Q..8.*J.S.%..oH..CP.$]w..`zD..-.#....3D...j...j#. _.:.kc!....].@
.,...iF.o<..~.Q....'.F=.0..............bI........c.bt....E...Esm..A
...Qp....@=.E.........,M.......PG...........,....<.A..7..ZI........
-.."....M...7..=......B....:....W...........B*..P,.c..Ò.H.........t{
..36@!....:..\vw.n...%..?....s..^.5U.i.{.5.Y .B...|..rg....."........(
F..G..0.{&...3....$.`.w...Rl...........9....3xq.tz...7.y.....wL.(..f..
I....$I..mL......h..`./g....'..H...z.....P.vB...(.z...E..1..z~.......h
".o...t.9I...4n}......!.k.C..f...n...)M.$.....E.1.j..; ^...^..t.t...r;
..`3.........r#.bn.]%r9!bW.M..]....pj.......m..u..h...=-..M.......
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=2089508-2611884

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:23 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 2089508-2611884/114400751
....Q................}..'.?.]#U....1.N6"_.Y....F<..'..u....k..'B...
.}.0.j.....p)@Q8JE>.7......m.(........K.....8W~H.P......J_].......s
...3Cn*H...qr.....V...nM......P.Cz.(8_.....@tc;./..!...C\......L....(.
..C..\.<.)gY..2....{.5s........bl....I(. %.........f_..N..(...7E.a.
..M,vf...Y.#..;.^...a.....U....$..U.O|K..S..(..u..i..%8M..:x\..(.B....
L....J..0A_..b.>....?.x....A..F....,...y\.0.....x....=..W#E-.......
.b........@...(._...T@.=.&W....q..6J.V............1t..p..m.......".[.M
..6.>;e.3.......P...^$.'...g....l..<..KR.... ........ .0 * ..yT.
...GM..@Y'._.1..s..A?.c:[email protected]:..2.....BW`..Y........H?.a..Yd}..L.v.
N..... IY.i5*..a.....X4.......X#.kG..*.('kG.....{.E...%g*.QA...._7P.Fx
4Gj{....,...4.}.i..m....`r.......?M\RU..d.y!.I|.'.$..G..9......oB.._.*
...s..T5...u1.~/..5...q.....3..=....6........h{..m..x...b....W.`..X..\
.}.:.......}..3..(.......m....\N....Y..aV.k/./...X.36........fXp.....m
..O...|....,.a..X..n2...~..7.........P...e..|..f..Z...eQ.*h........u^x
.o...Z.T.......U8Q......&...NG^1...=.=...l<......b2....1.....:@.jOU
...\'Ih.....&..Ue..4'..i..),.7.$7ZT....U[[email protected].^b.....
..U2.r.S`..0.8.e.M.....&..R.....os.CK.F2......!...#Jb.C...E..r..;.9...
...K.6.....sT9.8..#!...ph...).&.E.O6...0.....k.._.$... B.M..<G.8...
vy......[ .....:..*..G. ?.E.V.URc.l..t%.......E..(|>.v../..].v..T..
..0.Z....G...F...tNOT/.\........g.M.M....;nVQ1..|..k....x...p.$.|*....
.&>S>8....$.g./._A..s..BKSe........V-. ............2k..O[&.a5...
...6=....U...........X........g..h-&._.g.0..d..o.dk.....9.....jg..
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=3134262-3656638

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:24 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 3134262-3656638/114400751
.e.vH.N....V.n.y...]..^...u....Q/.9.....1.U.M.....^;.M.......@X"v.....
N..:o}.{z.wc......../xn.4...L...\.j=t.(..p...............e#..my....3..
..kj.L".S1;....4.X.....D.jN".2*&..Q1.. .{.....Q.oQF.o.4..`.l....`<.
.`.^.l=.S.m^<5......}.f..Q.nD.....NI..%...K!.?Q.. IB.._g.V}(.k.lM.w
.......LWa..(f.....-b.j....}.3..*..f*.#..h.*dP...Hk.../.RS.0H....R.*S!
...\.....b....'...a.....ct...O....!....'.(.! .... ...d..;..Q......T.;.
.q0;x..t%.S..H...C..tF.....x,..,....).u..p..#......L....3S.L..1.......
n..1.4f....C.....=F..]..8Q{...(..Y.Z.-..Z.B...Z.h.8..<..w.......Z..
oc.....YdL6G$.............EyR..wY.a....<.2.It..*..{.s...y..|?lk...i
2. |p..........\.......m.L.Sf...3..(.#..}3..Hc....|..v..i..$:..vi.....
o.~s.V2P..t*....\...&.S.....&..]2.qE.-dv.a*...MGQ./X.....:.."wy.0.C=..
.E1V..........'H..{..I*.C.......UU.k..S....._..$ .1.>D...3.;...q['2
.....Ho.... G..k..i4#P.. ..>.../....XO.....!O.S..Ya.....'6B.:.p.d7.
._...*....*.............E...=h.......D}.zqU...`..b...9u..Vt..F........
....w...U...~=HP..G...J.$.~_.}.... ..z0........!..../...Lo...d.wVZ..|.
..=..._. E...R..C.Z..Y.J[..5yi?K3....;.U..MF.J&........I.U.Z.%,U..W.KT
.#..s..2..B..|.,.M.h.0Y.]..8....$..).%......orJi....w4...t .\...u...f.
...EF.{......s4.U..Z.....^...|...y.Y.a."Bu/[email protected]
\..7.]....;'d.s.w.f..(.G...k...5.6i....%...X..4.g..L.....A...F...}P..5
.`...f.....h.....`;..8.Q..4c.w...s.t...H.........Hn5}z..x.....)..].a.-
.wS.g.......,M..J..!...Gp../-8.A.....x$,o. ~{..L.Y....C.WK.K.F.x.....~
..D.%.%....u.6..Ia...;:(.........}Q?}P....Uk..'...wd....[j.._..G_U
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=3656639-4179015

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:25 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 3656639-4179015/114400751
....M..\.z$.z&.....kUD.....2..g......W..Y...U.....9X>.".!I,..7...k.
2~.'..9.M...Kc^.9.`.ggr3...m...&......r.I'c.N.....2...I.a./.}.......E.
!.|...w.a....}......V..'.j.......*J<.x.^.;.g....DZ.Q.x.6.....'87>
;....2o...]....m;.S....6T.I..*.....`T.e.y...W.....)...SB..[3*b..Wl..(.
K....5Di.s.......I....o.mN.....|...o%..8;[L.1....... .gg.t^v.Lf......5
f...L..M58.%.5..~5..43..\....j.....2....%..#[email protected]'.2&....NO.:......
.m....a.31...x.......We...x......."c?......c..gz..y5J.Y .Q#.6....]f.L.
9..n2... ....;A..5.2.9.. .A.....f...$...[>%2.K ?Rm.Nb.h1....*o~.205
.U.....y.]nJ.h....iv.l.........,f]Z.cz.b..FL9d>.l=..m....x....T..U.
....r...B..Y....#...Uv{..[..U......H4oW:.;.t.O5.....u..UV.4.g....4.. .
......U..j..e.... .&....eH.n.n&..C..z.|._.>....a>:o..=A...R.F...
..J.`..}4......T..-.l.Z~G.p...Nm.."__......F......M....T..J^m:..u.vV..
..y....5.........u.W....^..3.\M..y.6my....\....!G:.N.....].....6.....;
.\vb.....}...5ot....e..&.-L.&...]t.|.{.i...J.9...~S.v../....-.M.C|..1.
.........i...J.cL.U.........01a.N.....y.........lc...e!.l2..=r.o1....~
gT0.."=...`...5.......=K...ss.0.<...Lr......g..:V...........gQ..tM&
lt;.-LM...P....1..`*)...K,e.X...K#o..l...9w.....hP...?......T......S..
q6{..D-...S[...t[....^..3....v0.....?.Um.....2{.jp..;L.6..%}o....o....
-bqv.E..W:]..!.t.H....$o......K..`[email protected]<.\....)}!.Z..)6.....eR.
.....]$0=..s...".[2(..[...7x.o.g.W.....`.x.^..q7..'2.T..%..GU.........
n.NH6.,z...s....P...M......rH.p...D..p..q.....G.k.w......y......q0..g.
8...Kx{....V.....w)'.Ul.o..J5Ly....V}.m.=.zhs....O.<..k..n...&.
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=4179016-4701392

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:26 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 4179016-4701392/114400751
).3.jqn... .J.)Vsm........^^......i.=.7J*.0.xh.....-..#.*.j..X.i d.<
;.H.....U.....r.n.....K.M..XM....yT;B".F.h..|.r@.>.Mvr!.....EHSJ3..
8.E..?..7...A........!r.|.. ....W$..c.855P.7.....S..........J.WFS..Z..
Y.m.....Z..O.1.6.....Q... ...D..]../...m.. K&5zW..Q.Z.G...{p....ST..\.
....0am.e..S...X?.f.Fv.Te...>.....60_ .....*....<...[2%5.....#?%
..IWnV.?.....s..CZ..H.I}<-......!d.q...v....!..."..#.........J...$.
...E.e...b3..9..A....J.\.8.4.A.yd.J3.*X.x}......]Z.....Vv...*."....$3Q
...o.....<jc.dg..6t..A..I..).....g...t:....|.?>.....PP..h.p.....
..(...X...|.....C..M..{._.V3*uG].5%..I..]....$...~-...8...\....L...?t.
../......^$........n..0..CR.>...E0...s9....r........V........{%_d..
.GCt..[ `..Y....`/..V........|..q...[......S{B.d.L:|.Ql.,...O.........
?...o)..kP..I.8....T...P...WF.x...ix...Vc<.b.....3!..b..h.D^.o.&..U
......j.....{).G.n...%..Iov.W....l..q.j:....1.v..W.j0;;Wm..P .v.WU.@bn
...>>.hZ....J.1....0n...^wg.....p.$.OtU..{......?Mwt..q.t.xm...d
'.....L$6.&...,<..,..869......U.5....X..L`W....H..T..Aw.]v.b....;..
..W.._J..5..t...pl.7.m% ....P.~..n/r?....M.~.A.hJ.K.^..,.......]_..X..
v..8/..[.!.m. Y.Ezc....q.|...;[email protected]...?.A.U..2ia.f.......|..4..~.VI&
gt;0x.k..y...ts...T.al~z...j.....4K._..}...2..8y..h..xfj...`...B...;'.
Q"Z..!].z.B.=>.yiy..*R..r=A....:...[[email protected]}G.
T.:.?.<\..06...I<.N..b..Pj..[...N..fl..-..s....@!......X...K.}-.
.ySv.x... .}X. 8.<f...i...{......j.>"....2,...^.L...=Y..%{rdO...
.=..g..).=...T....r...=3e.W....9............9V.V ....G.`.2..H.Sf.Y
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=4701393-5223769

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:26 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 4701393-5223769/114400751
..........R..3.....Z.Pe.Uk.@|7..<X.[....J._.H.o......j ..`..-0fy...
v..........KC ..?d.a,......l<...F......a?.....g.Kj.(.Q8'.8...gL4...
}'.....E.|..R..I.y.UN-_..=`....f....Y.H..$..]=.....:.w.x.....v....=4."
\..i....;>cL* .L..E.Dv.....F..]..>(6.$V.q......8.6vW.A.....-....
].[.]..>..A.*G^2........0..jT[a..1.JU.du!I.K.<h.#.t..QcI!M4O..".
..].:7.....)......B.{#.k.U)..*......Z.Q..9X...<e.........o..0~...f.
.j.'.f......<.F..P....I...(...P. ..o.,.J..Kr......*....:bo.....h..$
f...........E...ON...mtBc..%|......Zy~.....N.i..9L~g...z...M.\Kbc,.@..
...*.A....CL.W...Cp...z.....*.....6S.%S.d.H.4...t..R..$t.'O..;S...d...
.TH..w.M............D!"...F..I.J.mJ.e...8.Y @..yQY.(... ..3.nZ.q.D0qY.
.4.....!..p..*.......2s.0......?.S.y.R.8gn...F..6..&C.6..!..9s.D..(..m
.a.e\..$.....1[t._M.$.4..hE.^...^ ?......9.gs......$...!.1......{...k{
.....!..Yr...fP[...y`.~$Q!.<..>.................nRf..[l.Rl^.*...
..{?#c.#..i..&U.....z<...H{p.S.A.bB....S...aB....*.x*..i..GN....k.3
 ..4.w.Z.....Gz..e2H(.ob.eMO..mv.q(ZZ..F-l&.S..Y.. .(=..4.2....^..O..(
P.. .`..U.9.o]..k.5.-.1a.a....WB.}..p...S{..,..FMD.2.,a[x^.....q......
C"...R."{m.s*........s.......LF.EE].......M...B....V..R.U....z\...s..1
..9.....Wi...._=.P._X....5..F..f.w....KG>7.g...\ABw.b.y.........}..
....9Q.. ..[..&...o......q.y.4K..YrQ.......>....8.bu.....:...0....^
a9..............7(.o.......B.qk..".....:}y....0......G{r"..].y.]....S.
.....P..i.z ..T........./N.W@_. ..(..B...a5.6.......@3!Q....o...A.J5..
6.?B0.i.........0....D...g[...j...w.R.)?.....p!.l._.......:7......
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1

Host: cdn.vn.garenanow.com

Range: bytes=5223770-5746146

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 05 Jan 2015 19:11:27 GMT

Content-Type: application/zip

Content-Length: 522377

Last-Modified: Wed, 20 Aug 2014 04:04:08 GMT

Connection: keep-alive

ETag: "53f41e38-6d19def"

Content-Range: bytes 5223770-5746146/114400751
P.3.A.V".*.t/.Dj.`?....m.Tg.Gh...8L....e..>[email protected].}*..L.
[...h...*...t..... u.o...}M.n..!;......"...i.>.....}.H..w...}....7E
j`..R5..J...TZ.4.3...)..r...7OZ...R.......D........B...k.H...F.D.zi.}.
....".......n.N..f.U|)..E.....w..'..E..2.cd.:.>N..2.g..e.'...Y.B.6f
}......Y ..i.......("/.#q..%E.=....=..........'..)......S#K.WT...Y.&..
T...H.%.).rX..Y".V!.P .-.....)..%b..."...[.>.f...Q..9...#3.........
....2.8....N..YE...?.cR.x......q./....<w....`......'..Y.x..{Qg..>
;....P.4...../...3......{.9b.....G.x...&..D.y..R.$..q..c...[cJ..M.T.FX
.i..e<.d9..G=...i..;.w.2.P..(..J.i(.#d[.p...u..."..t...h....W..H:.3
..|3H...S..eV.h...|..Rr.q..o..?...]O_.......O.......'.7....{lr7.L|.}f&
lt;.>...........W>.......z.}..v..............a..t..N....\.|..Qz.
.?.)...5.GO"....z.V.6.][email protected]&.fpO:[email protected]...\.(r.....t.
.L.J.N...0/T..yR.SPv.?.../w....;.....,-...iQG,.....|.....b...c&...E.y.
...-....,A...i'....tlM..H......,.....;.X...zu.......qI.\[email protected].|,_.-wf
0K....a.....W.1(Zc.?.O.1n.F~..U.d .....2.3l.n..0.a......(...Pd,..c...!
......=o0.;.9...Z.=~......3.[.L.xC.....s.b.m....p.[.......;.....qyK\..
H4......V..B.... c...6B.~.i.>....=.......Q.:Fh[eC..8/M.i....7...8..
l..:..~.....6..-..0.A...\.T..... G.T.T:.q.N.u5...k*..D..X.....q.O.}8:.
..k.QTj...V1.:.ZL..ci~.R)Sf..? ..#......L|6....c...w....F.............
.O..,..$..P.......$o..~C.qhW...T5...Ay..BR....,j.k....7i....w..t'.`^a.
.7.Mdx....HL^H.qP...\NW.9..={1.....Z.......p......J:[email protected].
...f..y.9......TH.u.O..U.2..|.&.#.......X.......|...B...]...*T.H.L
<<< skipped >>>

GET /products/beedoctor/000/000/001_AviraEngine.zip HTTP/1.1