Sample_7a02c9f0fd

by malwarelabrobot on December 18th, 2014 in Malware Descriptions.

GenericEmailWorm.YR (Lavasoft MAS)
Behaviour: Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 7a02c9f0fda15d12a976c745e50ad6cc
SHA1: d84f0f32660f9008b3f6e92740b9ef7e2dc3ce72
SHA256: f0a422e120a4b196f7d0d859b23b21ca27a9b7058a55de8dbb9ff6d3328759fb
SSDeep: 98304:tXqpTHZjDza 51RVAzTIBUJ2hgkkVP /xSbqMQHc3ChQt:4H5P51RizTIUkDkF 0qRcShK
Size: 4605992 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: Itibiti Inc.
Created at: 2010-10-30 23:54:54
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Worm creates the following process(es):

%original file name%.exe:3224
7a02c9f0fda15d12a976c745e50ad6cc.tmp:3304
TrustedInstaller.exe:3980
makecab.exe:3968

The Worm injects its code into the following process(es):

Itibiti.exe:3820

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3224 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-BFS7E.tmp\7a02c9f0fda15d12a976c745e50ad6cc.tmp (50 bytes)

The process 7a02c9f0fda15d12a976c745e50ad6cc.tmp:3304 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Program Files% (x86)\Itibiti Soft Phone\unins000.dat (4424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\KNCTR.lnk (1 bytes)
C:\Users\Public\Desktop\KNCTR.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-5B1S6.tmp\_isetup\_shfoldr.dll (47 bytes)
%Program Files% (x86)\Itibiti Soft Phone\is-VDL36.tmp (12287 bytes)
%Program Files% (x86)\Itibiti Soft Phone\is-7REBL.tmp (54184 bytes)
%Program Files% (x86)\Itibiti Soft Phone\Itibiti.exe (1358 bytes)
%Program Files% (x86)\Itibiti Soft Phone\is-9IQGD.tmp (8356 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-5B1S6.tmp\_isetup\_setup64.tmp (6 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KNCTR\KNCTR.lnk (1 bytes)

The process TrustedInstaller.exe:3980 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.0.regtrans-ms (5720 bytes)
C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f\c30b3226271ad001050000008c0ffc0f_catalog (15 bytes)
C:\Windows\System32\config\SOFTWARE (30137 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db1a-917a-11e2-9ef7-000c29a8bd90}.TMContainer00000000000000000002.regtrans-ms (9064 bytes)
C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f\9526cf26271ad0010c0000008c0ffc0f_catalog (15 bytes)
C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f\39dbf226271ad001110000008c0ffc0f_manifest (509 bytes)
C:\Windows\System32 (824 bytes)
C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f\0f8b9f26271ad0010b0000008c0ffc0f_dxmrtp.dll (6708 bytes)
C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f (4 bytes)
C:\Windows\System32\config\COMPONENTS (64689 bytes)
C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f\af299d26271ad0010a0000008c0ffc0f_manifest (5 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.2.regtrans-ms (856 bytes)
C:\Windows\Logs\CBS\CBS.log (33524 bytes)
C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f\62aa2f26271ad001040000008c0ffc0f_rtcdll.dll (7482 bytes)
C:\Windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin (566 bytes)
C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f (4 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.0.regtrans-ms (20617 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.1.regtrans-ms (856 bytes)
C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f\f99df726271ad001130000008c0ffc0f_catalog (15 bytes)
C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf (656 bytes)
C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f (4 bytes)
C:\Windows\System32\config\SYSTEM.LOG1 (1099 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (29180 bytes)
C:\Windows\System32\config\TxR\{016888cd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms (3944 bytes)
C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f\39dbf226271ad001120000008c0ffc0f_rtcres.dll (808 bytes)
C:\Windows\System32\config\SYSTEM (1120 bytes)
C:\Windows\System32\config\COMPONENTS.LOG1 (62494 bytes)
C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f\62aa2f26271ad001030000008c0ffc0f_manifest (31 bytes)
C:\Windows (288 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.blf (4670 bytes)
C:\Windows\System32\config (772 bytes)

The process Itibiti.exe:3820 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\settings[1].png (922 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910384[1].jpg (800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL909460[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912686[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\shadow3[1].png (508 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\RSSIcon[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\icons_dwn[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\f[1].txt (7546 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL911075[1].jpg (5338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912827[1].jpg (4118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL913710[1].jpg (1004 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL912882[1].jpg (3857 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\776638438837976361[1].jpg (8948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\S8IYTPF2.txt (517 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery.ui.theme[1].css (3673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\kn_video_v400[1].htm (1149 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\6[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery-1.7.2.min[1].js (46725 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912880[1].jpg (1600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910181[1].jpg (1264 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\0[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\astrix[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4NL9WKW3.txt (237 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL914257[1].jpg (3564 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\facebookIcon[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\collect[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\f[2].txt (7074 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\itibiti_phone_api[1].js (8425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\ui.core[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\ui-bg_glass_75_440a4d_1x400[1].png (191 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\INfoBTN[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\header[1].jpg (5313 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\menutab[1].png (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910298[1].jpg (2257 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL913725[1].jpg (2094 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\2[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910171[1].jpg (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL912964[1].jpg (1164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\skin[1].css (241 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (966 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FVYCXAZC.txt (95 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery-ui-1.8.20.custom.min[1].js (14853 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ECR3NVAR.txt (277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\logme[2].htm (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SettingsBTN[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL913439[1].jpg (2163 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909504[1].jpg (4278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\17877534288319335953[1].jpg (10330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\9[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\f[1].txt (33826 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL912835[1].jpg (3394 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\min_normal[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\pubads_impl_55[1].js (56054 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913503[1].jpg (7094 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EG9E1SRI.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\4[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knctr_with_phone_loader[1].htm (1231 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911157[1].jpg (3658 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL914094[1].jpg (1561 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\kn_video_v400[1].htm (1149 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_49A9889B8F89F388F5CDBBE2AA579A5B (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\video_menu[1].htm (7447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\itibiti_phone_api[1].js (10633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\T6YF3VKP.txt (519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\8[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\icons_up[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6L0MAOIU.txt (275 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\faq_icon2[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913655[1].jpg (2714 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\1[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\right_banner[1].htm (2358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\video_menu[1].css (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL910478[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL914293[1].jpg (1404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\social_icon2[1].png (3093 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\ads[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910944[1].jpg (2064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\5[1].png (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\container[1].htm (393 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\get_flash_player[1].htm (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\jquery.ui.base[1].css (58 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\stylesheet3[1].css (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL914123[1].jpg (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL913685[1].jpg (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\jquery-ui-1.8.20.custom[1].css (361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912904[1].jpg (1037 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery.jcarousel.min[1].js (4845 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\refresh_parent[1].htm (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\f[1].txt (28786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\f[3].txt (8031 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\exit_normal[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\twitterIcon[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P5D2O52B.txt (277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911156[1].jpg (3821 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6SRWNV6A.txt (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910494[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\index_tabs2[1].htm (1236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\kn_banner[1].htm (1411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\style2[1].css (241 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\f[1].txt (8043 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (1056 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\ui.tabs[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\welcome_icon2[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912893[1].jpg (2334 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL911101[1].jpg (4040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910136[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\container[1].htm (393 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\analytics[1].js (15208 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL911120[1].jpg (3693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery.cookie[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\end2[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\sliderbg[1].png (959 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\demos[1].css (2521 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\talk2[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL910890[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\collect[1].gif (105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knctr_with_phone_loader[2].htm (1033 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\skin_channel[1].css (241 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910262[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\knctr_icon[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL909652[1].jpg (880 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910406[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL913611[1].jpg (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910341[1].jpg (2337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\logme[1].htm (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\get_flash_player[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910110[1].jpg (2621 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knvideo[1].png (4668 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\logme[1].htm (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Itibiti\registry.dat (369 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\HelpBTN[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909646[1].jpg (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL913506[1].jpg (2937 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\welcomebg_pur3[1].png (2221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1XFNDMHT.txt (277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\phone_icon2[1].png (1634 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL912663[1].jpg (2938 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910521[1].jpg (1264 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\kn_banner[1].htm (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\heros_code_here[1].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E0702DFC20F36D954C803A3BAB6675C4 (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\activate2[1].png (7329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL908833[1].jpg (1637 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\sidebar[1].htm (856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\kn_video_v400[1].htm (1149 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery-1.4.2.min[1].js (41841 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery-1.7.1[1].js (128562 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_49A9889B8F89F388F5CDBBE2AA579A5B (1432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910865[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909585[1].jpg (1613 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\background2[1].png (1421 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL914321[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913657[1].jpg (1937 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\17877534288319335953[2].jpg (21272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\footter[1].png (2300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\14465066621354102719[1].jpg (3280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911203[1].jpg (2081 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\icons_bg[1].png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\right_banner[2].htm (1179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL909531[1].jpg (1938 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL914146[1].jpg (3420 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_E0702DFC20F36D954C803A3BAB6675C4 (1432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL913470[1].jpg (2853 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911121[1].jpg (1024 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\jquery.ui.all[1].css (302 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\f[2].txt (7340 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\swfobject[1].js (13261 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL911115[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912727[1].jpg (1023 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\jquery.ui.tabs[1].js (7385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\7[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\number[1].png (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL912932[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\nextapp[1].png (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL914301[1].jpg (2900 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL910280[1].jpg (2537 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\3[1].png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\phone_dialpad[1].css (361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909503[1].jpg (1100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\itibiti_phone_api[2].js (8973 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knctr_with_phone[1].htm (3164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\83S2NG2R.txt (519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\collect[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery.ui.core[1].js (865 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery.ui.widget[1].js (3145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912901[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\9975433107761106746[1].jpg (8717 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913635[1].jpg (3461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\collect[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\f[2].txt (7437 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\style[1].css (241 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910404[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\itibiti_phone_api[2].js (14969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\bg3_DRAGVERSION_ALPHA[1].png (29582 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\sidebar_bg[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\kn_banner[1].htm (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\feedback_icon2[1].png (1794 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL909578[1].jpg (2063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\13540127826435132492[1].jpg (4644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL913647[1].jpg (2553 bytes)

The process makecab.exe:3968 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Windows\Temp\cab_3968_2 (564989 bytes)
C:\Windows\Temp\cab_3968_3 (76 bytes)
C:\Windows\Temp\cab_3968_6 (8 bytes)
C:\Windows\Temp\cab_3968_4 (564989 bytes)
C:\Windows\Temp\cab_3968_5 (76 bytes)
C:\Windows\Logs\CBS\CbsPersist_20141217182742.cab (11744 bytes)

Registry activity

The process 7a02c9f0fda15d12a976c745e50ad6cc.tmp:3304 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Itibiti_is1]
"DisplayName" = "KNCTR"
"Publisher" = "Itibiti Inc."
"UninstallString" = "%Program Files% (x86)\Itibiti Soft Phone\unins000.exe"
"InstallDate" = "20141217"
"URLUpdateInfo" = "http://www.itibitisystems.com/"
"EstimatedSize" = "10050"
"Inno Setup: Setup Version" = "5.4.0 (u)"
"Inno Setup: Language" = "english"
"Inno Setup: Deselected Tasks" = ""
"Inno Setup: User" = "%CurrentUserName%"
"QuietUninstallString" = "%Program Files% (x86)\Itibiti Soft Phone\unins000.exe /SILENT"
"Inno Setup: Selected Tasks" = "desktopicon,quicklaunchicon"
"NoModify" = "1"
"Inno Setup: Icon Group" = "KNCTR"
"NoRepair" = "1"
"Inno Setup: App Path" = "%Program Files% (x86)\Itibiti Soft Phone"
"HelpLink" = "http://www.itibitisystems.com/"
"URLInfoAbout" = "http://www.itibitisystems.com/"
"InstallLocation" = "%Program Files% (x86)\Itibiti Soft Phone\"

The process TrustedInstaller.exe:3980 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3]
"sf" = "2"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_5.2.1002.3_none_af1aecad9109b29e]
"c!microsoft.w..king.rtcdll_6595b64144ccf1df_5.2.1002.3_af1aecad9109b29e" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_5.2.1002.3_none_3b4992a44ea4e480]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.dxmrtp_6595b64144ccf1df_5.2.1002.3_3b4992a44ea4e480]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_5.2.1002.3_none_af1aecad9109b29e]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3]
"CT" = "62 00 61 00 39 00 61 00 38 00 61 00 30 00 66 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3]
"CT" = "32 00 32 00 31 00 36 00 32 00 30 00 64 00 35 00"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_5.2.1002.3_none_3b4992a44ea4e480]
"f!dxmrtp.dll" = "64 00 78 00 6D 00 72 00 74 00 70 00 2E 00 64 00"

[HKLM\COMPONENTS\CanonicalData\Catalogs\221620d51c65eb44ee793e7bd1c8631d1666fb96f433a6b14484d0bf06cdbbe3]
"c!microsoft.w..king.rtcres_6595b64144ccf1df_5.2.1002.3_b5a302ab8cccdfca" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3]
"S1H" = "71 58 8A 27 D2 57 BA 18 C0 09 F3 60 31 B8 52 A8"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)]
"UtilizedSpace_MCP_c22d037d" = "F2 40 52 01 00 00 00 00"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_5.2.1002.3_none_b5a302ab8cccdfca]
"f!rtcres.dll" = "72 00 74 00 63 00 72 00 65 00 73 00 2E 00 64 00"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_5.2.1002.3_none_3b4992a44ea4e480]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_5.2.1002.3_none_b5a302ab8cccdfca]
"c!microsoft.w..king.rtcres_6595b64144ccf1df_5.2.1002.3_b5a302ab8cccdfca" = "Type: REG_BINARY, Length: 0"
"S256H" = "F9 DE E3 AC 06 75 0F 19 F0 A7 12 0B 9D 11 73 74"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\5.2]
"5.2.1002.3" = "01"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_5.2.1002.3_none_3b4992a44ea4e480]
"c!microsoft.w..king.dxmrtp_6595b64144ccf1df_5.2.1002.3_3b4992a44ea4e480" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3]
"MCP_c22d037d" = "00 00 00 00 D9 A6 52 01 5F 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3\UnstagedFiles]
"rtcres.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.rtcdll_6595b64144ccf1df_5.2.1002.3_af1aecad9109b29e]
"CatalogThumbprint" = "ba9a8a0f0dba26c2761c14c2c4e9c22fd406d6c6006cb7f7a1713d8f1cb20f8bÃ…Å¡"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3]
"MCP_c22d037d" = "00 00 00 00 9F 79 52 01 66 23 00 00"

[HKLM\COMPONENTS]
"ExecutionState" = "2"

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\5.2]
"5.2.1002.3" = "01"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.rtcres_6595b64144ccf1df_5.2.1002.3_b5a302ab8cccdfca]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\CanonicalData\Catalogs\ba9a8a0f0dba26c2761c14c2c4e9c22fd406d6c6006cb7f7a1713d8f1cb20f8b]
"c!microsoft.w..king.rtcdll_6595b64144ccf1df_5.2.1002.3_af1aecad9109b29e" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3\UnstagedFiles]
"dxmrtp.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.rtcdll_6595b64144ccf1df_5.2.1002.3_af1aecad9109b29e]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_5.2.1002.3_none_af1aecad9109b29e]
"f!rtcdll.dll" = "72 00 74 00 63 00 64 00 6C 00 6C 00 2E 00 64 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.rtcres_6595b64144ccf1df_5.2.1002.3_b5a302ab8cccdfca]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3]
"(Default)" = "10"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.dxmrtp_6595b64144ccf1df_5.2.1002.3_3b4992a44ea4e480]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_5.2.1002.3_none_af1aecad9109b29e]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3\UnstagedFiles]
"rtcdll.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3]
"CT" = "65 00 61 00 36 00 30 00 65 00 38 00 34 00 32 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.rtcdll_6595b64144ccf1df_5.2.1002.3_af1aecad9109b29e]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_5.2.1002.3_none_3b4992a44ea4e480]
"S256H" = "23 AC B7 AA A6 95 31 18 35 7B AD 7D A3 1C 7A 1A"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3]
"S1H" = "E0 13 1C 1D 7A 09 FF 0A 23 4E B9 85 14 54 30 26"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_5.2.1002.3_none_b5a302ab8cccdfca]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.rtcres_6595b64144ccf1df_5.2.1002.3_b5a302ab8cccdfca]
"CatalogThumbprint" = "221620d51c65eb44ee793e7bd1c8631d1666fb96f433a6b14484d0bf06cdbbe3Å›"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3]
"S1H" = "3D 60 AE C5 61 8F 26 DA C7 03 D3 FC 0D 0F 22 97"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide]
"PublisherPolicyChangeTime" = "Type: REG_QWORD, Length: 8"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_5.2.1002.3_none_b5a302ab8cccdfca]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.w..king.dxmrtp_6595b64144ccf1df_5.2.1002.3_3b4992a44ea4e480]
"CatalogThumbprint" = "ea60e8422645c2f8da51751b2bc4979fb03a440bb5df8b2001e105bd8716e072Ã…Å¡"

[HKLM\COMPONENTS\CanonicalData\Catalogs\ea60e8422645c2f8da51751b2bc4979fb03a440bb5df8b2001e105bd8716e072]
"c!microsoft.w..king.dxmrtp_6595b64144ccf1df_5.2.1002.3_3b4992a44ea4e480" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3]
"MCP_c22d037d" = "00 00 00 00 05 9D 52 01 D4 09 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3]
"sf" = "2"

[HKLM\COMPONENTS\ServicingStackVersions]
"6.1.7601.17592 (win7sp1_gdr.110408-1631)" = "2014/12/17:18:27:43.904 6.1.7601.17592 (win7sp1_gdr.110408-1631)"

[HKLM\COMPONENTS]
"StoreDirty" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3]
"sf" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\5.2]
"5.2.1002.3" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3]
"(Default)" = "2"

[HKLM\COMPONENTS\DerivedData\Components\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_5.2.1002.3_none_af1aecad9109b29e]
"S256H" = "2D F8 2A 14 73 61 92 75 D4 0B EB F8 7B DF E6 3C"

The Worm deletes the following registry key(s):

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3\UnstagedFiles]
[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3\UnstagedFiles]
[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3\UnstagedFiles]

The Worm deletes the following value(s) in system registry:

[HKLM\COMPONENTS]
"PoqexecFailure"
"RepairTransactionPended"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_none_76907d8bf50e7115\v!5.2.1002.3\UnstagedFiles]
"dxmrtp.dll"

[HKLM\COMPONENTS]
"LastScavengeCookie"
"StoreDirty"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_none_d9368da8ee26719b\v!5.2.1002.3\UnstagedFiles]
"rtcres.dll"

[HKLM\COMPONENTS]
"PendingXmlIdentifier"
"LastScavengeFlags"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_none_d9d58e0eedade867\v!5.2.1002.3\UnstagedFiles]
"rtcdll.dll"

[HKLM\COMPONENTS]
"ExecutionState"

The process Itibiti.exe:3820 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"fdwSupport" = "1"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\termmgr]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"AdvancedOptions" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"NetSim" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"MaxFileSize" = "8388608"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"User" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"FileDirectory" = "%USERPROFILE%\Tracing"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing]
"DisableClass" = "0"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"MaxFiles" = "2"
"EnableDebuggerTracing" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Itibiti.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\termmgr]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"cFormatTags" = "3"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"FileDirectory" = "%USERPROFILE%\Tracing"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"cFormatTags" = "2"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing]
"INFO2" = "0"
"INFO1" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"MaxFileSize" = "8388608"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\termmgr]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F1 F8 48 2E 27 1A D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"fdwSupport" = "1"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"UseAdvancedTracing" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"Crypto" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 06 00 00 00 12 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 02 00 00 00 32 00 00 00"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"Queue" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing]
"DisableGroup" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"Demux" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "DB 35 4E 89 16 19 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"fdwSupport" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 31 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"RTCP" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"FileTracingMask" = "4294901760"
"DebuggerTracingMask" = "4294901760"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\termmgr]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing]
"Warning" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"setup" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"cFormatTags" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"AddrDesc" = "0"
"RTP" = "0"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"DebuggerTracingMask" = "4294901760"

[HKCU\Software\Microsoft\RTC]
"PreferredMediaTypes" = "15"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"CritSect" = "0"
"Heap" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F1 F8 48 2E 27 1A D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1372240261"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing]
"PERPACKET" = "0"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"channel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"DShow" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\termmgr]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"RtpPerPacket" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"AdvancedOptions" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 11 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Tracing\RTCDLL]
"FileTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2B\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"EnableDebuggerTracing" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing]
"ERROR" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"fdwSupport" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\termmgr]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"Network" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp\AdvancedTracing\Group]
"QOS" = "0"

[HKCU\Software\Microsoft\Tracing\dxmrtp_rtp]
"MaxFiles" = "2"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Itibiti.exe" = "%Program Files% (x86)\Itibiti Soft Phone\Itibiti.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
03aec68faa27aed6d3f7198571e9dee4 c:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
19e5052c8496ad95a8cdb8a4ef076780 c:\Program Files (x86)\Itibiti Soft Phone\unins000.exe
942ce9725b4bb76f3a9aa9796c2b0f2b c:\Windows\winsxs\x86_microsoft.windows.networking.dxmrtp_6595b64144ccf1df_5.2.1002.3_none_3b4992a44ea4e480\dxmrtp.dll
20b3e8f6ba957765c560d5cb418a1b56 c:\Windows\winsxs\x86_microsoft.windows.networking.rtcdll_6595b64144ccf1df_5.2.1002.3_none_af1aecad9109b29e\rtcdll.dll
545c104b728cf4dfa359626c1b90e75b c:\Windows\winsxs\x86_microsoft.windows.networking.rtcres_6595b64144ccf1df_5.2.1002.3_none_b5a302ab8cccdfca\rtcres.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Itibiti Inc.
Product Name: KNCTR
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: KNCTR Setup
Comments: This installation was built with Inno Setup.
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 82928 82944 4.49312 824e3957006b0613ed9c53ada45c1db3
.itext 90112 3048 3072 4.16532 a1e7b318e1115c7a9aaa4dee97b67e4b
.data 94208 3484 3584 1.85481 00abeb3340a427c843c21fd934d5ae67
.bss 98304 22288 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 122880 3998 4096 3.4434 b47eaca4c149ee829de76a342b5560d5
.tls 126976 8 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 131072 24 512 0.132037 3746f5876803f8f30db5bb2deb8772ae
.reloc 135168 6464 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 143360 45568 45568 2.8796 9fbc7799ba769437837a91d6bd967108

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 16
41017d283d71d2596a5cb7ab5f81afc6
674b20fd6d5820a777a93f1e6d9c2ae6
4c3ac0c8e28c1f4d3bb23c95d2608478
05db4deb7552b1a3137bd74768dfd7d6
607afcc15c5cd15bd9a40212ec2399b6
b28f7bafc877f865d14c6a21dfbff91d
600e19175e0f11151943c03ca0aa6e18
a43f23eb432e22688dc5c0a1032f13e7
c2ba6dfd4f9f9dedb494ecfea422defa
8ef55c72eee51b0242991a51c421dd19
49b13ffc4bed5a727004e0248e900c06
c71910354aff72163ee7acca7b86ed15
4be5e44c672dc8a40d8436f675c35ed1
00de346b668c9bf2725448cc62990b93
1f8d01d042de3a194dc505913e8a177c
c6e1d764a7a0a22d822e8b92967931ff

URLs

URL IP
hxxp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/phone_js/itibiti_phone_api.js?1418840875 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/heros_code_here.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/phone_js/jquery-1.7.2.min.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/jquery.cookie.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/logme.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&timestamp=1418840876616 174.127.83.136
hxxp://web.itibitiphone.com/knctr/refresh_parent.html 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/bg3_DRAGVERSION_ALPHA.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/phone_js/itibiti_phone_api.js?1418840886 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/phone_js/itibiti_phone_api.js?1418840887 174.127.83.136
hxxp://web.itibitiphone.com/knctr/logme.php?product_key=undefined&product_name=undefined&product_version=undefined&timestamp=1418840888310 174.127.83.136
hxxp://web.itibitiphone.com/knctr/logme.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&timestamp=1418840888466 174.127.83.136
hxxp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number= 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/jquery.ui.all.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/phone_css/jquery-ui-1.8.20.custom.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/phone_css/style.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/phone_css/phone_dialpad.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/demos.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/style2.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/phone_js/jquery-ui-1.8.20.custom.min.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/jquery.ui.widget.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/jquery.ui.tabs.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/phone_js/itibiti_phone_api.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/facebookIcon.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/twitterIcon.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/RSSIcon.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/nextapp.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/knctr_icon.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/footter.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/jquery.ui.base.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/jquery.ui.theme.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/ui.core.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/ui.tabs.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code= 174.127.83.136
hxxp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code= 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/background2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/talk2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/settings.png 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913725.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/images/dialpad/end2.png 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL914321.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL914146.jpg 50.7.99.28
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL914301.jpg 50.7.99.28
hxxp://web.itibitiphone.com/knctr/images/phone/min_normal.jpg 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/phone/exit_normal.jpg 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL914293.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/images/header.jpg 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL914257.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/images/menutab.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/video_menu.css 174.127.83.136
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL914123.jpg 50.7.99.28
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL913635.jpg 50.7.99.28
hxxp://web.itibitiphone.com/knctr/js/jquery-1.4.2.min.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/jquery.jcarousel.min.js 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913655.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL912964.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL914094.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/css/skin.css 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913710.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL913611.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913685.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/css/skin_channel.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/swfobject.js 174.127.83.136
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL913503.jpg 50.7.99.28
hxxp://web.itibitiphone.com/knctr/images/knvideo.png 174.127.83.136
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913657.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/right_banner.php?SYSTEM_ACCOUNT_KEY=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1 174.127.83.136
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL912901.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913647.jpg 50.7.99.36
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://web.itibitiphone.com/knctr/images/ads.png 174.127.83.136
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j31&a=344759030&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MECAAAgAI~&jid=1787667799&cid=1489344308.1418840893&tid=UA-38306554-6&sf=25&_r=1&z=857581271
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL912904.jpg 50.7.99.28
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j31&a=344759030&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MECAAAgEI~&jid=1700144484&cid=1489344308.1418840893&tid=UA-42318620-2&_r=1&z=555905987
hxxp://www.wip4.adobe.com/images/shared/download_buttons/get_flash_player.gif
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL909504.jpg 50.7.99.36
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912932.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL912882.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913506.jpg 50.7.99.36
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_55.js
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913470.jpg 50.7.99.36
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-1/html/container.html?n=3
hxxp://a1953.x.akamai.net/www.adobe.com/images/shared/download_buttons/get_flash_player.gif
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL911203.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL913439.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912893.jpg 50.7.99.36
hxxp://pagead46.l.doubleclick.net/gampad/ads?gdfp_req=1&correlator=2301890974904160&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&eid=108809028,108809034&sfv=1-0-1&iu_parts=282654509,knctrC_bigbox&enc_prev_ius=/0/1&prev_iu_szs=300x250&cookie_enabled=1&cdm=web.itibitiphone.com&lmt=1418840893&dt=1418840893020&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=1144579259&oe=iso-8859-1&gut=v2&ifi=1&ifk=45333344&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ref=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418840893&ga_hid=1496577444
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL912835.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912880.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912827.jpg 50.7.99.36
hxxp://pagead46.l.doubleclick.net/simgad/776638438837976361
hxxp://pagead46.l.doubleclick.net/pagead/osd.js
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL911121.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL911156.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL911157.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912663.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL911115.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL911120.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL911101.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910384.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL911075.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912727.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL910521.jpg 50.7.99.28
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL910865.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910944.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910890.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL910341.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910494.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910478.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL910280.jpg 50.7.99.28
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL909652.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910406.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910404.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL910181.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL909585.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL909531.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910298.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL909578.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910262.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL909503.jpg 50.7.99.36
hxxp://resource7.itibitiphone.com/thumbnail/celebrity/SPL909460.jpg 50.7.99.28
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910171.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910136.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL910110.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL912686.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL908833.jpg 50.7.99.36
hxxp://resource8.itibitiphone.com/thumbnail/celebrity/SPL909646.jpg 50.7.99.36
hxxp://web.itibitiphone.com/knctr/images/dialpad/1.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/8.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/index_tabs2.html 174.127.83.136
hxxp://web.itibitiphone.com/knctr/sidebar.html 174.127.83.136
hxxp://web.itibitiphone.com/knctr/kn_banner.php 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/9.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/astrix.png 174.127.83.136
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-1/html/container.html?n=2
hxxp://web.itibitiphone.com/knctr/images/dialpad/0.png 174.127.83.136
hxxp://pagead46.l.doubleclick.net/gampad/ads?gdfp_req=1&correlator=754948230998804&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_leaderboard&enc_prev_ius=/0/1&prev_iu_szs=728x90&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418840912&dt=1418840912369&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=3538004474&oe=utf-8&gut=v2&ifi=1&ifk=443509494&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&ref=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418840912&ga_hid=1390386811
hxxp://web.itibitiphone.com/knctr/images/dialpad/number.png 174.127.83.136
hxxp://pagead46.l.doubleclick.net/simgad/9975433107761106746
hxxp://web.itibitiphone.com/knctr/images/icons_bg.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/3.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/4.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/5.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/6.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/dialpad/7.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/phone/activate2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/icons_up.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/icons_dwn.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/jquery-1.7.1.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/js/jquery.ui.core.js 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/stylesheet3.css 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/sidebar_bg.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/HelpBTN.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/INfoBTN.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/SettingsBTN.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/welcomebg_pur3.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/welcome_icon2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/phone_icon2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/social_icon2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/feedback_icon2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/faq_icon2.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/images/shadow3.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/images/phone/sliderbg.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/css/slider_images/ui-bg_glass_75_440a4d_1x400.png 174.127.83.136
hxxp://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0 174.127.83.136
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j31&a=1912250307&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MAEAAAgEI~&jid=&cid=1489344308.1418840893&tid=UA-42318620-2&z=368998375
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j31&a=1912250307&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MAEAAAgAI~&jid=&cid=1489344308.1418840893&tid=UA-38306554-6&sf=25&z=1487364687
hxxp://pagead46.l.doubleclick.net/gampad/ads?gdfp_req=1&correlator=4191087010913227&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_leaderboard&enc_prev_ius=/0/1&prev_iu_szs=728x90&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418841028&dt=1418841028120&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=3538004474&oe=utf-8&gut=v2&ifi=1&ifk=443509494&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&ref=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418841028&ga_hid=1200603661
hxxp://pagead46.l.doubleclick.net/gampad/ads?gdfp_req=1&correlator=2823204564141822&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_bigbox&enc_prev_ius=/0/1&prev_iu_szs=300x250&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418841028&dt=1418841028289&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=1144579259&oe=iso-8859-1&gut=v2&ifi=1&ifk=45333344&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ref=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418841028&ga_hid=754552994
hxxp://pagead46.l.doubleclick.net/simgad/17877534288319335953
hxxp://pagead46.l.doubleclick.net/simgad/13540127826435132492
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?820495df5593ce08
hxxp://a1363.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://a1363.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://partner.googleadservices.com/gpt/pubads_impl_55.js 173.194.113.218
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl 87.245.202.48
hxxp://www.adobe.com/images/shared/download_buttons/get_flash_player.gif 192.150.16.64
hxxp://pagead2.googlesyndication.com/pagead/osd.js 173.194.113.217
hxxp://wwwimages.adobe.com/www.adobe.com/images/shared/download_buttons/get_flash_player.gif 213.155.152.203
hxxp://www.google-analytics.com/collect?v=1&_v=j31&a=1912250307&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MAEAAAgEI~&jid=&cid=1489344308.1418840893&tid=UA-42318620-2&z=368998375 74.125.232.8
hxxp://tpc.googlesyndication.com/safeframe/1-0-1/html/container.html?n=2 173.194.116.236
hxxp://pagead2.googlesyndication.com/simgad/17877534288319335953 173.194.113.217
hxxp://pubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=2301890974904160&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&eid=108809028,108809034&sfv=1-0-1&iu_parts=282654509,knctrC_bigbox&enc_prev_ius=/0/1&prev_iu_szs=300x250&cookie_enabled=1&cdm=web.itibitiphone.com&lmt=1418840893&dt=1418840893020&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=1144579259&oe=iso-8859-1&gut=v2&ifi=1&ifk=45333344&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ref=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418840893&ga_hid=1496577444 173.194.113.218
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?820495df5593ce08 87.245.202.35
hxxp://tpc.googlesyndication.com/safeframe/1-0-1/html/container.html?n=3 173.194.116.236
hxxp://pagead2.googlesyndication.com/simgad/776638438837976361 173.194.113.217
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= 23.43.139.27
hxxp://pubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=754948230998804&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_leaderboard&enc_prev_ius=/0/1&prev_iu_szs=728x90&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418840912&dt=1418840912369&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=3538004474&oe=utf-8&gut=v2&ifi=1&ifk=443509494&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&ref=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418840912&ga_hid=1390386811 173.194.113.218
hxxp://www.google-analytics.com/r/collect?v=1&_v=j31&a=344759030&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MECAAAgAI~&jid=1787667799&cid=1489344308.1418840893&tid=UA-38306554-6&sf=25&_r=1&z=857581271 74.125.232.8
hxxp://pubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=2823204564141822&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_bigbox&enc_prev_ius=/0/1&prev_iu_szs=300x250&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418841028&dt=1418841028289&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=1144579259&oe=iso-8859-1&gut=v2&ifi=1&ifk=45333344&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ref=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418841028&ga_hid=754552994 173.194.113.218
hxxp://www.google-analytics.com/r/collect?v=1&_v=j31&a=344759030&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MECAAAgEI~&jid=1700144484&cid=1489344308.1418840893&tid=UA-42318620-2&_r=1&z=555905987 74.125.232.8
hxxp://www.google-analytics.com/analytics.js 74.125.232.8
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 87.245.202.48
hxxp://pubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=4191087010913227&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_leaderboard&enc_prev_ius=/0/1&prev_iu_szs=728x90&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418841028&dt=1418841028120&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=3538004474&oe=utf-8&gut=v2&ifi=1&ifk=443509494&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&ref=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418841028&ga_hid=1200603661 173.194.113.218
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= 23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl 87.245.202.48
hxxp://pagead2.googlesyndication.com/simgad/9975433107761106746 173.194.113.217
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl 87.245.202.48
hxxp://www.google-analytics.com/collect?v=1&_v=j31&a=1912250307&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MAEAAAgAI~&jid=&cid=1489344308.1418840893&tid=UA-38306554-6&sf=25&z=1487364687 74.125.232.8
hxxp://pagead2.googlesyndication.com/simgad/13540127826435132492 173.194.113.217
hxxp://www.googletagservices.com/tag/js/gpt.js 173.194.113.218
wsup175.itibiti.com 204.244.36.175


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum

Traffic

GET /knctr/right_banner.php?SYSTEM_ACCOUNT_KEY=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1 HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:30:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
49b..<html>..<head>...<script type='text/javascript'>
;....var googletag = googletag || {};....googletag.cmd = googletag.cmd
 || [];....(function() {....var gads = document.createElement('script'
);....gads.async = true;....gads.type = 'text/javascript';....var useS
SL = 'https:' == document.location.protocol;....gads.src = (useSSL ? '
https:' : 'http:')   ....'//VVV.googletagservices.com/tag/js/gpt.js';.
...var node = document.getElementsByTagName('script')[0];....node.pare
ntNode.insertBefore(gads, node);....})();....</script>.....<s
cript type='text/javascript'>....googletag.cmd.push(function() {...
.googletag.defineSlot('/282654509/knctrC_bigbox', [300, 250], 'div-gpt
-ad-1375898792374-0').addService(googletag.pubads());....googletag.pub
ads().enableSingleRequest();....googletag.enableServices();....});...&
lt;/script>..</head>..<body bgcolor="black" marginwidth="0
" marginheight="0" topmargin="0" bottommargin="0" leftmargin="0" right
margin="0">...<div id='div-gpt-ad-1375898792374-0' style='width:
300px; height:250px;'>....<script type='text/javascript'>....
.googletag.cmd.push(function() { googletag.display('div-gpt-ad-1375898
792374-0'); });....</script>...</div>..</body>.</
html>..0..HTTP/1.1 200 OK..Server: nginx/1.0.15..Date: Wed, 17 Dec 
2014 18:30:28 GMT..Content-Type: text/html..Transfer-Encoding: chunked
..Connection: keep-alive..X-Powered-By: PHP/5.3.3..49b..<html>..
<head>...<script type='text/javascript'>....var google
<<< skipped >>>


GET /gpt/pubads_impl_55.js HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/right_banner.php?SYSTEM_ACCOUNT_KEY=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: partner.googleadservices.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Wed, 03 Dec 2014 11:00:33 GMT
Date: Thu, 04 Dec 2014 23:15:26 GMT
Expires: Fri, 04 Dec 2015 23:15:26 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33367
X-XSS-Protection: 1; mode=block
Age: 1105966
Cache-Control: public, max-age=31536000
Alternate-Protocol: 80:quic,p=0.002
......n.....y_...8.?..t.P)..M.6......6[.i...g....l$.%...9....,'.......
fF.....;...l0Im...g.#v.....e....}...Y.y=.D..-..K..o|.d./}.....n.O.M...
....q8.|?p......A..x.b..,.w.h...by.2...Yh3.......i6.M...lr2..i........
...l~......=.Uk.o.b..*.XX.|.....!5Gq......y... .#k.....A.....N.lvw..A.
q........-Q....... 9......dT.......*z...Z..<......x..}..`......X]..
.K...m)..*...dQ.N.<...LT. .K.Vy.fu......Kv]Wn..%.kGb......NUy.h.8.[
>...u-Y.} .M.y._........G.....~3.p ........z.o...?..P...FM>...l.
..01..`g...z<X.....;.~6..<..If.......y.#.|:z.q.q....>a{j=7 @,
.....Zj...A2.C.Y...2.G.\...R...%.[..;_.W.y........L..l......8T).....p.
.....;[email protected],..f|..'a6........k..../....
..5..c?l.....9[ENf.N':..~..O'....?.=L.A...m3.k',....g.7?W..ri|...).p..
L6.g....sR..!K...u..]u....W..ta]r?..........rFe......T5..........cgM.M
...`..].0..k.X..(A.. ..K.R.q..^..m.....=..jp..9k)...u8.g.1.[4.1.......
sv....V.....,.g..&ue.4e.t.c*>k,......,..fe...\U.0...........5..V.8.
..x...V-..R:...Y].. .s,.. ...S...._.'.u..R.................A....Y. ..n
..f....9.>....Z.;... 6.g..q<..L~{...8.................j.r....E..
t.t.....;}.....b^..).,..').x........Q43..b..~..5.[K.\.?.f.Y.|.c3..._.N
....>bX)....l.5.y......&o'7.r/(\..Y....4{.m.....a)....yo..p}..1..).
z..........$....x....}....`-v..Z..F..H..s..wwq.;.]d`....Ab.F.......n..
....!..7..........(.......Rp."..Oq..b.4.f..04..j..F..g."......h...u...
.G...W.x.e7~6...:H.... z..%..........~.[....?..........x.'..I]9.......
.....u............2..3...[..#.. ...E.."4.B).l.U.=......g.<{."..
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?820495df5593ce08 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT
If-None-Match: "0b2464b1797cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT
ETag: "0b2464b1797cf1:0"
Cache-Control: max-age=86400
Date: Wed, 17 Dec 2014 18:31:31 GMT
Connection: keep-alive



GET /safeframe/1-0-1/html/container.html?n=3 HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/right_banner.php?SYSTEM_ACCOUNT_KEY=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: tpc.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Last-Modified: Fri, 14 Nov 2014 14:57:36 GMT
Date: Wed, 17 Dec 2014 17:12:26 GMT
Expires: Thu, 17 Dec 2015 17:12:26 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1786
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 4546
Alternate-Protocol: 80:quic,p=0.02
......n....W{S.....Oa<\...;..i.qD...RJ...8IzG.......<h..~W....{.
9sfxH...O..o..........1...x....Fc.h(.0....q.....cf..D.(a...%.....~.>
;.;..G..'.....$.Q. .kF...1.2;$ 9..>.......E.d..........t._#[email protected]
N.1gb........\)#...{..#Z.Lx*R...iG.(.:..c...t5..K.....HX.......(...L.c
.q..Grb......i...\dh..W.I...........<k.a...........L..nV`.../.>.
V^.?.I.Z.*_..Y.1..&S....Hb]iA.l. ..w..|.\....O...<.77...A...y..E.&1
..r.w{YoA...r5:p..i...n.....7..a.N..f.^..F.......I.,.R.r.Nc....;....!K
..'...$....7x...ij[.rX.'#.b.-..........]......].[.........6..vw.e.}jb.
:.....C:g.E3..Zk...HH.}..]b[.>...=%;.C.B.4...{ _.IW..4d.Y..F5.gOw..
....XV..x.%.H.J....`....!.L."\.^....g.:.~.a._.....v..r...f].s.g.[7.O..
e!P....H.\..T..=H.D.....[...0....u.....j..a.?.P...8..............Wn/.r
.<.>..wi.._>.z..#...TX.a..K ..w..^.. ..%.#gL...Th.,...`....7&
gt;{.R. ....}`'..J>..o......2Q..........m.....c..Se..|.7.."....O...
.Z.uK.o...w.....<^...G.'C.X .......D ).kUl......../,..jz.j..{C$.m).
.|....;..~4Rm.?_q......O.hY.M......N..J..*......L....L......Q.s.c...g.
..X?..)}C.0.Z.......7..r.Z.d...N...A.^.......p...c&g..........d..X...Z
MK[d.f.n..l...`.....^...C...L~..=I.%.:.x:........VGk.'.].3J..9.1.,....
......v...n...e..-.....3..../........h.n..m._.....g4.&..v.JH..0 ......
.3.:sX"Kyx..by.....4T.....$as..^h........N..L_A6.C{........G..8(..*D..
7........%...~.S..6U.....!8.s]..%.w .I.......*:.......|G...4W.(..c..T.
6.B.a1...hs.<[email protected]#..."5.Bp..`.m.*...9Ye.;I.........o .
....'.`6.3.Q.>.....S-|Q.>..u.. .n.L.&]....\.d`..3..`....q*;.
<<< skipped >>>

GET /safeframe/1-0-1/html/container.html?n=2 HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_banner.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: tpc.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Last-Modified: Fri, 14 Nov 2014 14:57:36 GMT
Date: Wed, 17 Dec 2014 17:12:28 GMT
Expires: Thu, 17 Dec 2015 17:12:28 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1786
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 4564
Alternate-Protocol: 80:quic,p=0.02
......n....W{S.....Oa<\...;..i.qD...RJ...8IzG.......<h..~W....{.
9sfxH...O..o..........1...x....Fc.h(.0....q.....cf..D.(a...%.....~.>
;.;..G..'.....$.Q. .kF...1.2;$ 9..>.......E.d..........t._#[email protected]
N.1gb........\)#...{..#Z.Lx*R...iG.(.:..c...t5..K.....HX.......(...L.c
.q..Grb......i...\dh..W.I...........<k.a...........L..nV`.../.>.
V^.?.I.Z.*_..Y.1..&S....Hb]iA.l. ..w..|.\....O...<.77...A...y..E.&1
..r.w{YoA...r5:p..i...n.....7..a.N..f.^..F.......I.,.R.r.Nc....;....!K
..'...$....7x...ij[.rX.'#.b.-..........]......].[.........6..vw.e.}jb.
:.....C:g.E3..Zk...HH.}..]b[.>...=%;.C.B.4...{ _.IW..4d.Y..F5.gOw..
....XV..x.%.H.J....`....!.L."\.^....g.:.~.a._.....v..r...f].s.g.[7.O..
e!P....H.\..T..=H.D.....[...0....u.....j..a.?.P...8..............Wn/.r
.<.>..wi.._>.z..#...TX.a..K ..w..^.. ..%.#gL...Th.,...`....7&
gt;{.R. ....}`'..J>..o......2Q..........m.....c..Se..|.7.."....O...
.Z.uK.o...w.....<^...G.'C.X .......D ).kUl......../,..jz.j..{C$.m).
.|....;..~4Rm.?_q......O.hY.M......N..J..*......L....L......Q.s.c...g.
..X?..)}C.0.Z.......7..r.Z.d...N...A.^.......p...c&g..........d..X...Z
MK[d.f.n..l...`.....^...C...L~..=I.%.:.x:........VGk.'.].3J..9.1.,....
......v...n...e..-.....3..../........h.n..m._.....g4.&..v.JH..0 ......
.3.:sX"Kyx..by.....4T.....$as..^h........N..L_A6.C{........G..8(..*D..
7........%...~.S..6U.....!8.s]..%.w .I.......*:.......|G...4W.(..c..T.
6.B.a1...hs.<[email protected]#..."5.Bp..`.m.*...9Ye.;I.........o .
....'.`6.3.Q.>.....S-|Q.>..u.. .n.L.&]....\.d`..3..`....q*;.
<<< skipped >>>


GET /thumbnail/celebrity/SPL913725.jpg HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:42 GMT
Content-Type: image/jpeg
Content-Length: 12391
Last-Modified: Wed, 17 Dec 2014 17:35:10 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.)..S..:..E:..u&)..S....).S....1K..)qK.Z.1KKH.........u...M..0.D..g...
..(....._...j..3.i.......Q.i........n.r.._.U.....~.....v..Y..w..C...Y.
....un?...u0..t.?!R..tE...y.^...K.......1..}.3.e?D5e..3....d.B.B..:...
.OO0....OH&?....|..Kv.YE^yQ#.I.q..j..F.....7)..=..............1x......
F..Bn....?......;v......<v r).....U..2................M&.(......z..
....BW..n....0}...{ ..D..d.;....2.2E.....b..ADx..I.\P.x..?.b...1O..(..
..>....)qO.....K.......K...b. .bDd=......F...b2.n...... .q\...q...|
m......=.mJVv.D.....G:,W..A.OF....^0y.5.V.a....Y<..s....} .!.`.#L.A
..M*.I........K.~)qY.......@3....@[email protected]..(.?.R.....(....E.7.S.A.
...)...*.([email protected]. ...LS.E:..ZZZ.Ju.)...........Mx..T....j^y.3..
...x....I`.F..#..._QR}.......@.>..=i.i..Y..,s.._. 2..=.1mp._c...zg.
..I...X.v.R...z...v......N8.}).f.`B....}h.B.l.4O..L.#nRr[._QQ*..wy...Q
.6.....u"D.U..1K..l..?.......c6..^Ry..x9q......B.s;..`..nJ..........;.
dr....)_.,.$.L...q.q...5R..7.Lr...$...q..........)8.s..3..@....\f.
<<< skipped >>>

GET /thumbnail/celebrity/SPL914293.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:43 GMT
Content-Type: image/jpeg
Content-Length: 16670
Last-Modified: Wed, 17 Dec 2014 17:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.......Y.i..%KFH .....Z.....V...o.U2.{U.......6.....>.r...u:.W...!-
.`..s..^.hso...."....}........x...8...7R...u.S....K.....$ .c..N..=.jR.
R..Z(...........Z..t.0.U-.:[email protected]!.F.........J#.1`...N.N:g
[email protected]........*(..Hd.E..3..2....H_.V..]..M..............=3...9
.Q.&.1|...W....7..~9E....h..g9&.|.X.].ZC..\2...^....QN}.".$.<...FZ.
q..?N...E.sri.I.<2.O..8...".....`..V...,#.%^RI%2....}B.2y5.E.V.,>
;..4}./......S.........e...O..tP.O....(.*..x.B..@.>.?......7.C.....
..).K.........s...]..)}....i<[email protected]..._.....-.R.....
.ym..<..*...G.?.........?.^..(....g..h...g...P../...h.?..*.E.P....J
\..W...?....^.v.h...0).....{U..A.Q.}..(..#[email protected].
Z.tRyI...@......?ARyI......OC.....OAG...../..i<..o....'...OAN....?.
..W.M....7.OAQ.(GAR._.7.\...5.....>[.....>X.H.....C7J.od.:Um>
...u.d..._.\/f=7{..Q.m>H#...N:.. z.....DsZ..(..l.W.......>.|.3.z
.......g..s.?.;>...#_Jx....w...N..Z@:.L.P1ii...F.y>..T..._..
<<< skipped >>>

GET /thumbnail/celebrity/SPL913655.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:43 GMT
Content-Type: image/jpeg
Content-Length: 14408
Last-Modified: Wed, 17 Dec 2014 16:35:10 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
...?.m..k6;i....m.....L.X.m..%y...'l.z.*...Bx<......4......]...A..t
#..... .......v5.O..u.5..s.......RQZ.#......IE.-%.P.E%[email protected]%-..QIH.
._.F..K(8w.\..0......G,..z7..#5....-.>........n.....s).E.4......~..
......_.JOAL.d.....Jw.S3N^..F=...>...H....3K.~t.....MN........ S.Z.
.a..N.AH.JL..7(Q....F;.qP`....ju....J.O..Rg.........s...P".>$.....5
:.va'.^.=7f..s&?.3...Z........0>..j......p...ne.j..T.......A....Ja4
.n......I8o...wl..S....z.R...;[email protected](.h.....JZ.)
)h.p..o...;w.]k..W...K..f.....T..........;f..o..{.................?.}.
:.5..c.*7g.1..G...e...]?FyO.K.o....A..s.b..X..?'...z...zw.......U.GS.M
.[..r.1.:....C.2q.'.<..k....#.b....;p*b..F.s...".V\........V.})...n
;..D-g.u.%..h../........In.....U.....V<J......Rf.'4.......4f..;5\..
fMKQf..C...c....v4..(..QE-.%.RP..;..gk5....-.\v.u.x.o#E.a.............
..I....7..k.?-K e...Z.Z#.....T....Gz.FM..GzP3..;..*\P.......zRl....T.f
.....?.O..8... ...NU........'8QS.R.2..T|...^.X..V...U...O^..1|..X.
<<< skipped >>>

GET /thumbnail/celebrity/SPL913710.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:43 GMT
Content-Type: image/jpeg
Content-Length: 18173
Last-Modified: Tue, 16 Dec 2014 20:05:20 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...(...\.R.....=gS.R... .%9.J9q[[email protected]\.4..]*.......Q
Z.ZJ.).f.3S.......Z))......,M%8.h.. OZ..('...('..je.J^.'[email protected]..
E%[email protected].. .X.e.h!.M.........Ed..#l5;5.%.....Z&.1.
.*...]..........$|.\.....jc....;.n..Td.y.H...i)([email protected]...(
.......QIE.:.E.......V.....E(.ll$......?.~.a[..)....._.n.sU..T...Z..$.
....&.5<.BM2H...i.MI.P.E-...QP3f...zS(.... Z}!8.I..<..EE..QE..QK
[email protected]%-.N..?....&.K8..f.`Z......Z.X.)6Ta.H....)[email protected]......
.......`=d..C.#\IO.k'}4.RRf...I5S2UVzF..w.QcN-P.L.1...S.......1))..(..
.Z.k....1.S..)1.(..%.._.6..o..S%....N......J.))i(....M.%[email protected]@.8._..N
=..K..v......k...I.... :.=.#(TH8l.l..........m.....<........B<..
.......c2F....]....... ...;..s.s.^.......xl....7r:W.u.{[email protected],..U=.fR
9V......<...K{..o.C4m.d..... [email protected].....
........!z........|.......,...>..,;#.?....XX\.......A.....A........
$............:F.c.FV.3...W..|z.....]-......,.....q'..S..7.......q'
<<< skipped >>>

GET /thumbnail/celebrity/SPL913647.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 15851
Last-Modified: Tue, 16 Dec 2014 18:05:27 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.......'.h....]...Z...K.Jc..E..{`..pFGz......J....I&F.m...k.....W.-%so
pX.N........v.R.~....}[email protected]
...i..G.}G..... U].*..-.>c.'.....#..`[email protected] .NMOE..R. Kv...8.O.T`
.{}=.5,-#0.......g.{..9.W.......Y....$..y<J.[..N...E........2; ..}.
.9..:V..]...G....R.G.....n.$....z........xi.Y!.....8..kQE...VIf$...<
;..I$l..0:`...h.h.......E%[email protected]%..Z))h.i)....J.wn...TVR..0.x.......
.....t;.4T"d=.K.b..J(.h....(...JZ(......S...(.....(...(...(...)(......
o.<.i"....<...[....Xc.6H...p.##.Rv`p0i...-....[.r1.......Z....O.
.8....b..bY.@........~.I.J..... .4 )'.#....O...k:.o....w...H...6D..3..
9..k.N.......O...%.....mS.~B.C.`.Z......qJ*J..u-6.R1ii(...k...?.IQ....
G.4.5....)i)h...(..Sii..))(..RR. ..(..RQ@......(...ZJ(.h....E.R.S..5,.
(..i.EA.8.3.....&#.oC..e....>.?..H..Cl%r...^ ..S..li].s.15.......2.
#..P3Ljs...6:s. ..,..OZ.el...Y........U.GV7..#...N...!....*.%Wh.G.5...
Q.........u.TD...i..E?5[...".{..!..b%0.v..... ...D..#...d.~.m...&l
<<< skipped >>>

GET /thumbnail/celebrity/SPL909504.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 19296
Last-Modified: Tue, 16 Dec 2014 17:35:16 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
............... ! ....!!###**((112<<H...........................
...................................................}........!1A..Qa."q
.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxy
z.....................................................................
....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'
()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.............................
.................................................:.0.."...............
....?...(...IIE..QK@..)[email protected].)[email protected].@.[.....4..
f..R.d.P...@Ni(...(...).M.2..0QN..v...}-.&.>.(......S.E:...(.)....a
..Y.(.... ^..Q.`.E.8.sE"h..0."-[.Ur.S.P..<T$S.\.h.......;.f...v...$
j.c...-.y..$./E..u....5.5U&......U... !..).S...B.E%%.%6.....ZZ.m..m..Q
E..QE...M....L*.5dPRM.<.~)EJ)\.G.5.dx.yy....5..v.G..\_.....A.....x.
.ffQR..WcAB1.Q.E.8c5=V..$..Je..R.......f..N.....qQ.....B. [email protected].
,.Rn..:.....P...>.N.*.-.-.*QT.AA%.V.U .....sV!]D5..[q6(.#...~1TRJ..
.[.P5JqT..AW ..`M%[.Z..|.\...j2.E.06(..L.T[....1H.ri..=...)....X.Sj...
1.)....:.KO......p......4...)..qkq..%%....J.ZJ)h.(...\f.1S.....@)i.P.S
.......~4.#..?T[.WP.>j.74..| u..W?.....>...' U^<....-..|....?
.....o...Fx...-w....Ky......i,n.$.(.d..`z.....Z..\.....m.H.6......T.&l
t;.Q.a.../.1.....U..d..."w...3.$|.....[..wT.C$...A...?........oS.bA.Y.
.iG....D>.....q`f..Wj<9|;.?.d..%...9y.o.~...J....BNk....j.u.....
[email protected]....{................
<<< skipped >>>

GET /thumbnail/celebrity/SPL913506.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 21026
Last-Modified: Tue, 16 Dec 2014 12:35:06 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..(...(...(...p4.(.]....(.\.3M...(...(...(...(...(...{..1.....%.u.~...
...a..L..V...P..T.._z.z..u.....7.5.....s^.w...........q..v...`'..S~S.N
.9..3nzP..=.bq..........)..02}..HNs.Z.t.vJz|..W7..=k.....>..(......
............PJ.y.....b.........;.........)M.bj.._.!X....5..c.....XI...
.(...........:..9..... ..J.f...C..]...k...>[email protected].(9....E/.5.
.q#.. ........Xs.....m..4_t.j..,_v.8.9.O......<.......:....b^....{.
V....E..{.P..wW. m.~......[O.O..9....l..O............{....._Q....U...5
...Z._.(.KO..R....n.... M.........W.>...'....9?....W$.F......=..ti.
.~...}[email protected]^.h.Y.P.Q.%f....,F3.>...G...AU.B$<q...(V
.....R...........G..1h...(...(...(..{N......kefx.f%..Tg....R...s... ..
....s.....T.D.?.....?.....6.........{.............{;[m.<..L..{.QS..
.....I&..<......g.*[email protected]}.q..]...\.J..../.K....9....*v.....oR
S.?.....O.i|.....f...2D,;....?.kQ...........5C....x`.....A.OF<L=...
...!..kRW.7@j......?.).\....Ibx..]\.O.>.....P~.,..x.....2.....#
<<< skipped >>>

GET /thumbnail/celebrity/SPL913439.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 16635
Last-Modified: Tue, 16 Dec 2014 10:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?....Uj..ft3I.].Uc... .....R....".....M.S.W1.c.Lu.V.)P.h.b.....J.c..M
...SqW.T{ .S^c...!....&......b....j........?.:...j....KEu.bRS.........
7C.....}s.k....D.59..X..\.J..".u......i..1.......0>....B.|......<
;i.....md_G.`W..............`IIE..)[email protected]..(....KIN........E
..Si...Jm:...IN....)h.aQI.....o.R.2.....[.R..GAS3b........*...l.....c.
."..0...@.._/[email protected]../?.....I......................T.RP.
...O..z:...$u.. 5.....jjE.R..T.....5_...L..-J..V7#...GW.4`MKL.S.ii(...
......Q.....U.E*".|...<........xH......%....cP..5..?......K....EX.;
..E.....R.P.^E....m..G...v........2/.A..6'...'....w.....S.....I....o.s
......G.........._.6..z..J..LC.i)h...e:......(...(..g.1...:..4..T7(...
.V...h.0...Z.{......(......JC..... c.R .^f...ZR..'L.;.......{.y.cte.AB
.c..t....4...."...g..t.u..(.i(........IKI@..(..T.......U=W..L..7..i...
...T.[m...h?9..*x.J..|A(.X..GJ.......~o...Z...k....7....#. .k.........
........._7.u.....:JZ(.i..N.......t.H.!..S.E5`R.8..UEZZ.j.8.......
<<< skipped >>>

GET /thumbnail/celebrity/SPL912880.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 25513
Last-Modified: Mon, 15 Dec 2014 19:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?..zCNZ.. .B..q~.).D......... ~.. x.....m.B. ....>...x..j.4<=..
...x...2G..Kpg=.L.A....?_jFbOJ.!.R....fH...4....Ty."6...;6M3.....@....
......{..h[....0.j....[..2t...U0qZ*....3K.z.......?r.........3&p....j.
..b. .....Z...p....&qV@>...qVA..X..8......qZ.rx.H....J..\.</4...
.v*..;.....Jy...Nj?...T.&1..'.".....W.]..f2 ..#c..m..5..z.....Mh...*..
#......{..T.3.. ...*@3H.".h.....N.I..#.."..Z8..L..(......S)...B.S.M?..
Z.`....K.Q.8...\.r)c|c.].j1 N.2.K.-...\1..w...J.P.=>...<..s)...Q
[email protected].".nij...L.He`1...j].u.s._...''.f.....=.`.C...o....
Z...D.).Y.".g........5.{..V......_.M.?M...............g....O ......Y9&
.}w..I.K.ky...[.Z..&....h`M(......R..%;8.I..*.2(l.......<.).......Z
......k....E......Z.W`...GI..8. ....:.Z...R..m.9...>.Z...".....$.=)
...j`c..9.D,C....3.......v..}.S.e.^*LS.`. OiS..I..o........*..;V.\P3].
.......Q...O......AH...cbz....:.4&Eb...V...k..=....G9&..Z..=kM...mR%..
.....95.'...#...5....5.....>..W...).I..P.S...b.A....Nis..r..c.w
<<< skipped >>>

GET /thumbnail/celebrity/SPL912663.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 17337
Last-Modified: Mon, 15 Dec 2014 10:05:06 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...a......."...m...........d-.QT.E.U.QE..(..`.QE0.(...(...(...(...(.
[email protected]@[email protected]@[email protected]@.y...Sm.ZD.y..Gh..<...bY.H.{..$......N.6..
.~.(./..z.......N......c]..r?.....>..$.e.5..........uc.W..M...q.Y..
.....Fk/.s.D..p.x...<....X.w{.....J...pF.....c...j1...;.-eI"l20a...
.i...I.<g.$...G,I...e..wQ...e.......q.9.6...,.W..[...,x.........]..
.n.!.r..p.#.}:[email protected]@[email protected]@.A?..
?.o.jz...R...... o.....4...E\.v..!...i.....Y..QEP..QL..(..(....(...(..
.(...(...(...(...(...(...(...(..AE.P ..KY:...0q....p0.x....@.;.F..kb..
....a.?....9..NB....zPY.=.........j7. .e......A.....\..J..z..B|.......
H...<..j\.........O..v..*..156..>[email protected]...:..?....
.*2.y.a....d[x.`;w....N?..8=k...%..0.N..o.y...5..n........ ......7..-.
.E...9...G..J.$..=..(.2.([email protected]..(..E.P.E.P0..(.QE..(..C.(...A?..?
[email protected][email protected]..
QE..QE..QE..QE..QE..QE..QE .(...(........?..3..2V.pA...r...b.U.7..
<<< skipped >>>

GET /thumbnail/celebrity/SPL911101.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 30544
Last-Modified: Fri, 12 Dec 2014 18:35:20 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..m.T.4.F.5..cI....c..)).RR...:...kF.......Y..d........k[q.......t..a.
....PM._.O......E .?..'........E_......&......^....s*7d.=}...(........
....Q.O.7~.....Z..l..{.......s.'.|..........>$........}.9.......1..
......'...?.......y.a.Ou....~...3..........z}..0v...............e...a.
[email protected].@|......,..a..s...v.0 ....y.?
.G..<P...t.......(@.......G.z....O~.......Y/...?...4.f..q........i.
........8=............A.Q..z..)......C.....8..............{Q.3........
....No....-........H.r...m..-#....>.z.....~d.wF....~...q.oN.......&
gt;. 9..c.O.j..!......I.......=....e.?....x..^.............|.v.....'..
.{..w........FGe.....#d.O...)}.v......*n...g.9......{R.'o..gH... ..1..
Jr..........oO....h^................B.....g.....O....}.......{..)6.}..
..O....~..Zs.7|......H=[.t..i..P..?.g........}zv.9.n.....g..#..?.....\
.....8.0{.....iYH-...k..,....>.......T.....(.&.....9......zG..<.
.?..F.'...b.a.....z..$u....b..?..`4.8....-...{z.].0m.zs.??.s...J.I
<<< skipped >>>

GET /thumbnail/celebrity/SPL910944.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 23437
Last-Modified: Fri, 12 Dec 2014 12:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.(......(...J.............n..m..../...{.....:...z..75.b....R.@&.:...S.
h..)q..(.JV,.o...w..4..."#...R..UX..G.Q.<Q.M .2<.J^i...V)=F....Z
JZ..S(aM#.B`..p...h..5.7.....A.h.0}MF..0i...R....PO.\.......t...K.j...
K...I...L............cn?.x$Y.b.>2~..h.:|.....V1.U..9..YZ.......'.s[
.nK... ......r7.?1_7(..u#.Y.9....._.=x..(.............I...k~.......M..
i..a.?.. ..........5...o.......{.1..h....."........vT..T............A.
\g ......C.Ync..yX4....1T...E....j..e..>...~M.KO.y......R....U`..W.
.&... .a.... .}uI..m...$.<w.[.;......Q..4=D..zXS../..A.....K.Q.xy..
......I.;9s9b..^......K%E.z....<..?......e3G}>.$K.c.{~....S..:V.
.(.....\...]r.....q.x... .......{1..Tom.c...# ...3^.]9....Z..../sN....
...........Uwm....9Y.~....\.....<.o....?.....v.ki4.2F........y..M.8
i-.%9.. =.H..5D......*...u...D(..._...Y..~............[mJ.O.kg.\w|....
.G..s..&........\W4..Tm..M6....~...a...5....#.....~X.......YX.j.O...,.
..f.[...*......M.......*.......%}Z/..W.*.......e...Tb.....c.../w..
<<< skipped >>>

GET /thumbnail/celebrity/SPL910494.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 14657
Last-Modified: Thu, 11 Dec 2014 23:05:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?.../.G.*P.....(....4F.._.T......p.(........?b..u.!O. ..G........._.T
........B.......1KH../.W....*P/S.?t;W.b.w...2?..?.\w3....)jTU,....N3.|
V..8.........<.....<..8..:..Bo%dX....H8....g{......2..2...Ej.i..
.[...*......oV....%2.....#...T...X....&F..FQ..:..qBA..7h...b.. OQ...k.
...Y....2..5...*\#..[.h.zS.4tQ]YX|.!.n.J.U.T.....C;...v$.S.......Q@...
)h...@........._Bl_... ......R......M}.YO..Ob-......E.Z..u.!R..&.[....
.<....B.b.d......OFS."........6/.W..&)h.../.W...Z..u.!R.Ld[.....6/.
W...)h......B.-.....h.../.W..l_...*j(.-.............@G........._.T.S..
....B......IKH......B......KE1...v6.s..zW..L ..W.y.d..s^.^1.......K...
-..=T.z.{.7Z........p.&.K _)..'..2...= ......<n6.-......Z.:......j.
E.?>.......%<.H.d..u.......i..OW...... ....V..f..W.......{...l-.
dS;......We...6.*.@...]_...-Miq.....=.H.J....CM...6.......*Z]...}...,X
..u.d.3dt..y..t.{?."..#..}?..^..*...E...W..../......'.:..../oa......p;
....6....&.PD1..N:(.........H......\.=*.E...B.c......*._...*....u.
<<< skipped >>>

GET /thumbnail/celebrity/SPL910406.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 18702
Last-Modified: Thu, 11 Dec 2014 22:05:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..m.i2*..}3#...z....o_ZM..(.%......rz........M.D....T.W.Q.xS~.....\...
..QI...h.B...bz..........O.P...J...zF...........C'..jX.5>.......~C.
i.....~k.4.^.._......._........B.E.*.....................i.r......z?.{
.(.........f.}...z.......e..z.......\...O....V...G...F....~B.-...n..S.
..._..(....z_.....@....'..._.q...C...4.d.....m.4.!..zo....d..y.....4}.
..y/.=.4...>?..i......x...O.....x...|.5..~....'."...;"...?....;...&
lt;.....F.S.d^..l...........LF.....F..^..........=)7.J...K..9?....}.O.
.'..Z[... [email protected]._......W..3w....?.y.....q...Z?%.'..g..z 
.......s........)>Oz......H.....yS...d.._.=.0...G...{......>....
......U{..F...._e?......^.o..c.V.....*............F....F...U..J..S.M..
.h.uXB..I#.j........9.#}t.M.1......U2;;2p`C........j...".}..z[...|....
..../......1......E....G.....X:.y6...!.....W@%...k..~......%......Y...
...J......=.....N.....g..[.H.!.~.?......S.........Wih..........~......
..\....d.....o...%......V..E_....<...}........4.._....4...G.S..
<<< skipped >>>

GET /thumbnail/celebrity/SPL909585.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 25470
Last-Modified: Thu, 11 Dec 2014 20:05:17 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?.../...... ....\.....Q.eU..[.q^I,..{W..........a..O..i....2.{..T...z
..v!......[.oS5...;V\..n....}jP.g~.i.....?J...z..tZ.,w....P[..g....d..
9....\..G..#J..7(.!. ...k..%.n.[..W..v.O.5~.~.g3..z4zu<RS.........'
.rI.(..N....wO4q........z....Aa.8i........i.j..y.r..i....'....}.....z.
.,.b8.^O.#8..*.......O.g..5...a..^..G..c.*w.,.|.....).......G.k....As.
...k..-.W\..._xGP... r..y.8....."j...K.9...O........<..x.*C.{.i....
...f....1.....:........T.0.EoV4.m^....3o5.]=U.e..$) ....i......-...b..
.Gn@..>...y[..n...S.(.M........is.......#.m:.H......^Y.5....~....(.
..-v.8...F}?.on..y.6...%/....I.#_`O........c...F....d?.......k..)..L..
?.&..<.....}#L..G.....l|.S...!..*...fv....y.7Q...'c~M....xM../..h..
@.. ...'.....x...J.&}...........}...{;....&8.j.......:.~t.............
k..Sz...h.i.9k..4......\)l.....b..C....g...OT.k............5;5.y.B].j.
.....B.....;.c.>#........I..4..3....?L._..Z........C/..#.wR... ....
...?..?i?/.../...b......QZx../,o...bv...C..;......R....."../.z..QZ
<<< skipped >>>

GET /thumbnail/celebrity/SPL910262.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 19986
Last-Modified: Thu, 11 Dec 2014 16:05:24 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?......f...n`\.Vf..Z..&.f..X.Hj...N...#.=....f.`.g.Z.N.. ...su,.. v..
f...5.O..K.8.&.=X.$..7..A....534.,...........>...j.i...F.A._...^.Y.
....b.y......W. D.YC....5.8U...,6..B....}..B.."...E...TW.:%...K.q.....
S.?.....q..`.K.O.OQ(..k.........I....[}.......e.........T.........)|.7
ry....i....i..\..W.^}...\..l.........|7S*...J(.D...(..E.P.E.P.KIK@....
.(...-6....N..P.E.R.h....E...J(...h....R..R.......i.....H....Z.....)j.
.h.(......`#..kBs.$......Vk..:..8..._.....=..5.2jJ.....O]?...rw.......
%.m\m.tA^E.B...>.d.....9J..l..E..Mg..ZR.j ...{.5.%c.7C..7U..5.JR..s
..V\..j...0..X.X_Zb..*.q...uPkN=M.zb;B...W.4.g...5.%.x.)..rpI.....z.C.
......Z..*.|....z.I..ly......y..m ....5.5Y.<.V..=..}.>b..... ...
..Sw.a.:W..hrIY...[o7Vy...........{...}.k...m.i.78..}....?.k..'5..f...
IN.I9=k.e......U.9G.....Z.......L..Q.~....|G..=._.._}....1.z...zZ.....
..ym......W.[2...gU...?...g....)....i.r.....Z...Z..P~.s..]....gUK\_.$.
../.|...H<Ik.Q0.04..._c...Xx...IG....G.t..WO....A.......zJ...vo
<<< skipped >>>

GET /thumbnail/celebrity/SPL910171.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:47 GMT
Content-Type: image/jpeg
Content-Length: 19582
Last-Modified: Thu, 11 Dec 2014 12:35:06 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?..E.WA.%[email protected]\...)1..W:1..7.......\l.}. ..B..H...A......
8..;H.dfa.0I5.G..NKi{]....I..v.n....*.m..Uc*....tp5f4!.lt.U.]..Z..n.. 
..3....h<M..b9..s...S.Z|.......%[.S.&h./j...5d.j.9....3V....`T..Y..
.....MRj.3.K1..:W)o..!...\d...k...rV.n...?s/..P(.z..QA.QE..QE..(...(..
.(...(...))i(.k..L?.i/........S...&R......(..^...J.......e...=j..V..%.
...5`.sNA..G\U..Ni...EVcL/.).VcS...5\......4...{U....3.|..iji:.V 75...
Dr.}.Z.o.)[email protected].(..`.QE..R.P.\...Et...\.....eGs..9q.A
...G,.........'...y......g.....E.m.... }.z..:U...n.?..Q.J......).Z...Y
#.V.u..5..Us.....;i &.. >3....5.M....[..TL2.,.)?.......^..../Zm.sT.
..B..3 ...-.w.........l.>...... .[.K...I.XA.w.e.B..W._B.lz..QL...(.
..).QE..QE..QE..QE..RR.P.^;.%........^.^W......v?.I......mj0.U..&.EwZ.
m[nM<.(B3.8.E.08Z.e.0....Q...Y ........6j.u.[.....T....<T.T.....
.o..t... ...D..|...9..b...Z..E........J..B.?..V.Ch... ..).QE-.%..P..RQ
L.....Z)(....D.d..e..H.t.._g...|.....&Tw=.;Y.....8..Z..cc .M@.\..s
<<< skipped >>>

GET /thumbnail/celebrity/SPL910110.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:47 GMT
Content-Type: image/jpeg
Content-Length: 24339
Last-Modified: Thu, 11 Dec 2014 10:35:11 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...(...(..%.(.....<.~)EJ..G.B.c. L.#-..".<.......T.....(...(..
.([email protected]...........*,....(...(...(...ZZ)h.R.K@.:...E.RS....
.4T.... F$... ^[email protected]..\.V.SsUr...YR.T.I..y.L.1...z.
^.-@.,..R6)[email protected][email protected]@=.*u2...)h.(.RP.)i.P.E.P.R.Q
[email protected]#.x..k......i\|.........E......?..>o.#.....pk
.....,......(..b\C.d...m...).%[email protected]([email protected]...(...(...(...(...(..
[email protected].....!@.)...e...;..A)...j..:...:........d..<WT..
....q.._..._O......D..,#..jP#..(.@_...../.x...5y<.....~...Q.D..<
. V:..........2... R?.]..y..F...@.............>...!... I|..........
.RR8..........k..K....~3.;..).F..Vr..*..R.[k.8;@..l...i.....,..X...A.a
.s.U .........>....[.:<.K.Z8x...,...*r.{....|.<..._Z..h..\b?R
........:i...J..4........z....i..lm........l...6.64....Y.v.=H'.p{P ..|
............7.'?.k.....6@...\u<....1....XMA... ........\....\.<R
..!.j2}. ..._.&._.k/.N..aq.....Q.b..Q^.c..8x...lH...=..ino^.......
<<< skipped >>>

GET /thumbnail/celebrity/SPL908833.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:47 GMT
Content-Type: image/jpeg
Content-Length: 15947
Last-Modified: Wed, 10 Dec 2014 19:35:10 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
....(......(...(...(.....J.Z(...(...(....2.)[email protected]......)4
..\..(..2([email protected]@.-...R.S.......ZZP)...J.i...i.J.kB(sI.95.Am.V...3V.
.R.s.]*.)...T_9..$UV...-..2K|R.2f Nj.#.i|.Q.Qs6..#.... )g.M..\.....yF*
.f..%.9.d2..f...Hd.L....u6..0.6......S...H..R.@.)i......)qJ*J....i...Q
K..J(...(...([email protected]..(...W..e... ...V..QK....K_...F...T.b..Q
E..T...U.>....9..i..RR.@.:......4/.>...J(....#q.2.X.6..(...E...)
..u...IK@\[email protected][iN....AZ....W)2...V....L..
.3*b.e;....Yl......y..E...\...J.'.L.N. ......]{[email protected].).3R....c.R.J
.z.._.U..J{.n........./....Zx\.....S%......IN...)wSi(.ii...m-%..RR.@..
RP......GO?u..].#......."U....j..fd.T.i..F........5.$".0..8...E^..G..Y
..V...P.f.'.T4.(........sS..E.P.HH...P.....L...)i...QE...ZJu..u6..#...
N...T... ...R.!......PCgE......Z7.\Y.....J)L...qH.>..*.... ...9.k.{
.,.f...d|[email protected].".j......V4.....j}W...S.ih.(..FEES.k.....M.
.Ze.M....K.BSi.....i...(.....(...(...)...y.....8...i.Gi.....nAN...
<<< skipped >>>


GET /simgad/17877534288319335953 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pagead2.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Fri, 08 Mar 2013 21:23:47 GMT
Date: Wed, 17 Dec 2014 10:40:04 GMT
Expires: Thu, 17 Dec 2015 10:40:04 GMT
Access-Control-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 56230
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 28224
Alternate-Protocol: 80:quic,p=0.002
......Exif..II*.................Ducky.......d......Adobe.d............
......................................................................
...............................................................Z......
......................................................................
........................!1...AQa..q....."...2#5...B346.Rbcd.%7y..S$Te&
.89r.DEUuf..t.'g.).........................!1.AQ"..aq2..B#.....Rb3...r
..$t.6..Sc.4uv.....Cs.d^&F....T...E...............?......_X-V.n^....
Su.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.j5.7.
j5.7.j5.7.j5.7.j5..1......dDL)2vR.H.?.....|..o..78.C.0.a...........9..
..Z.5-.....z..Y...t.Ru"..&UQP..%:f.....:..?.Sc..._....Wj=D..~/O_....V.
.{.:.............Q..h.W.Ca...o....j]F..l!....^.o..eo.._a......4.C..P|A
.U.E-.e%...p.{~_^..z5[.$..C~.h~Q..=J..N.q..........=.?6..h.5.5'*.Q....
..R....N..9U..o..?>....k4...X|[email protected].........
w.t......t....7........ld.%......v.j....6.m.;..O..............CO..H{j.
.....z{.O.S._.Z.1.o.~M<.v.V.K.W......p"...[.!.G...:ii50.c'......K..
........A.T.Q.F..../..4.H.B]._.K.Rj..O..{z.......N....z....w...9.c....
}!......J.b|.V..;U[.........!.Iro.E0{%[email protected]\&Q.....c...
..`.&....lIx]@...l.em..6|..o%&Fk........_..z......o".Lg...k ..U.6...L.
c..`X..$K..N...)....EQT.&.0.]~|..Q....".:{;;n.....9..B.i.9F.....1*x.; 
?|.....?b...2h...W>Y....R.q.Q.W....$.s...XN...L.^r.K..4.I%S......0.
:W.....M1...t.s=K..l/..vH6.....W.nYS.....1 .a....2c.j.....E..Ij...I..l
...^J)..P,.."......P5......]...cr.)....|q([email protected]...:h....L
<<< skipped >>>

GET /simgad/13540127826435132492 HTTP/1.1


Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pagead2.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Tue, 01 Apr 2014 20:21:25 GMT
Date: Wed, 17 Dec 2014 10:26:57 GMT
Expires: Thu, 17 Dec 2015 10:26:57 GMT
Access-Control-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 39170
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 29011
Alternate-Protocol: 80:quic,p=0.002
......Exif..II*.................Ducky.......Q.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3AD63FD07BAFE311A
E2A98C15EA94FBD" xmpMM:DocumentID="xmp.did:E7039597B5E711E38F3381A1D2E
76D80" xmpMM:InstanceID="xmp.iid:E7039596B5E711E38F3381A1D2E76D80" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:F3A0D982E4B5E311AECE925BBFE905A1" stRef:doc
umentID="xmp.did:3AD63FD07BAFE311AE2A98C15EA94FBD"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
....................,.................................................
..............................................!.1..AQ".aq2...BR#3..W.$
4....b.Cs5....S.7....%Uu......e.w89......................!1..AQaq.."..
..2......BRr.#3b.s4..$..CS....c............?...~p\4..DM.4D..DM.4D..DM.
4D..DM.4D..DM.4D..DM.4D..DM.4D..DM.4D..DM.4D..XD..DM.4D..DM.4D..DM.4D.
.DM.4D..DM.4D..DM.4D..DM.4D..DM.4D..DM.4D..DM.QY.2\.....=...".....
<<< skipped >>>


GET /knctr/js/heros_code_here.js HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:55 GMT
Content-Type: application/x-javascript
Content-Length: 3550
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
..var myhero = new function () {...this.DisplayRef = false;...this.Sta
tusText = false;...this.InfoText = false;...this.MicVolume = false;...
this.SpeakerVolume = false;...this.PhoneEventReceived = false;...this.
RegEventReceived = false;...this.DisplayChanged = function() {....if (
this.DisplayRef) {.....this.DisplayRef.value = phone.GetDialString();.
...}...};...this.StatusTextChanged = function() {....if (this.StatusTe
xt) {.....this.StatusText.innerHTML = phone.GetStatusText();....}...};
...this.InfoTextChanged = function() {....if (this.InfoText) {.....thi
s.InfoText.innerHTML = phone.GetInfoText();....}...};...this.VolumeCha
nged = function() {....if (this.MicVolume) {.....this.MicVolume.value 
= phone.GetMicVolume();....}....if (this.SpeakerVolume) {.....this.Spe
akerVolume.value = phone.GetSpeakerVolume();....}...};...this.PhoneEve
ntChanged = function(eventId) {....if (this.PhoneEventReceived) {.....
this.PhoneEventReceived.innerHTML = eventId....}...};...this.RegEventC
hanged = function(eventId) {....if (this.RegEventReceived) {.....this.
RegEventReceived.innerHTML = eventId....}...};...this.OnEvent = functi
on(eventId) {....if (eventId == "EVENT_DISPLAY_TEXT_CHANGE") {.....myh
ero.DisplayChanged();....} else if (eventId == "EVENT_STATUS_TEXT_CHAN
GE") {.....myhero.StatusTextChanged();....} else if (eventId == "EVENT
_INFO_TEXT_CHANGE") {.....myhero.InfoTextChanged();....} else if (even
tId == "EVENT_VOLUME_CHANGE") {.....myhero.VolumeChanged();....} else 
if (eventId == "EVENT_RING_START") {.....myhero.PhoneEventChanged(
<<< skipped >>>

GET /knctr/js/jquery.cookie.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:56 GMT
Content-Type: application/x-javascript
Content-Length: 1942
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/**. * jQuery Cookie plugin - hXXps://github.com/carhartl/jquery-cooki
e. *. * Copyright (c) 2010 Klaus Hartl, @carhartl. * Dual licensed und
er the MIT and GPL licenses:. * hXXp://VVV.opensource.org/licenses/mit
-license.php. * hXXp://VVV.gnu.org/licenses/gpl.html. *. */.(function(
$) {.    $.cookie = function(key, value, options) {..        // key an
d at least value given, set cookie....        if (arguments.length >
; 1 && (!/Object/.test(Object.prototype.toString.call(value)) || value
 === null || value === undefined)) {.            options = $.extend({}
, options);..            if (value === null || value === undefined) {.
                options.expires = -1;.            }..            if (t
ypeof options.expires === 'number') {.                var days = optio
ns.expires, t = options.expires = new Date();.                t.setDat
e(t.getDate()   days);.            }..            value = String(value
);..            return (document.cookie = [.                encodeURIC
omponent(key), '=', options.raw ? value : encodeURIComponent(value),. 
               options.expires ? '; expires='   options.expires.toUTCS
tring() : '', // use expires attribute, max-age is not supported by IE
.                options.path    ? '; path='   options.path : '',.    
            options.domain  ? '; domain='   options.domain : '',.     
           options.secure  ? '; secure' : ''.            ].join(''));.
        }..        // key and possibly options given, get cookie....  
      options = value || {};.        var decode = options.raw ? fu
<<< skipped >>>

GET /knctr/refresh_parent.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:56 GMT
Content-Type: text/html
Content-Length: 135
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
<html>.<head>..</head>.<body>.  <script>
..setInterval(function(){...parent.location.reload();..},7200000);.  &
lt;/script>.</body>.</html>.HTTP/1.1 200 OK..Server: ng
inx/1.0.15..Date: Wed, 17 Dec 2014 18:27:56 GMT..Content-Type: text/ht
ml..Content-Length: 135..Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT.
.Connection: keep-alive..Accept-Ranges: bytes..<html>.<head&g
t;..</head>.<body>.  <script>..setInterval(function(
){...parent.location.reload();..},7200000);.  </script>.</bod
y>.</html>.....


GET /knctr/images/bg3_DRAGVERSION_ALPHA.png HTTP/1.1


Accept: */*
Accept-Language: en-us
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Charset: x-user-defined
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:06 GMT
Content-Type: image/png
Content-Length: 162947
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.............x.e.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:686DDE1EBF0011E1B886CECD64
E721C9" xmpMM:DocumentID="xmp.did:686DDE1FBF0011E1B886CECD64E721C9">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:686DDE1CBF0011E1B886
CECD64E721C9" stRef:documentID="xmp.did:686DDE1DBF0011E1B886CECD64E721
C9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.A~...x.IDATx......WY'.~...[..-..Te."....!.2.
(.."..-.4....>3j;...Q.v...q.u...Q...F|..{....*{......o..{.....[ImY.
|..S..[.w.y.{...FUUQ.....5.iMkZ.....=^....iMkZ.....5.iMkZ.<4.iMkZ..
...5.iMk...5.iMkZ.....5.i.....5.iMkZ.....5.Q.....5.iMkZ.....5.C.....5.
iMkZ....FyhZ.....5.iMkZ....FyhZ.....5.iMkZ...(.MkZ.....5.iMkZ..F.C.Eg.
;.'...Y......p?..{F..F.mZ..........Y.ig.,.tP."%[email protected].
..~.g.....iMkZ...(..,..R.\...}..l......n....Q.EZ.e...Y...8...p..-oy...
?=.~.....J.oZ.....5......R.,..Q.Bb..........w.oqq1v.O..yp..x.1?..$...=
..s..7..N.......%.......5.i....R.,...RO..0E.o}.[o.....[...b|O.e..o
<<< skipped >>>

GET /knctr/knctr_with_phone_loader.php HTTP/1.1


Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:07 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
15f7..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<!-
-..This is the loader page created to make it easier to use the Knctr 
alpha background loading functions...Because the LoadBackground functi
on MUST BE THE LAST JAVASCRIPT CALL...  It is easier for it to be..on 
a separate page like this one and when it is properly loaded for us to
 then load other pages.  It..is not the most efficient way of loading 
everything together and then displaying the page, but it is..probably 
too hard especially when there are variable code executed by the ad sy
ndication providers..-->..<!--...This page creates an iframe and
 puts the "knctr_with_phone.php" in it.    all the Knctr app content w
ill be inside the iframe.    .-->.<html xmlns="hXXp://VVV.w3.org
/1999/xhtml">.<head>..<style>..    body {..        over
flow:hidden;..        height:760px;..        width:749px;..        mar
gin: 0;..        padding: 0;...}.....html {..        overflow:hidden;.
.        height:760px;..        width:749px;..        margin: 0;..    
    padding: 0;...}.    </style>    ...<title>KNCTR Loadin
g...</title>. .  .<!--  <script type="text/javascript">
if (external) { external.LoadAPI(); }</script> -->.  .<scr
ipt type="text/javascript" src="js/phone_js/itibiti_phone_api.js?14188
40887" ></script> .  .<script type="text/javascript" src="
js/heros_code_here.js" ></script>..<script type="text/
<<< skipped >>>

GET /knctr/js/heros_code_here.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
If-Modified-Since: Fri, 12 Dec 2014 20:32:01 GMT
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 304 Not Modified
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
....


GET /knctr/js/phone_js/jquery-1.7.2.min.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
If-Modified-Since: Fri, 12 Dec 2014 20:32:01 GMT
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 304 Not Modified
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
....


GET /knctr/js/phone_js/itibiti_phone_api.js?1418840887 HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Content-Type: application/x-javascript
Content-Length: 27154
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
//..// This is the main file that needs to be referenced by all..// ne
w Itibiti phone software.  Please DO NOT use the..// external commands
 directly they they will change without..// notice...//..// IMPORTANT 
NOTICE:..// All API calls through this file can ONLY be made from the.
.// MAIN browser phone window.  Calling the functions in this..// file
 from a pop-up child window will result in an..// "unspecified error".
  This behavior is intentional in the..// current version.  Future ver
sion may support API calls..// from multiple pop-up windows...//..// A
nything that is preceeded with an underscore (_)..// such as _StatusTe
xt is considered to be private and such..// functions and variables sh
ould not be accessed directly.....//..//..// The phone object wrappers
 all phone related functions...//..var phone = new function () {...// 
This is just a temporary buffer so Albert can add status in JavaScript
......this._StatusText = "";......this.initialize = function(SecurityK
ey) {....// We will potentially use the SecurityKey for making sure th
at no....// hackers tries to compromise our skin page and load whateve
r....// they want...  At least it will make it more difficult for them
.....if (external != null) {.....external.OnEventCallback = this._Even
tHandler;....}...};......// SetDialString - sets the dial string for t
he Itibiti browser phone...// - Any illegal characters are parsed out 
and alpha-characters are converted to...//   numeric numbers between 0
-9 according to the North American telephone...//   touch tone key
<<< skipped >>>

GET /knctr/refresh_parent.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
If-Modified-Since: Fri, 12 Dec 2014 20:32:01 GMT
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 304 Not Modified
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
....


GET /knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number= HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: CP="CAO PSA OUR"
1fad..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>....<link 
rel="stylesheet" href="css/jquery.ui.all.css">...<META HTTP-EQUI
V="CACHE-CONTROL" CONTENT="NO-CACHE">...<meta http-equiv="Conten
t-Type" content="text/html; charset=utf-8" />......<!-- CSS for 
kn_phone  -->...<link type="text/css" href="css/phone_css/jquery
-ui-1.8.20.custom.css" rel="stylesheet" /> ...<link type="text/c
ss" href="css/phone_css/style.css"  rel="stylesheet" />...<!-- E
nd CSS for kn_phone  -->......<!-- CSS for Phone Dialpad  -->
...<link type="text/css" href="css/phone_css/phone_dialpad.css"  re
l="stylesheet" />...<link rel="stylesheet" href="css/demos.css"&
gt;...<link rel="stylesheet" href="css/style2.css" type="text/css" 
/>...<!-- End CSS for Phone Dialpad  -->......<!-- JS for 
kn_phone  -->...<script type="text/javascript" src="js/phone_js/
jquery-1.7.2.min.js"></script>...<script type="text/javasc
ript" src="js/phone_js/jquery-ui-1.8.20.custom.min.js"></script&
gt;...<script type="text/javascript" src="js/heros_code_here.js" &g
t;</script>...<!-- End JS for kn_phone -->.........<scr
ipt src="js/jquery.ui.widget.js"></script>...<script src="
js/jquery.ui.tabs.js"></script>...<script type="text/javas
cript" src="js/phone_js/itibiti_phone_api.js"></script>..
<<< skipped >>>

GET /knctr/css/jquery.ui.all.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Content-Type: text/css
Content-Length: 302
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*.. * jQuery UI CSS Framework 1.8.17.. *.. * Copyright 2011, AUTHORS.
txt (hXXp://jqueryui.com/about).. * Dual licensed under the MIT or GPL
 Version 2 licenses... * hXXp://jquery.org/license.. *.. * hXXp://docs
.jquery.com/UI/Theming.. */..@import "jquery.ui.base.css";..@import "j
query.ui.theme.css";......


GET /knctr/css/phone_css/style.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: text/css
Content-Length: 5057
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
@charset "utf-8";./* CSS Document */..html {..margin:0;..padding:0;...
....}.../* the new alpha background image is below*/..body{..margin:0;
..padding:0;..background:#333;../*background:url(../phone/png/bg3_DRAG
VERSION_ALPHA.png) no-repeat;  */...}...active_yes{..background:url(..
/phone/png/phone_bg3_Version2.png) no-repeat;..width:300px;..height:14
5px;..margin-top:9px;.}.../*..active_no{....width:295px;..height:155px
;...}..*/....#phone_section {..margin:0px;...}..#phone_txt {.....margi
n-left:75px;..border:0;.}...input.phone {..background:none;..border:no
ne;..text-align:center;..margin-top:25px;.........}.....#buttons {....
width:235px;..height:25px;..margin-top:2px;..margin-left:30px;../*bord
er:1px solid yellow;*/..}.........#buttons ul{margin:auto;padding:0; l
ist-style:none; clear:both;}   .#buttons li{overflow:hidden; text-inde
nt:-9999px; /*display:inline;*/ float:left;}   ..#buttons li a{width:a
uto; height:25px; display:block; margin:auto;}   ../*-----------------
--- Call butotn -----------------------*/..#buttons li.call_btn{width:
76px; height:25px; margin-top:2px;}   .#buttons li.call_btn a{backgrou
nd:url(../phone/png/call_normal2.png) no-repeat; }   .#buttons li.call
_btn a:active{background:url(../phone/png/call_inactive2.png) no-repea
t; }   .#buttons li.call_btn a:hover{background:url(../phone/png/call_
roll2.png) no-repeat;}.../*-------------------- Settin butotn --------
---------------*/..#buttons li.setting_btn{width:78px; height:25px;mar
gin-top:1px;}   .#buttons li.setting_btn a{background:url(../phone
<<< skipped >>>

GET /knctr/css/style2.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: text/css
Content-Length: 4830
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
@charset "utf-8";./* CSS Document */..body{..margin:0;..padding:0;../*
background:#000 url(hXXp://itibitiphone.com/knctr/2012/build2/phone/pn
g/bg2.png) no-repeat;*/..scrollbar-base-color: #000000;..position:abso
lute;.}..#container{..margin:0;..padding:0;..width:746px;..height:590p
x;.}..#sidebar{..background:#000 url(../images/sidebar_bg.png) no-repe
at;..margin:0;..padding:0;..width:22px;..height:139px;.}..#brandright{
..background:#000 url(../images/brandright.png) no-repeat;..margin:0;.
.padding:0;..width:178px;..height:39px;.}..#brandleft{..background:#00
0 url(../images/brandleft.png) no-repeat;..margin:0;..padding:0;..widt
h:178px;..height:39px;.}..h1, h2, h3, h4, h5, h6 {.    font-family: Ge
orgia, "Times New Roman", Times, serif;.    color:#4088b8;.    clear: 
both;.}..h1 {.}..h2 {.    color: #c8c8c8;...margin-top: -25px;.}..h3 {
.}..h4 {.    color: #333;.    margin-bottom: -10px;.}..p {.    margin:
 10px 0;.    clear: both;.}..ul, ol {.    margin-left 0;.}..ul ul {.  
  margin-bottom: 20px;.}..#wrap {.    color: #404040;.    /*margin: 0 
12%;*/.    margin: 20px 40px;.}..a {.    color: #4088b8;.}..table {.  
  font-size: inherit;.    border: 1px solid #c8c8c8;.}.a.menutab {..ma
rgin-top:0px;..margin-left:2px;..background:url("../images/menutab.png
") no-repeat 0 1px;..width: 110px;..height: 27px;..display:block;..tex
t-indent: -9999px;.}..a.menutab:hover {..background-position: 0 -25px;
..height: 27px;..}.a.menutab_close {..margin-top:0px;..margin-left:2px
;..background:url("../images/CloseMenu.png") no-repeat 0 1px;..wid
<<< skipped >>>

GET /knctr/js/jquery.ui.widget.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: application/x-javascript
Content-Length: 7275
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*!.. * jQuery UI Widget 1.8.17.. *.. * Copyright 2011, AUTHORS.txt (h
ttp://jqueryui.com/about).. * Dual licensed under the MIT or GPL Versi
on 2 licenses... * hXXp://jquery.org/license.. *.. * hXXp://docs.jquer
y.com/UI/Widget.. */..(function( $, undefined ) {..// jQuery 1.4 ..if 
( $.cleanData ) {...var _cleanData = $.cleanData;...$.cleanData = func
tion( elems ) {....for ( var i = 0, elem; (elem = elems[i]) != null; i
   ) {.....try {......$( elem ).triggerHandler( "remove" );.....// htt
p://bugs.jquery.com/ticket/8235.....} catch( e ) {}....}...._cleanData
( elems );...};..} else {...var _remove = $.fn.remove;...$.fn.remove =
 function( selector, keepData ) {....return this.each(function() {....
.if ( !keepData ) {......if ( !selector || $.filter( selector, [ this 
] ).length ) {.......$( "*", this ).add( [ this ] ).each(function() {.
.......try {.........$( this ).triggerHandler( "remove" );........// h
ttp://bugs.jquery.com/ticket/8235........} catch( e ) {}.......});....
..}.....}.....return _remove.call( $(this), selector, keepData );....}
);...};..}..$.widget = function( name, base, prototype ) {...var names
pace = name.split( "." )[ 0 ],....fullName;...name = name.split( "." )
[ 1 ];...fullName = namespace   "-"   name;...if ( !prototype ) {....p
rototype = base;....base = $.Widget;...}...// create selector for plug
in...$.expr[ ":" ][ fullName ] = function( elem ) {....return !!$.data
( elem, name );...};...$[ namespace ] = $[ namespace ] || {};...$[ nam
espace ][ name ] = function( options, element ) {....// allow inst
<<< skipped >>>

GET /knctr/js/jquery.ui.tabs.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: application/x-javascript
Content-Length: 22005
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*.. * jQuery UI Tabs 1.8.17.. *.. * Copyright 2011, AUTHORS.txt (http
://jqueryui.com/about).. * Dual licensed under the MIT or GPL Version 
2 licenses... * hXXp://jquery.org/license.. *.. * hXXp://docs.jquery.c
om/UI/Tabs.. *.. * Depends:.. *.jquery.ui.core.js.. *.jquery.ui.widget
.js.. */..(function( $, undefined ) {..var tabId = 0,...listId = 0;..f
unction getNextTabId() {...return   tabId;..}..function getNextListId(
) {...return   listId;..}..$.widget( "ui.tabs", {...options: {....add:
 null,....ajaxOptions: null,....cache: false,....cookie: null, // e.g.
 { expires: 7, path: '/', domain: 'jquery.com', secure: true }....coll
apsible: false,....disable: null,....disabled: [],....enable: null,...
.event: "click",....fx: null, // e.g. { height: 'toggle', opacity: 'to
ggle', duration: 200 }....idPrefix: "ui-tabs-",....load: null,....pane
lTemplate: "<div></div>",....remove: null,....select: null
,....show: null,....spinner: "<em>Loading…</em>",...
.tabTemplate: "<li><a href='#{href}'><span>#{label}&
lt;/span></a></li>"...},..._create: function() {....thi
s._tabify( true );...},..._setOption: function( key, value ) {....if (
 key == "selected" ) {.....if (this.options.collapsible && value == th
is.options.selected ) {......return;.....}.....this.select( value );..
..} else {.....this.options[ key ] = value;.....this._tabify();....}..
.},..._tabId: function( a ) {....return a.title && a.title.replace( /\
s/g, "_" ).replace( /[^\w\u00c0-\uFFFF-]/g, "" ) ||.....this.optio
<<< skipped >>>

GET /knctr/images/facebookIcon.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: image/png
Content-Length: 2383
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR................U....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:7BB438EA3AFD11E1A0CC9C9B72
0690BF" xmpMM:DocumentID="xmp.did:7BB438EB3AFD11E1A0CC9C9B720690BF">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BB438E83AFD11E1A0CC
9C9B720690BF" stRef:documentID="xmp.did:7BB438E93AFD11E1A0CC9C9B720690
BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.cUz....IDATx..VK.\E.>u.....L..........!1.
1.. ..D!kA......?...\.n..}.MF.,d.h2...f2.W..}.......;...j.N.....w.*E.3
.{..#/..a.ecD^...Ga<........6.~ci... ...{..2E.Vg...'.;y..s..... G.$
...............9..yr.......5...o._.s..l}.:K3...;w.v...O.|.h..NY.d..!N.
....&...p.a,fk.:C.Xy..9..u....................O.[.T......$j6......a.N.
..z.......j6...;..6..,1F..j1.Yx.KA.(.d6... ..JE.....8 v..l..<.0.-.7
.....F........*/.EQL..K.Y.#e.hG.!5...J.=...j..C.............xC2.IT08..
q...1..u..ku..w_....QK..........4...)UC\[email protected].'4?7K..2....p
....(R.....S........h.......[A..v.>8..8B).<.c............0Vl
<<< skipped >>>

GET /knctr/images/twitterIcon.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: image/png
Content-Length: 2318
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.............b..k....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:5E5462CA3AFD11E19C4FEED561
3E6777" xmpMM:DocumentID="xmp.did:5E5462CB3AFD11E19C4FEED5613E6777">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5E5462C83AFD11E19C4F
EED5613E6777" stRef:documentID="xmp.did:5E5462C93AFD11E19C4FEED5613E67
77"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>q.......IDATx..V...E.~.]3;;...l Y.Q...a=.Hd..
M%z..M...A...."x.$..M..I ..1'....& ...f63.3..~..W.3..I...]...z....V...
S...^...l<^...L..R..~>z..M}.l....o_...k.O..R9..wO]X_.....<w..
.F..C........{6....F...g,.~..}..g...v..Qo......;_|...W_[.....".Q*..e.C
0p41|. .Zr0k....../.Sf......o^....t..y..zv0...&N..N..[th.a..`...1...{4
..t....d}CWe..U%.jJ&7.R....4I(.s...k.....1.....2..3*....9.......)/QP..
.y.m...2.!.l..Pkn..<R'..u5..P........e..O..v.(..v...gg.t.....`@...R
.ZT-...`#.CT.Dg$.*. .............#....e:.r... \f. ...ACt..............
c....r........|6.{.7..$H[.....D...C.b.d.P!o.]j...oL(W......*|..{.O
<<< skipped >>>

GET /knctr/images/nextapp.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: image/png
Content-Length: 941
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR................U....tEXtSoftware.Adobe ImageReadyq.e&
lt;...OIDATx..V.O.A......V..P...H."1...9.......&.B(.j[c...7......x..Gj
.H0X..........l....hS..ufg.{..9.....kH.....n.pggg....8.N.............O
.....M......U.Q.c...{.....e.dI..558..q...J.......0...,0..<..{......
......_{.K.t..v.>.....Y.u..`..`...1.$.,<.!:.. f.5&...A...7.pp...
o.&..p;.l..([email protected]!C.U=..C.\fv.0....$.. ...(......<
;..Ku...EQ`vv.VWW!...VRk\..`.`...TQHa.f.P,....R.t".................W.E
..[..O.T.DD.B..L.666 ..a.;..*Q.... .JA...2..%.T.5.......<#FZ..iH&..
....pX<..K.%..a.....Vy*T..7.4.$...U......Hy....b1...x..k..g.PU.%...
[email protected]!..Cd9"......`0(.[Yy....ptt$*.*k.....0.........\....,a....
w.....$.}...$...B........r.W...$.-..^...:,..0.y...2.,.b14*..y....h....
Y$..u.q..........(...1............F3.._... .....j$Y.U.D...q..!"u......
._.~..eyF.t{p.z,V...........3.y.{..4...V..g..0...~.a-`3...?.;Q....l...
C.....|=..o,.C...~a....H...._....<.#.zSI....IEND.B`.....


GET /knctr/images/footter.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: image/png
Content-Length: 19169
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......6.............tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:13479B2A72BF11E1B05FF20D2B
9800EA" xmpMM:DocumentID="xmp.did:13479B2B72BF11E1B05FF20D2B9800EA">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:13479B2872BF11E1B05F
F20D2B9800EA" stRef:documentID="xmp.did:13479B2972BF11E1B05FF20D2B9800
EA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>dS....GWIDATx..}.|.....B..R..$x......."..=@H.
...P.\..S(E.W^.Wy.........(...{n.vs.7.._.....fw.....3.s.......6.m.....
....L.^V....g..9/O..*U...............{..=.^D..1.v.......;..A..?.G....H
.7m.SF....Wm...B....1.kcS..2.v2.j..\....,..{)Q.zu..i.q.....|..[Z.....m
.U....w.....[..{.~/.Z...PjS....6.=...M.7..o......t....P......W.....V.Z
...^.?..# ..{y.-...JkV.<..(.....c}Z..<.BT.JQ....JgcS.*...X.ccc..
..R..9.....Y.5j....5.7o.\..;.\.U..r...........U..R..QW....6..M.&..J.7.
...\..Fg...CX....<.Cm.....R.n....n....H.J..UhR........J....EHy.0:[.
f.......y.*.Qhd!.M.W.ltim."7.......YK.h.\......~......h..:.......U
<<< skipped >>>

GET /knctr/css/jquery.ui.theme.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: text/css
Content-Length: 17695
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*..* jQuery UI CSS Framework..* Copyright (c) 2009 AUTHORS.txt (http:
//jqueryui.com/about)..* Dual licensed under the MIT (MIT-LICENSE.txt)
 and GPL (GPL-LICENSE.txt) licenses...* To view and modify this theme,
 visit hXXp://jqueryui.com/themeroller/..*/..* { margin:0px;padding:0p
x; !important }../* Component containers..----------------------------
------*/...ui-widget { font-family: Verdana,Arial,sans-serif/*{ffDefau
lt}*/; font-size: 1.1em/*{fsDefault}*/; }...ui-widget .ui-widget { fon
t-size: 1em; }...ui-widget input, .ui-widget select, .ui-widget textar
ea, .ui-widget button { font-family: Verdana,Arial,sans-serif/*{ffDefa
ult}*/; font-size: 1em; }...ui-widget-content { border:0px /*{borderCo
lorContent}*/;/*{bgColorContent}*//*{bgImgUrlContent}*//*{bgContentXPo
s}*//*{bgContentYPos}*//*{bgContentRepeat}*//*{fcContent}*/ }...ui-wid
get-content a { color: #222222/*{fcContent}*/; }...ui-widget-header { 
border:0px/*{borderColorHeader}*/;/*{bgColorHeader}*//*{bgImgUrlHeader
}*//*{bgHeaderXPos}*//*{bgHeaderYPos}*//*{bgHeaderRepeat}*//*{fcHeader
}*/ }...ui-widget-header a { color: #222222/*{fcHeader}*/; }../* Inter
action states..----------------------------------*/...ui-state-default
, .ui-widget-content .ui-state-default {/*{borderColorDefault}*//*{bgC
olorDefault}*//*{bgImgUrlDefault}*//*{bgDefaultXPos}*//*{bgDefaultYPos
}*//*{bgDefaultRepeat}*//*{fwDefault}*//*{fcDefault}*/}...ui-state-def
ault a, .ui-state-default a:link, .ui-state-default a:visited { color:
 #555555/*{fcDefault}*/; text-decoration: none; }...ui-state-hover
<<< skipped >>>

GET /knctr/css/ui.tabs.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: text/css
Content-Length: 1671
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*.. * jQuery UI Tabs 1.8.17.. *.. * Copyright 2011, AUTHORS.txt (http
://jqueryui.com/about).. * Dual licensed under the MIT or GPL Version 
2 licenses... * hXXp://jquery.org/license.. *.. * hXXp://docs.jquery.c
om/UI/Tabs#theming.. */.. * { margin:0px;padding:0px; !important }.. .
..ui-tabs { position: relative; padding:0px; } /* position: relative p
revents IE scroll bug (element with position: relative inside containe
r with overflow: auto appear as "fixed") */...ui-tabs .ui-tabs-nav { m
argin: 0; padding: 0; height:42px; background:;}...ui-tabs .ui-tabs-na
v li { list-style: none; float: left; position: relative; margin: 0; b
order:0 !important; padding: 0; }...ui-tabs .ui-tabs-nav li a { float:
 left; margin:0px; text-decoration: none;  }...ui-tabs .ui-tabs-nav li
.ui-tabs-selected { margin: 0px; padding:0px; }...ui-tabs .ui-tabs-nav
 li.ui-tabs-selected a, .ui-tabs .ui-tabs-nav li.ui-state-disabled a, 
.ui-tabs .ui-tabs-nav li.ui-state-processing a {background:#FFF;}...ui
-tabs .ui-tabs-nav li a, .ui-tabs.ui-tabs-collapsible .ui-tabs-nav li.
ui-tabs-selected a { cursor: pointer; } /* first selector in group see
ms obsolete, but required to overcome bug in Opera applying cursor: te
xt overall if defined elsewhere... */...ui-tabs .ui-tabs-panel { displ
ay: block; border-width: 0; padding:0px; background: none; }...ui-tabs
 .ui-tabs-hide { display: none !important; }..#tabs-1 {...margin:5px;.
..height:auto;...padding:10px;..}..#tabs-2 {...margin:5px;...height:au
to;...padding:10px;..}..#tabs-3 {...margin:5px;...height:auto;...p
<<< skipped >>>

GET /knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code= HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
1fc4..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en">.&l
t;head>..<title>KNCTR</title>..<meta http-equiv="Con
tent-Type" content="text/html; charset=iso-8859-1" />..<script t
ype="text/javascript" src="js/jquery-1.4.2.min.js"></script>.
.<link rel="stylesheet" type="text/css" href="css/skin.css" />..
<link rel="stylesheet" type="text/css" href="css/skin_channel.css" 
/>..<script type="text/javascript" src="js/phone_js/itibiti_phon
e_api.js"></script>.....<script type="text/javascript">
.....    var getVideoID = '228394';..    var getChannelID = '1';....if
 (typeof console != 'object') {....eval("var console = new function() 
{this.log = function(debugString){}};");...}......if ((typeof external
 == 'object')&&(typeof external.Debug != 'undefined')) {....eval("var 
console = new function() {this.log = function(debugString){if(external
 != null){return(external.Debug(debugString, 1));}}};");...}.....funct
ion setActiveVideo(theID){...    try{..            if(typeof(parent.vi
deo_menu.activeVideo) == "function"){...        parent.video_menu.acti
veVideo(theID);..            }else{..                setTimeout(functi
on(){setActiveVideo(theID);},1000);...}..        }catch(err){..       
     setTimeout(function(){setActiveVideo(theID);},1000);..        }..
.}....function RWCall(fn,dv) {....if (typeof(fn)=='string') {.    
<<< skipped >>>

GET /knctr/images/dialpad/background2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/png
Content-Length: 19599
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...,.........=`......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:491F3AE1E32011E1B46883EE
6D352711" xmpMM:DocumentID="xmp.did:491F3AE2E32011E1B46883EE6D352711"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:491F3ADFE32011E1B4
6883EE6D352711" stRef:documentID="xmp.did:491F3AE0E32011E1B46883EE6D35
2711"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>p,GG..I.IDATx.....\.u&zc......3........$..$
P.J.$...e>[...NZ.........~..% ..o....d.O.%..H.9......$...`..C...._u
..w:....0}.....u..[u.:.N.#.......t...B...u=.....IN..!.r ..X..*.i&.G.G.
,S.D.YU5-.N.rbj.0..$.#-.e.|.\>?3..H...z ..C....)M..S...C.Pc.m;x.i..
.AGR....c....@"...}..s.....F.#.k.H&...g[VbrHVTE.B..@ `.F..CcR....)....
TJ.uT.O.UT.....>]G.L:.G. {w..; ..av^.........XvbrP.|.z.`$.......c:&
gt;. ..Z.......n...?...fX..74`"[email protected].....$)..>.a..t..y...... .H
..aCc.?X..FC..m...c.....C.d".I..|...m...eY.EQ.K..... ....>*}.u..O..
..VrP...?...~}...x~E..2.X..xq.w..V..)9........]..v.."1y... ,..$u..
<<< skipped >>>

GET /knctr/images/dialpad/settings.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/png
Content-Length: 4552
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...\...f.....F.......tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:747693FAE31711E1991FBC35D2
E3C737" xmpMM:DocumentID="xmp.did:747693FBE31711E1991FBC35D2E3C737">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:747693F8E31711E1991F
BC35D2E3C737" stRef:documentID="xmp.did:747693F9E31711E1991FBC35D2E3C7
37"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.~.....>IDATx...Wo.M..kl.s..9. .......>
.$nv%.W{.......^ .......A..D.9g..x..S.w(.'...~ZUI......z..sNu.....=...
..Mu...#}....MU..".I..d<e......`.R....I..4.&.L.....pD..T.2.#...=...
..i.=..Q<.....Q..gxd.o.).x..'.I{p}EE.=b.X..|..V...w.et/....... x..#
....J3.*..D"[email protected]...... .8e..We....5(..p..M"...38..s..U.Ki.....
..a........o.u.....W....Y.S...m.6..:...S..M...o..L...L..].!.*..A}.....
w....... ....rp-.z..e.|..%;......-Y....g.. 6...2............4...p.....
F,[..L.<.|.....[..s....,Y..6.2\G9>....[M..=......H.Y[[k.m.....5.
..3.......(...k.o.>...u.........m...6.....cn..m...k.....\..e...
<<< skipped >>>

GET /knctr/images/phone/min_normal.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/jpeg
Content-Length: 1425
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:47C15536AF3E11E1812B9CFD1A6598A2" xmpMM:DocumentI
D="xmp.did:47C15537AF3E11E1812B9CFD1A6598A2"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:47C15534AF3E11E1812B9CFD1A6598A2" stRef:doc
umentID="xmp.did:47C15535AF3E11E1812B9CFD1A6598A2"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
.................................1Aa..3.57.8..2.4d.U.Vf...............
..........!..a2.1q.."B................?..v...G.Z\.Tf.6....Jg.Vy.....1.
.)&..M......@.....*.).&(.0t<.8....G.yZ.w2*u....dM7hH..3.../.&o.....
S8.s.%..Q.... ... .....,...fBTf!..S'........|.e$2D............V9..V.b.
..;.....P....1..l._`...m..7.:...v......y.y.../P..B........0....K......
...?-..w........
<<< skipped >>>

GET /knctr/images/header.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/jpeg
Content-Length: 27055
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:A139775BC08D11E1933BE636D3ADFCA1" xmpMM:DocumentI
D="xmp.did:A139775CC08D11E1933BE636D3ADFCA1"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:A1397759C08D11E1933BE636D3ADFCA1" stRef:doc
umentID="xmp.did:A139775AC08D11E1933BE636D3ADFCA1"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
...............................................!..1".A2Qa.#3$4...T%.q.
...R...W..B.S5V....Cc.Ue&6b.Ddt.Eu.X.....................!.1...AQaq."2
......B...br..R.#.3C....cs.$%.............?..#V.6..!yo...l.'.4.]?.6.HO
.Q...h.......f[k...[......*X...i.../.-"k..... ..k%z..:.<..|........
.a...._O.A{%..d.....Ol...Z..a...T..y.......wI.u......X.=.....4..9.....
..I^.(.... L.,....&.#.....Ae.:........&....:...2..... ..C.f.&w.]..
<<< skipped >>>

GET /knctr/css/video_menu.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: text/css
Content-Length: 7498
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
        body{background-color:transparent;margin:0;padding:0;}.       
 a{cursor:pointer;}..        #category_video .sprite{background-image:
url('../images/knvideo.png');}.        .videoBox{background-image:url(
'../images/knvideo.png');background-position: -142px 0;width:58px!impo
rtant;margin:.15em 1em 0em 0em!important;/*background-image:url('../im
ages/Video_Container.png');*/background-repeat:no-repeat;vertical-alig
n:middle;padding-left:.2em;padding-top:.2em;/*text-align:center;*/}.  
      .videoBox:hover{background-image:url('../images/knvideo.png');ba
ckground-position: -207px 0;/*background-image:url('../images/Video_Co
ntainer_Roll.png');*/}.        .video_active{background-image:url('../
images/knvideo.png');background-position: -207px 0;/*background-image:
url('../images/Video_Container_Roll.png');*/}.        .videoBox a{widt
h:58px!important;}.        .channelBox{float:left;position:relative;wi
dth:66px;height:54px;display:inline-block;}.        .channelBox a{back
ground-image:url('../images/knvideo.png');background-position: 0 0;dis
play:block;/*text-align:center;*/text-decoration:none;color:#303030;fo
nt-family:Arial,sans-serif;font-size:13px;font-weight:bold;/*backgroun
d-image:url('../images/MenuChannelBackground.png');*/word-wrap:break-w
ord;break-word:break-all;}.        .channelBox a:hover{background-imag
e:url('../images/knvideo.png');background-position: -71px 0;/*backgrou
nd-image:url('../images/MenuChannelBackground_Active.png');*/color:#30
3030;}..        .channelBox a.channel_active{background-image:url(
<<< skipped >>>

GET /knctr/js/jquery.jcarousel.min.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: application/x-javascript
Content-Length: 15650
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*!. * jCarousel - Riding carousels with jQuery. *   hXXp://sorgalla.c
om/jcarousel/. *. * Copyright (c) 2006 Jan Sorgalla (hXXp://sorgalla.c
om). * Dual licensed under the MIT (hXXp://VVV.opensource.org/licenses
/mit-license.php). * and GPL (hXXp://VVV.opensource.org/licenses/gpl-l
icense.php) licenses.. *. * Built on top of the jQuery library. *   ht
tp://jquery.com. *. * Inspired by the "Carousel Component" by Bill Sco
tt. *   hXXp://billwscott.com/carousel/. */..(function(g){var q={verti
cal:!1,rtl:!1,start:1,offset:1,size:null,scroll:3,visible:null,animati
on:"normal",easing:"swing",auto:0,wrap:null,initCallback:null,setupCal
lback:null,reloadCallback:null,itemLoadCallback:null,itemFirstInCallba
ck:null,itemFirstOutCallback:null,itemLastInCallback:null,itemLastOutC
allback:null,itemVisibleInCallback:null,itemVisibleOutCallback:null,an
imationStepCallback:null,buttonNextHTML:"<div></div>",butt
onPrevHTML:"<div></div>",buttonNextEvent:"click",buttonPre
vEvent:"click", buttonNextCallback:null,buttonPrevCallback:null,itemFa
llbackDimension:null},m=!1;g(window).bind("load.jcarousel",function(){
m=!0});g.jcarousel=function(a,c){this.options=g.extend({},q,c||{});thi
s.autoStopped=this.locked=!1;this.buttonPrevState=this.buttonNextState
=this.buttonPrev=this.buttonNext=this.list=this.clip=this.container=nu
ll;if(!c||c.rtl===void 0)this.options.rtl=(g(a).attr("dir")||g("html")
.attr("dir")||"").toLowerCase()=="rtl";this.wh=!this.options.vertical?
"width":"height";this.lt=!this.options.vertical? this.options.rtl?
<<< skipped >>>

GET /knctr/css/skin.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:12 GMT
Content-Type: text/css
Content-Length: 4789
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
..jcarousel-skin-tango .jcarousel-container {.    background: url("ima
ges/clip_bg.jpg") no-repeat scroll 0 0 transparent;.    border: 0 soli
d #346F97;.    border-radius: 1px 1px 1px 1px;.}..jcarousel-skin-tango
 .jcarousel-direction-rtl {.    direction: rtl;.}..jcarousel-skin-tang
o .jcarousel-container-horizontal {.    padding: 1px;.    width: 434px
;.}..jcarousel-skin-tango .jcarousel-container-vertical {.    height: 
245px;.    padding: 40px 20px;.    width: 75px;.}..jcarousel-skin-tang
o .jcarousel-clip {.    overflow: hidden;.}..jcarousel-skin-tango .jca
rousel-clip-horizontal {.    height: 56px;.    margin-left: 40px;.    
width: 370px;.}..jcarousel-skin-tango .jcarousel-clip-vertical {.    h
eight: 245px;.    width: 75px;.}..jcarousel-skin-tango .jcarousel-item
 {.    height: 52px;.    margin-top: 2px;.    width: 80px;.}..jcarouse
l-skin-tango .jcarousel-item-horizontal {.    margin-left: 0;.    marg
in-right: 2px;.}..jcarousel-skin-tango .jcarousel-direction-rtl .jcaro
usel-item-horizontal {.    margin-left: 10px;.    margin-right: 0;.}..
jcarousel-skin-tango .jcarousel-item-vertical {.    margin-bottom: 10p
x;.}..jcarousel-skin-tango .jcarousel-item-placeholder {.    backgroun
d: none repeat scroll 0 0 #FFFFFF;.    color: #000000;.}..jcarousel-sk
in-tango .jcarousel-next-horizontal {.    background: url("images/next
-horizontal.png") no-repeat scroll 0 0 transparent;.    cursor: pointe
r;.    height: 52px;.    position: absolute;.    right: 2px;.    top: 
0;.    width: 20px;.}..jcarousel-skin-tango .jcarousel-direction-r
<<< skipped >>>

GET /knctr/js/swfobject.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:12 GMT
Content-Type: application/x-javascript
Content-Length: 25737
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*!.SWFObject v2.2 <hXXp://code.google.com/p/swfobject/> ..is re
leased under the MIT License <hXXp://VVV.opensource.org/licenses/mi
t-license.php> .*/..var swfobject = function() {....var UNDEF = "un
defined",...OBJECT = "object",...SHOCKWAVE_FLASH = "Shockwave Flash",.
..SHOCKWAVE_FLASH_AX = "ShockwaveFlash.ShockwaveFlash",...FLASH_MIME_T
YPE = "application/x-shockwave-flash",...EXPRESS_INSTALL_ID = "SWFObje
ctExprInst",...ON_READY_STATE_CHANGE = "onreadystatechange",......win 
= window,...doc = document,...nav = navigator,......plugin = false,...
domLoadFnArr = [main],...regObjArr = [],...objIdArr = [],...listenersA
rr = [],...storedAltContent,...storedAltContentId,...storedCallbackFn,
...storedCallbackObj,...isDomLoaded = false,...isExpressInstallActive 
= false,...dynamicStylesheet,...dynamicStylesheetMedia,...autoHideShow
 = true,..../* Centralized function for browser feature detection...- 
User agent string detection is only used when no good alternative is p
ossible...- Is executed directly for optimal performance..*/...ua = fu
nction() {...var w3cdom = typeof doc.getElementById != UNDEF && typeof
 doc.getElementsByTagName != UNDEF && typeof doc.createElement != UNDE
F,....u = nav.userAgent.toLowerCase(),....p = nav.platform.toLowerCase
(),....windows = p ? /win/.test(p) : /win/.test(u),....mac = p ? /mac/
.test(p) : /mac/.test(u),....webkit = /webkit/.test(u) ? parseFloat(u.
replace(/^.*webkit\/(\d (\.\d )?).*$/, "$1")) : false, // returns eith
er the webkit version or false if not webkit....ie = ! "\v1", // f
<<< skipped >>>

GET /knctr/right_banner.php?SYSTEM_ACCOUNT_KEY=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1 HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
49b..<html>..<head>...<script type='text/javascript'>
;....var googletag = googletag || {};....googletag.cmd = googletag.cmd
 || [];....(function() {....var gads = document.createElement('script'
);....gads.async = true;....gads.type = 'text/javascript';....var useS
SL = 'https:' == document.location.protocol;....gads.src = (useSSL ? '
https:' : 'http:')   ....'//VVV.googletagservices.com/tag/js/gpt.js';.
...var node = document.getElementsByTagName('script')[0];....node.pare
ntNode.insertBefore(gads, node);....})();....</script>.....<s
cript type='text/javascript'>....googletag.cmd.push(function() {...
.googletag.defineSlot('/282654509/knctrC_bigbox', [300, 250], 'div-gpt
-ad-1375898792374-0').addService(googletag.pubads());....googletag.pub
ads().enableSingleRequest();....googletag.enableServices();....});...&
lt;/script>..</head>..<body bgcolor="black" marginwidth="0
" marginheight="0" topmargin="0" bottommargin="0" leftmargin="0" right
margin="0">...<div id='div-gpt-ad-1375898792374-0' style='width:
300px; height:250px;'>....<script type='text/javascript'>....
.googletag.cmd.push(function() { googletag.display('div-gpt-ad-1375898
792374-0'); });....</script>...</div>..</body>.</
html>..0..HTTP/1.1 200 OK..Server: nginx/1.0.15..Date: Wed, 17 Dec 
2014 18:28:12 GMT..Content-Type: text/html..Transfer-Encoding: chunked
..Connection: keep-alive..X-Powered-By: PHP/5.3.3..49b..<html>..
<head>...<script type='text/javascript'>....var google
<<< skipped >>>

GET /knctr/images/dialpad/8.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:31 GMT
Content-Type: image/png
Content-Length: 2757
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......Q........5....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:B2B3D916E31911E1AE58EA9D2A
9A57F5" xmpMM:DocumentID="xmp.did:B2B3D917E31911E1AE58EA9D2A9A57F5">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B2B3D914E31911E1AE58
EA9D2A9A57F5" stRef:documentID="xmp.did:B2B3D915E31911E1AE58EA9D2A9A57
F5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.mV....;IDATx..XkL.W....E!.X.....Cy.h ""...%@
lc.T.."U....P*M.iA."....).........4X^AS..<.....".2,.v.]..;....d2.s.
g......n...eY.FR.........m..q.4..Od1!..*.....1..........hvv..{..)**..!
4\\\..2$.O..Q..;,,,//........U.V...zzz.FT.$..^..?...'.....k......DY..2
...vuu....v>|.pff.((eb...kjj6o..c...y......{..I...........i...[....
....j)^..%0.J5G:   9..y.&......C.L.............S.z.. W.......].~..vrr.
..y.B..hD._..3x,,,dT..8q..OOO....gss..c.`.}..I....d...7vYgg'.2h.......
....~$v.....].vi....-[......B{.z......`.. W"D.c.....g_.|).....G..L.F7o
..v.........0?vR__.&._w...w....R.SCO.../...='^....p$.j.X........rs
<<< skipped >>>

GET /knctr/sidebar.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: text/html
Content-Length: 2257
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xml
ns="hXXp://VVV.w3.org/1999/xhtml" xmlns:fb="hXXp://VVV.facebook.com/20
08/fbml" xmlns:og="hXXp://ogp.me/ns#">..<head>...<meta pro
perty="og:title" content="The most powerful app to hit your desktop" /
>...<meta property="og:description" content="KNCTR is a FREE ent
ertainment and communication desktop app that brings you amazing daily
 video including hot Hollywood gossip, news updates, technology & app 
insight, movie trailers, auto reviews, and daily exclusives!" />...
<meta property="og:url" content="hXXp://VVV.knctr.com" />...<
meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
;...<title>Menu</title>..</head>..<style type="te
xt/css">...body {margin:0; padding:0;}...#menuBG {....background:ur
l(images/sidebar_bg.png) no-repeat 0 0;....height:130px;....width:20px
;....margin:0px;....padding-top:9px;....}.......ul.menuBG {margin-top:
-2px;margin-left:-1px; padding:0; list-style:none; clear:both;}...  ..
.#menuBG li{overflow:hidden; text-indent:-9999px; float:left;}   ...#m
enuBG li a{width:21px; height:50px; display:block; margin:0px;}  ....#
menuBG li.help{width:21px; height:34px;}   ...#menuBG li.help a{backgr
ound:url(images/HelpBTN.png) no-repeat; background-position:0px 0px;} 
  ...#menuBG li.help a:hover{background-position:-21px 0px;}   ....#me
nuBG li.info{width:21px; height:34px;margin-top:5px;}   ...#menuBG
<<< skipped >>>

GET /knctr/images/dialpad/9.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2830
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......Q.....'..b....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:CF90E47AE31911E18FCD9ABA70
0B15CC" xmpMM:DocumentID="xmp.did:CF90E47BE31911E18FCD9ABA700B15CC">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CF90E478E31911E18FCD
9ABA700B15CC" stRef:documentID="xmp.did:CF90E479E31911E18FCD9ABA700B15
CC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.$.h....IDATx..XiLUG.>\. ..E...D.WZ....D\R
...D...b....u..&..6...j[-`Z7...X.(Q...V.."....,V."...}....{..?:...;w..
3g.3..............9.s....*..4..A/.)[email protected]_Bs.Z..g....g...t..UTT.
.[.h....s....W)............E)))[email protected]......)::....x,
??.$I.U.V.. W...."#I..W.XAyyy:......I.RQ@@.U!%%;.J...M........H...&.7l
&...4i.$.7.,..........{.2s...)rrr.}..i.?.../..c....7oX....4t..X..!..;w
..5k...e.....^.zE...4n.8viK4.y...FF.?!!!,....)&&.:::.......L.Q.<x.=
b..}....;......-.DpbGW.^.M..;.'.@xx8...?.........TTT$..n....%L....b...
.........!uH..#...Iy..9s.Y{)J.....%.....[..&.f.<y..l..Y...g..v.
<<< skipped >>>

GET /knctr/images/dialpad/0.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2942
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......W.............tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:1652BBD5E31A11E199B4FC082A
2E31E5" xmpMM:DocumentID="xmp.did:1652BBD6E31A11E199B4FC082A2E31E5">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1652BBD3E31A11E199B4
FC082A2E31E5" stRef:documentID="xmp.did:1652BBD4E31A11E199B4FC082A2E31
E5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.K......IDATx..X[L.W..fv..........RE)...M.S..
 <....<4...y...6$.C../%Z....'M#..&V....}.!^...*PA......f........
.=3;.9..r~!99Y.f......fff..%[email protected]..,C.e-...1...@0. :...0$.........0..e
.... .........{q..U...... ())a.{.^[n...x..*#.r....(//...Gq..q.........
....45.........0..V....p.rss......:.>|..s..i,_....m......fgg.!QQQ..
...../^...AG..S..i.w;.`:..U.....V.......}L......DFF"11Q..'?..D.[....(1
44........!I.6l...'.'.8...R.....w...U.`.&.@.....?..{...E.B....3...._..
...>...k......Y....m..#.~..rZ..9......<..l........K.L..I.%.F...x
..y&...b.......y}MM.&''M#.v....d3.p...wc...HKK...7....../.of.A.O..
<<< skipped >>>

GET /knctr/images/icons_bg.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 7371
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:DF22B4366A1711E1B9F399DC07
FCEE99" xmpMM:DocumentID="xmp.did:DF22B4376A1711E1B9F399DC07FCEE99">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DF22B4346A1711E1B9F3
99DC07FCEE99" stRef:documentID="xmp.did:DF22B4356A1711E1B9F399DC07FCEE
99"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.O.U...AIDATx...Y..Xv.I....R...YU]^J/..a..0.E
t?5.k1.x.mW...fq.%J... E.....(V....<...{.......o...a.........N.c{&g
t;w..m...b..........._W.1.}.x.w..@.<.....k>... ..#..._A.E.y...&=
^rj.........M7..8".|#..pq!.w0..Ys..t.a..|:.w.$8.p~...... .pgD...#v"...
;._D..9T.(.:.......[.u.FI'...M......e.M;a..r...!D...i.Fu..wa797......P
..8=}O...%..k.D?.>...N.#..vy......D.a.#&.E..I..!b_#.<.QO.]..=C..
...c..H..4M}..p.....J{#D=6G-.B...e.n../.......aB.9...5b....(......^.{.
S [email protected]%[email protected]:[email protected]....."
w..#....u...;. ....|..Ox....#..'..K...T#Z....C]v..`........B..X.*.
<<< skipped >>>

GET /knctr/images/dialpad/3.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2811
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......f.....>.:w....tEXtSoftware.Adobe ImageReadyq
.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:EE6861CAE31711E19E4AB42
2CFF350E6" xmpMM:DocumentID="xmp.did:EE6861CBE31711E19E4AB422CFF350E6"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE6861C8E31711E19
E4AB422CFF350E6" stRef:documentID="xmp.did:EE6861C9E31711E19E4AB422CFF
350E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>.8.....qIDATx..YkLTG.>... /..6!*.V.....
46...&....G. ...X["m(.hmM0m#&..DMjcR.....J...h[..S,[email protected]......~......{
.qI.v.....{.93..9..]ii.uzz.,...~jj...."..3....1./........OK...Q4....vw
w_.%&&.$.t:.)5........I..e.E..h......P....@[email protected]....$.T.. 6...1(
}........Ea..........{W...t.........K......h....Qss3.9s.M.`0..2.......
...t..ef..v.b.p.s....t.l....QN..X.p!...9.....^.xA..og....'..Wg. .....0
..7.|.....c.........DFFRSS.......`iYY......z........H........3s.HOee%.
.....m......@.}%$$.RSS. ...0....F.F...d..b9..p\[.~..1.....-[.w---...j.
."*.(..{7f.-...../_...w^{<...........{....0Y...............4...
<<< skipped >>>

GET /knctr/images/dialpad/5.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2397
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......Q........5....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:554067A5E31911E1B949E1F563
D4580B" xmpMM:DocumentID="xmp.did:554067A6E31911E1B949E1F563D4580B">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:554067A3E31911E1B949
E1F563D4580B" stRef:documentID="xmp.did:554067A4E31911E1B949E1F563D458
0B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.[.=....IDATx..XkH.W..........1..H,1P.Al.... 
H.$...%..G%P.h.n.B.._5$.bU...Z.@...&..5.4P...q]...v...~...8;w...i.....
.=..s.{.7...........h.../I...E.![[[h.v.r.D..M.xS`).K.8.....l6.. }}}QQQ
.....[.n...C.....L........k.6gggY.c..S`S###...J....=#)JMME..., ".....=
$$$...#G.....Wm...w...G.NLL@........\VV..~..t.....8....rOXX...g/_.....
../^@.l;.....\]hh.J..(.......^.JII...|..!:a;Y..$......`qQ.:Qcc#.....&.
3b...Xwzz.3. o..........5w.J...ZZZ...........'q{...Y.4.E............L.
u~~......<...D.}.w.^.....f.. ....)..*L._..<B..u:.P...... )u.8vgw
......c......MMM...555..(.K[...?.%%%....5.8.gw.......=.....d...]..
<<< skipped >>>

GET /knctr/images/dialpad/7.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: image/png
Content-Length: 3050
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......Q......>......tEXtSoftware.Adobe ImageReadyq
.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:971BB213E31911E1A946D6B
08C07A8D4" xmpMM:DocumentID="xmp.did:971BB214E31911E1A946D6B08C07A8D4"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:971BB211E31911E1A
946D6B08C07A8D4" stRef:documentID="xmp.did:971BB212E31911E1A946D6B08C0
7A8D4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>8......`IDATx..YkLTG.>.,.....M.D.jk*!6Z
,F.PS.F....U.......D#...?..._A...Kj}.(VQ..U#......Gy.".l.9.s......{..L
...s..7.1..............KKK.......K.V...FC.....Z{f..7o....0g......`0...
a.l..2<<.Zg..3..(...49.Z)../_.$.r.J.x..8..........,[.......^^^..
.........(  ...]..!\\\,...s..N............).(..B.,_........ .h.b..KJ.M
.......E.....Z[[e...T !.....MMM...k..U...`WZ.;.7......x....5.@...<.
.Uczgl.B......E .eB...A..3.....g..5...cD.....S6y..T3......y.....p.....
....vvvBFF.]hUA.hCBB......K.a...tuuAxx...8...;..S ..|[email protected].......
.O_RRR.].f..........}]]....U....G..........&$$..............233...
<<< skipped >>>

GET /knctr/images/icons_up.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: image/png
Content-Length: 2529
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......&........_....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:8340A8F46A1911E1850FA85090
3588E7" xmpMM:DocumentID="xmp.did:8340A8F56A1911E1850FA850903588E7">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8340A8F26A1911E1850F
A850903588E7" stRef:documentID="xmp.did:8340A8F36A1911E1850FA850903588
E7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..N....WIDATx..W[O\U....030.:3.R P.Z..Y.-...&
..I.l..}.........F.L.M........J.&}.....H.-7...af.....L.!V.Jv..s.^.Z..k
.5....8.N.\.dgg.....z....y#.|.v.e..;...l6.R)$....qD.Qlll`}}]F$...y...2
....*,,..T.......O....dR.........q=...p...)T]]-.b..(1.P.........d.....
......[ZZB...X[[..H..R9AH...Oe^QQ!F.N.....=...<.noo.544H,.=.."..4`z
z.........8y.$.....*6.F8g..>.p... ...*..{.....xu..}....r*....wj/jjj
PPP ..{..\kyk.z{{C.D .@ ....=z.....2.Aa|.!!}..........N`. 77W.........
......cAE..<...w...*.........Q......o...........P__/.....2..'..G...
.I.:....G..o.......o.....p...e.9TYX\\.]|RoUU.....5.o...e.qT..<Y
<<< skipped >>>

GET /knctr/images/icons_dwn.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: image/png
Content-Length: 2564
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......&........_....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:A57EF2A96A1911E1A834B21465
17DF6B" xmpMM:DocumentID="xmp.did:A57EF2AA6A1911E1A834B2146517DF6B">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A57EF2A76A1911E1A834
B2146517DF6B" stRef:documentID="xmp.did:A57EF2A86A1911E1A834B2146517DF
6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.......zIDATx..VKL\U.....a.<[email protected]
b#.....&...W]...q.tY.&..cj.....A ...TB...0.T...f.....{.h.m.=..........
......:....N'....v...x<j...t.\.99.].a...H$....h4.H$.p8.........m..!
....j../..q.....JQ*..c..VVV.&...J..\..)....hRAZ...).O..?......r||.....
W.............oZI..<@......~.......555...y& ....E__..........*K..@r
l...1LMM......B.hFnn.......s..z{{199...<.......2HO.`ZgjC...........
........T.......zU:.[.\m7..W..h.i.|.2.........R...;. W........|.b&k..t
(..i.fffJ.....A....k....8u.=......K.z...N.\...s...T..3.......d.....Q..
..(.wF ....7..?..---I.9.*d.k.........r.P....x....b..^ZZ..R.5   Cvv
<<< skipped >>>

GET /knctr/js/jquery-1.7.1.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: application/x-javascript
Content-Length: 257505
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*!.. * jQuery JavaScript Library v1.7.1.. * hXXp://jquery.com/.. *.. 
* Copyright 2011, John Resig.. * Dual licensed under the MIT or GPL Ve
rsion 2 licenses... * hXXp://jquery.org/license.. *.. * Includes Sizzl
e.js.. * hXXp://sizzlejs.com/.. * Copyright 2011, The Dojo Foundation.
. * Released under the MIT, BSD, and GPL Licenses... *.. * Date: Mon N
ov 21 21:11:03 2011 -0500.. */..(function( window, undefined ) {..// U
se the correct document accordingly with window argument (sandbox)..va
r document = window.document,...navigator = window.navigator,...locati
on = window.location;..var jQuery = (function() {..// Define a local c
opy of jQuery..var jQuery = function( selector, context ) {....// The 
jQuery object is actually just the init constructor 'enhanced'....retu
rn new jQuery.fn.init( selector, context, rootjQuery );...},...// Map 
over jQuery in case of overwrite..._jQuery = window.jQuery,...// Map o
ver the $ in case of overwrite..._$ = window.$,...// A central referen
ce to the root jQuery(document)...rootjQuery,...// A simple way to che
ck for HTML strings or ID strings...// Prioritize #id over <tag>
 to avoid XSS via location.hash (#9521)...quickExpr = /^(?:[^#<]*(&
lt;[\w\W] >)[^>]*$|#([\w\-]*)$)/,...// Check if a string has a n
on-whitespace character in it...rnotwhite = /\S/,...// Used for trimmi
ng whitespace...trimLeft = /^\s /,...trimRight = /\s $/,...// Match a 
standalone tag...rsingleTag = /^<(\w )\s*\/?>(?:<\/\1>)?$/
,...// JSON RegExp...rvalidchars = /^[\],:{}\s]*$/,...rvalidescape
<<< skipped >>>

GET /knctr/css/images/welcome_icon2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 14363
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...<...x......5......tEXtSoftware.Adobe ImageReadyq
.e<..7.IDATx.......u..........&....A.`0...A...HJ..D.eS...kK.....l.\
%[ViYZ.....E..L..E...H"..p0.&..s.....{....z...3 (.{.x.......s.9w.8..F.
...f.B.F.%..*#."DQ...y....M..-y..Z..f..PU.E..?L..d*...{e.N..zn..q...%K
r.n9>"..N..c....."B.........!..Gk.a$..}....L.>_L.f>T.M..L..G.
...I...,.fRQ...x.H.....8.....G.G....m...J..*.b........B0qK!... L7k....
y..F.v8.:.....\;..~...X...7B..XV.(..k.........q.....}]...eE...A0. .I2I
Z...=`..6...i.....?j7.B`.....R.$.X6.H"b%z'.5...q.!.,).#..e=...fYOJK.!}
)......ER......7.i.Ig.Y..FTY.....5....z0...q.WF...i.....8..E.HQI"h ..,
.PH..Y..".<.A.....Z[.f....\n.5.#=U.6..<.a...M01V...h.U..][p.7..(
.e..h.F.f....xh..ZA.....9.".. .C.JC.4$..)9.f.....TB2."...;A.V....J....
...........<[email protected] ...J~.k...Y.c"......c.W
=. .B.cRS.>5.tFMb@.".......D..........Kvf..l..-1F.....uK..U....6..?
<..}tm..f q{...a.b.ma. ..T..."..E.C...ia.6..$u.r.i...$A.}..0....F..
.P..a...X/..N..:.=.*.O..V....n..E....Z.....{. ........B..1c/c./...ug..
.............l.D>IX4...y(Y.Xr .....m\."}D......g..o.8:......&....K.
..j ....4....m.0u..k....K.<.$..F.3.Y.z....-7v.1.:....F.=b(..7;e...p
. J.{...n.....c..f..]2..}...i..6S.H..:.,m$.f..>4y.~..Jw.A.."Y...p.Y
@............:q..t..$...\..!/>.X.RDv.:.......TF......_}.$.....c..=i
.!.o...B.o.=8..z...wk.y'9Ny.[.d.......D....`..pYo6.M........,.8..E.}.q
2..7.q 5.'....r3.x....Q.b$.K.lnL..S.7.Y#A0.U......W...yg.J....K.....$.
....0t.K.5,U.0.:tM...&.vl.Y...;.1.Ma.T...e.J.3....}....$....|.K...
<<< skipped >>>

GET /knctr/css/images/social_icon2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 13761
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...<...x......5......tEXtSoftware.Adobe ImageReadyq
.e<..5cIDATx...i.d.u.x....=........h6.b#A..ARDH.d..EI.EI..r.1.g.a.m
.....Q.f.!.Zl)$.&..%[email protected]]{UV........^VgW/...y*q;.*.....s...s
..........o;...H...H.G.$....2.=........m..\ ..j[.eI..8'I..5E.k%.:6.x.8
.y,k....q.^.....oK.|;.US ....V..i.=cp.....n....4.;`...x...G...G.p!.D..
.d...>..d..HK..q.9.h._..X..,..Q....m....lMVY.Y..e..~>...[2r(.Eq.
..-]W.Q..;.x.nG..>.......".`...H...c...)..Tp43.Tu.`..w5UYTui ..).,.
...(...1...A.......D.....v7<...=I....X. :~Vf.d.I....(A).E..(#..}.1.
......ro.&.w.m...b.?...F0.:..]..dR........Z...I....O....T5B..'........
..qc.*....j&.4........pry.~j.8......G..*..E\...-...#.X.......]_...m..%
O;.%VA......L...........OGaRB>.0d2h....AY)@Y .fX...x.....\^ygr_....
.G..{.%..^......;.G...e.cK........J.....n.f..A.A.D..H..p"........(..{8
.R....j....&O.c.q.....<..l...G.&'..S<...e..J0...o.O,^.~...?.c...
..%......b4a(...1p...3..........1*d..a.V.;..*.6g.)c.`...|.......K...r.
..xa..'.8#..t...p....n.=Q..3...k.*...DQ.rP.."!...~..7I..x.........h..a
...3.O..U..3......Wx..Is...'xI..$...R.n....V...!=Y....~..x..A}...'....
.l.?.......N:....E.} ........0..?....{.]7......?Tu.6r...}.L...i......h
..5..Y.....p-\.;...(.<...vN<.....v..w..?B/O.Y ..p.........>v.
......jr..Z.......xG..k"2.V...Y.8.|.T..c.:...\."...z..D..r.Y..0D..@C7.
gD..Le...{..&B....r.%."%........7Z....9.L......=.rG..M\U_...f.y..?o...
[email protected]....(.....{0p.0..tM%Y.w.N2..s.>4....^w[.......A
Q.<........r.......dO..;.4.#gI.r.|w...R.C{*.....W.E.D.:.*.r....
<<< skipped >>>

GET /knctr/css/images/faq_icon2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:35 GMT
Content-Type: image/png
Content-Length: 12952
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...<...x......5......tEXtSoftware.Adobe ImageReadyq
.e<..2:IDATx..}y.\.q_..~3o..w..}.....AP..X............,;qR.U...]...
..*)'.....eGr..U.b[.e..%R.....`....{...f.}..{ovgq..........y.....}|...
$I.........q.......Q.C.'0.......uatG.:.........EQP. ....DE....^....7..
$..f.Lh;=7.X.I._..xV.."A.!L..........|.K..... P_k........C.....\. ../.
.c...E...$..4B0p...:...i&.!..H....r]...(.v.....&<....-.9.........H.
...} ...d...!...a...0Q.(..`..."..$...<5.udU..\.C.....a.uAd......"..
..Z.u.!MU..nx....,3.w.q%t.b.....9!.4.3).$.5^#fI.B.:B.D...J..*......#.z
.$]...K...P...4.q.Qg.b.... ....{.......| .f.4...........J...........|.
"...2...j/.....5k.jk................z...<A.[M02...~|..... ..n ..]aJ
..=J$..Q,...Zq..a.... !..H....%....d...DM*..iH.....%.v(..Z.....k#.;r..
.......j4......Q.&....XqO._.w%.0.D.A)....g.A..........-."Qj...B.b6....
./z... .......euL..4......V..g.kva......>...}.B..8u.fIR..^/y....dc.
..&.Q5..9./..5X...CB95....$...<xG..K.&D<~.}.~c.....{.I..M.......
<.yqb.~q....|EzJQ.fy........q.jE.X.h>hV.=y0.D..].[0..B ...X.x.$.
.I.....1.l9D.o...e.K.)..G...l.|.[5Y...I..='.f'....P.7..H3U.*.j......v3
9.........%X.V..B\=.Q.s.^g.8..^..$...~I.`\.....h.]...pOn.TI....l..85..
..d....J..W.E...L....f..G._...k&.T?w..W..,.2.0...4...M.I...."..c.^.D .
.xh......zp...0..;{..r...C?.........*.~-..E........Q...S|.........Q..)
N.t...........S..-@.$0..B...`.0z..G.Z/.t....].S..r..../.Y.............
....tJ.s']/.....FR..M...w..;..p....(.a..../.U.=..,.R49..........o....c
.6..-D....x.....j.....S#..|7..X ..n..!..7.X...0.$.9q...5.8z..q.tA.
<<< skipped >>>

GET /knctr/css/images/shadow3.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:35 GMT
Content-Type: image/png
Content-Length: 508
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...F..........W.&....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...Aj.@...$F<...*.o.iz......g..!i{......&i.B;~?<\$Y.
.7I.!i.4.|O....0`.......0....0`............0`............0`....F......
.0`....F...s..?z.U!.P/.....Ty.g.....5.4M...&..x...C..c.........5..6...
n.L.*........c.i.M.t..&..}...........8`F`.e421-0&...0`....09./x...s...
....t5.......8........0.U...X,.............,.,..d6.%......v..,..(..p8,
B.o.O....y..PG....l........1..[........0`...#`.......0`...0`.......0`.
...|.0....M...]....IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.0.15..Date
: Wed, 17 Dec 2014 18:28:35 GMT..Content-Type: image/png..Content-Leng
th: 508..Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT..Connection: kee
p-alive..Accept-Ranges: bytes...PNG........IHDR...F..........W.&....tE
XtSoftware.Adobe ImageReadyq.e<....IDATx...Aj.@...$F<...*.o.iz..
....g..!i{......&i.B;~?<\$Y..7I.!i.4.|O....0`.......0....0`........
....0`............0`....F.......0`....F...s..?z.U!.P/.....Ty.g.....5.4
M...&..x...C..c.........5..6...n.L.*........c.i.M.t..&..}...........8`
F`.e421-0&...0`....09./x...s.......t5.......8........0.U...X,.........
....,.,..d6.%......v..,..(..p8,B.o.O....y..PG....l........1..[........
0`...#`.......0`...0`.......0`....|.0....M...]....IEND.B`.....


GET /knctr/images/phone/sliderbg.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:56 GMT
Content-Type: image/png
Content-Length: 959
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...:...........,.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:87097394A5AE11E1A518EBF8DD
DB65AA" xmpMM:DocumentID="xmp.did:87097395A5AE11E1A518EBF8DDDB65AA">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:87097392A5AE11E1A518
EBF8DDDB65AA" stRef:documentID="xmp.did:87097393A5AE11E1A518EBF8DDDB65
AA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>}......5IDATx.b.....0....O.Y~...0...#''....o.
.I3......p.,@....l.8.m7.....IEND.B`...



GET /thumbnail/celebrity/SPL914146.jpg HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:18 GMT
Content-Type: image/jpeg
Content-Length: 19386
Last-Modified: Wed, 17 Dec 2014 12:05:06 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
.................................."").................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
......L.{....1?.5c.^.z.{Eu.L.?....`..`[email protected]......)qP.....IHM(...C .4.
j..M"..i.....4.M.q....c>..D}h....=i..Z...Z.F}i.....T;H.K.....(..V./
[email protected]/.&.*[email protected]...\.S........E....E/..D!..Df.......a4..R.
.\3KL......j.i2....4.i.5.4.v...M.E/.ij.....Z...w.KR..I....6.=0.>.F.
L.O.)j...........RPRR...fZz......./.;.Z..qsF.L2/.0.. .n4.5_}H.........
....E..y.!.Fv...K.w...o...;.4.F....0P.1<...jp...H..J>A.#.Z.1.m.I
.R.z..H.0..h..h.b.0'....B.Oq...%..V......-;}C..d.....R....h....\.S<
..O.M7.4h......g.I..F.vK..p.Ub....,...7.7.`.....][email protected](..
4..J8.F...\.p.....M.-7....P......j.....p.XBE'.Gz...J...R.#......T.'."a
%<Jj...naE...6.3...q..E.[..c.......R...._..[...O.8H}.1.n>.noJUl.
[email protected].........'..............>..;...JM..s.I.....4..(...E..[M.MMFE .
.r.Q0qWx..h.r.L.)....J{S|..t.Vge.(.kG._Jv.(..S?........<.J...Q..R.z
.... ...R..)r.o.a......q......aM2-;..dj.R.4.5i.`4j;!....g.I....E...N..
K.{R...j-....Z...<..dV......uc".[.....u=IL]....)7.@..}*2..iV.i.
<<< skipped >>>

GET /thumbnail/celebrity/SPL914123.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:18 GMT
Content-Type: image/jpeg
Content-Length: 17940
Last-Modified: Wed, 17 Dec 2014 11:35:07 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?......jNk......Sik#q....-Y.5  3SC.Vjh4.\/Qo...I.A{}...jv...........`
5.....V&...TE...5D2M.2.S.....j..Yy...Z67...Hz.=".k...VHz....0.2.X.JU..
..uq>kj3\....X.!...i...2...Jj3L.....j.....9f. .........s...z..\...$
....bt......G-k.-cp.M.HMW.SY.C......*..Y..E.H.%.S7....Q...cE.tK..vk-.[
......%E../Y6l.cv)...z..Av/.*3%R...M.[.Z.5g.d..1...3f#ZB......8..(..!E
.P.E.P.E.P ..(....Q...e.X3.....Jj.H..D.ZrV,...O4...V.U.i...{mFV.lQ...e
..U.FM@jb).h.X...h..q.;.....)]...4UD...R.=k........ ./.`.?#u.....:..}-
.....Mh..c*...>C".&.....?..k..~c...i.I....Z........~........uH.....
...........o.....>....?..f......M^.._R.bi_..k..~..)..ZO..Z....K....
...l.".5..............G..............?n.3.-..u....U...:Y.?..5(.....1..
}../f...x.g..=iI....6.........6....6.....o. ..../b*.k........,......U7
..N.........T.....#..H...lW...M?............4..n.....Ui..D.E.g..h.k...
....,.......R.. ..........ms.u.x..^G.^...[J...R......w.#.g.%....Y.....
............i....../.#z........G -...r.?.9............?....=e.....
<<< skipped >>>

GET /thumbnail/celebrity/SPL913611.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:19 GMT
Content-Type: image/jpeg
Content-Length: 20927
Last-Modified: Tue, 16 Dec 2014 17:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...N.WBS.Vv=uP...R.v.m.a.C7eN....B.a:.m..Z..Q..B..V.........9Om;m\.N
.E.....[kL.G.....v....)vR......kGe.]...3...Eo2Vd.L.s..V...y...V...c...
...e#..#...U...R*........[Xk]a.K.M......GV.*..P..Dh.yE4........4..1..$
.....\......T....3....5.i.b...5P..Z...5d...`....;5W4...b.Q...Y.IV...y 
9..d...Z.#'"...d.O35r6.icXH....u........r...mYT..Qa....1V.R...2...U...
h.r.)qV......(.I......_9..b.....O9Cm8-^...] ... U.ks......hk.N.-4...y.
..E.=.X9...U7...9...Po.}...E3......_95:.o.o..bjLT[....8.S....A.a...].8
.1E...t.......0.\.):.=".]<..\[email protected]....".mYZ......s.[8...9.Y2.Q E#..
xj........".....(O......Yv.....u`%t_....y..g................Yve.G.0v..
Y...Z<...yn.....\...=..?.H....-.4.........h.G].M....o......./......
....'.=..<..)8.GQ..Z...X.K...3.......}....iY.e.=..R&.j.6W...7....Q.
K........Qg.w]...X.l.i...........6....)......,V...V. Z.............-..
.. B.*QA....T.-..U.....=i.Z.F.M.=j&aTE.].*G.r.........V[.S.k%.l..-.d..
5..y...].H...t...-.u0.Es...h%E.[..9..f..Q....E3.9...8.R.E..&)qKN..
<<< skipped >>>

GET /thumbnail/celebrity/SPL912901.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:19 GMT
Content-Type: image/jpeg
Content-Length: 16488
Last-Modified: Mon, 15 Dec 2014 20:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...R.S.2? ...I.B.[Y..,R..;v.....6e*.'Z.......M..|.%.....,O.zn.g.M14.
32..W.........^..gY.....P.,......tO ..=....]i...~~.9..</y<I&..2.
......]. [email protected]..}.b....2J..v)l.<.....g..^....H...;.x.=F
q... if..E,......%..*]..\...;......0..M\........2.N.W^..S.T.".lx.....*
U.3%......R.P.E.P.QE..W..(G..7.........{..7.#A.... ..X.Y.o.q<.V.:}.
....r.Tn..^..K1offp.\?....O..U..|Si.n..B....'....}.>ME.W.... v ..a.
.~....n...9...]Ax.aO.h.....y.r..3.{t..h..F5KC6|....v.9. ....F.y.m..o2u
.p...*...u9).1y.....a.h..f................t1kzu...1..y..\.en...b..b.#.
......}..]...p..-...#..& ......O..)..kH..%.:....V.......].............
.....W..e5[<........j.....e*.%;:..9..-...l.N...L.w6..!.n#.@F.....'.
.. m.r.....W.%...h.cE~..9#...Q..5[O....SU......}K..Q..S:E.@..$.`...f..
t;.6;..F#..\.X.>P:../.d.-P2;!.G....\...yt.\.....x....7........;..p@
?..?..>....\....#.......?...X....5....L..y&O......~...2.U..!&..G...
'8.k..lEo..<K..A.?...R...#.~......%..mz...{YmW.W`Y@$.....c._..?
<<< skipped >>>

GET /thumbnail/celebrity/SPL912904.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:19 GMT
Content-Type: image/jpeg
Content-Length: 12407
Last-Modified: Mon, 15 Dec 2014 19:35:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
....o..'.)...C..<........J=.....O....R.;.....q..9...(...E$.FM.)i(..
[email protected]@[email protected]%-..RR..E%..QE..R.R..E.P.E%-...xCJMOR.....gpz.~U....\U}.
.m?..Y.a..r....x_....CG.../.^.j......z..F 2........A.../.r.....y..C...
.B..YH...u..Er..IW.1.?O.*....@.^.yZ6.TH.J~)..J(...(...([email protected]@..QH.
....(...(......(...(...).QE..J)h.....)..m>[email protected]...(..@-%.S.i(..
..J(..RQ@[email protected]@..QL.....ZJJ(........;g...... .......k..x.....acEE.(
.xw..>..It...N?...?%..z..C15......c...>.......R.T..pG....;....6@
..n}k....K.YG.b.3...e  ..r%..@[email protected]'...ZQ......8..\.:.$hTgy>.j..
.0=k.....s.>.c....1..v..:.9...f<[.......9.._....;nv..|.....$...w
..9......\.t.$E3....Y...S..[..W.......S.d.d.Ou*pj:..Z)(....(...(.)h...
JZJ.-%.P0..(...).QE..QE..(...(...))h..........(....).}%6...IIE .4SsI.`
>..3E!....)..)[email protected].@?4f..&h.\.....h.L..)sL..ni)..C.N...}&....k
a..-$P..9c.f.3......G.....3z......q].j.(.U.aT.......^.ai-...\.Oa....y.
.....1......f.z0..W.=O...W...Ms)........T..o.f.........VE....>.
<<< skipped >>>

GET /thumbnail/celebrity/SPL912882.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:19 GMT
Content-Type: image/jpeg
Content-Length: 18794
Last-Modified: Mon, 15 Dec 2014 19:05:17 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.ii....r.....P.(.d.~.0 .....J. .8.i.9 ....R.........`.}).%n......Mm,.U
...ZZ...../.x.. .^ij4.UG......Op..8....?:...)...~tn...\Z)h.bQKE.%.....
....E.......E...:..\....W2...4mr...x#.sZ..o.-..L........14...}.d..VU..
....c.UHu.$`..y..P.M....X.1. .o.u7...zTfX........u..QM.=E:..))h..EU...
.7..W.Mf...9..jy...7(.y..1[i.s....W......)v.`(.Asj.....Y\.........tG.h
..s7t.dI.<.8....O.}1._..."..f.B".3>.t............>..KO..b.K..
J.VN.@..[....U.....~0.L.Dc..X<Ic<.Y-.=....^.s9g%)6..gUJk#P..V../
....\.....N.ge....Fi..#.;.Z.g.%.8&.D..-.tZN.u..R.0.q....a..t....W.....
[email protected] S......E.....#.;.M&.?.y
.8......go.v...Z......j..[~P..a.G.T7h%..E.V....EC...c...T<..7b.QN._
.r.F...~.$o..D..{....mG.(]...cF.q]0......H..X...S....v,{....6..0...t.#
'{......D..t\)....{[7....$......v......c...*.9.f..c...9Ci.e...'...3...
G.#..`...oJ.nn...t.......h7v...rdQ..S..4.....h.sW..E..c.....8....uws.Z
..v.GRj...<.1/W...Y.....m  .'....G.PqNP..e.s..I...{.S..g..<.
<<< skipped >>>

GET /thumbnail/celebrity/SPL911203.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:20 GMT
Content-Type: image/jpeg
Content-Length: 17507
Last-Modified: Mon, 15 Dec 2014 17:05:11 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
.................................."").................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..h..zE.KN......)..R...0..v(..%..R....ZZZ.LR..1@. ....Tu.f.9.j-...\..c
.}P.d.Cm.J.......F.y.VR...b.U..W3.:..U.....j...R...;..93..R.g.W[.q.G..
...\.'...Q...u....B)s...T.~..5.........sZ.fS.r..j.5-.{MVF..B..q.Y....$
9....7.S.)..)....6.v([email protected]%0..Z1H..K.1@.%.([email protected]@.......:
.....W_j8...........i..i...-A....,.l.f....m.Bb..TDUs...&*.$\V..ZQ.>
fW*9{....f..Wz:./8...sze#IN....KKKZ....P.QKK.`6...b..E;.b...S.K@...)qK
..LQ.v).3H..*...%R.Vs....".[Q.....[.I..h..y...?./.....jM....U:.....Z..
k.O........&..,.t...v.....u...W...b......R.^x<[w..G....?. .?....?..
.T.5./...)..q........D...........u3.Q.....^.. ..............UI.pg.:...
...".GZ.[......W.un......a.G_2.5.u.F..[.../.TF.....j._U}.~?.L..}..Ax.k
..V...<.j.....*I.....t%c'8...J...P.K.9..c&&.lW..i.......*...M....1.
..I3\..l..}k...V....f7.N)qM.ia..........~G.&...b.E..M..I.'.DE7.c.I..i.
/....9=j3...o.....4....o..... %[email protected] ,}.=.7.i..U....v.../.O
.L7.....L.f*y..1]._n.~5n.-.....1U.t.i).U..S..-...m.6......6.. ..~.
<<< skipped >>>

GET /thumbnail/celebrity/SPL912835.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:20 GMT
Content-Type: image/jpeg
Content-Length: 14515
Last-Modified: Mon, 15 Dec 2014 18:35:10 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
...ST1.....t.5....`Q....kL...........Z.1.TsS........T......4..5D..L&..
...Q...E!.........WK\....H...t5...Zm..u...........0.KM..j.....}...\~..
fX...g#.D..*........Q...?.L-...h...$..s.t..".O..9..n...,IIM.G%...[..q.
..}i.Vld.......{.O8.E.6..4`.....<...T...0.O..j}._.......|..FQO..e.f
}J..V.Fbv.........Bn............?....%....C.....UZ....O.Q4...^.E.S..QE
..RQ@.......&i.......t.0......>gQ.Z...!...;.**.%[email protected]@[email protected]
[email protected]..:.\b....f...z.q7.4.Ui.......j"r. .{.{6j.[Æ..N.....f*
lTmT...,i.j.5P.jf...nh..h.....B...(.4..-....kj......MlVR..--6..b..T..&
lt;.............?..U..v....Y....v.Uf..$.."...[[email protected]....
...qK..(...T%.y..Q.w....$............I....:.*.?J.IJ.b.q..bg...7z...an.
..B..X.....#.S...J...8^..../..[<.)...l..=...AZ...s......~..*0..'.5p
y..#..,..."[email protected]:.N..#..uj .}..f..|....m.?....A/...~?.V..;..Y
..8..H,V.iD.Y...Ao..c......c.3..u.3...8.S..`I.f..#pV....n'....z.......
...{...Vi%{h.Z......{.f.4..KS ..5..f...u0.E..M.HZ..M....IF).......
<<< skipped >>>

GET /thumbnail/celebrity/SPL911121.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:20 GMT
Content-Type: image/jpeg
Content-Length: 24443
Last-Modified: Mon, 15 Dec 2014 15:05:12 GMT
Connection: keep-alive
Accept-Ranges: bytes
q..%....~......"`.H?......?.....W...v..p=.....@.{.7t..I...I..?.%.[.s..
.5... ..'..b=3\u..."H.k....U.......9.........3..%8.s...0a=q...8.Yw.*..
.........w..v.Z...a..........^.NH...........#C....o|w.f.h|...".{.s.M..
.....?.!.[.n.....>^..k...y....s.G]M..n$t....Gi)h..@,x..}...^r..0...
-5..f22...T.1c...5.r.y.6f..$(...x..z....?*........T.fw.....~..U2.....l
Wb.s].Q.^4...z..c....5F.......~.U....T%.Kfl.1..S..5.Z.S......F..U...u.
#..(.=....J.n...z7....t.e.&....).../.7.....z........L.D. `.p\.?.I.....
 ..f...G....g......3....^<rK...."q...X.....J.-_K....i..,h..<3...
..oA^.MCeG...=G......q.y.....:V(.....4.1*xn..C.O..UI..RO.Q........}...
.k..9.)(.......(...ZJZ.J)h..........n.f}.!....fU.F.s.zK...P....I..4...
.nI..N.M..5........C6:.....9=.^.\....f..o.........)ncWdq..;T..?...U...
.=.....6.......r....:.....].....|T..F..:..O.}i.8.g..u99..N).Y.H.~b....
.^....T2........G.2z2........J..=.......9......q................v.....
..J...Ge....6.y.,.......3........w...c...2:vc..|...........|....<..
..l.....]...... ..6}..3..s......o..kV......}..p..q........1S...[.u.8,.
N{......DJ..s..q..L.=q6.G..?)...l.f.....{u89.E......g ..p... .........
lW..P.,[email protected]...=X7...r..J..:..V.`h.rD..F...#.2.: z..kVk.Il.X
.t.Hû....}{z.n...0T?..*...]......DF.X.9Vc...q....w#.....t...B.bb..nw
G($`..!.g.v&..Y..S<..2F..J.<d.Q.~U..Cn.....r..;.......z..(..2..d
a......*.e.&....j...2H6.....d.?.D.. ........U.wU.x.h..........=Mk.b..'
..n2..hY.z..:..G.....zV..Cg.@?....2.l(.Ui.p..=k.;.X..q.v...$..U.....FO
4...F.....>.S.m.X...h..4...j.. 8t........O.W.m..h~....orq...Q.*
<<< skipped >>>

GET /thumbnail/celebrity/SPL911120.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:20 GMT
Content-Type: image/jpeg
Content-Length: 14000
Last-Modified: Fri, 12 Dec 2014 19:35:16 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
.................................."").................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
...SG.........b.=F;..`^\.r..........s..<zq[zv.i.F....C..N.8.B.I!...
k.....)...Z...d.T../............>...........B.q...N*....d...]..u.7n
Q....d.=q...r.^..OIY...z$.I.H...F........Q. .. ...V......}.stS.#?.'.%&
.e..B}A....(.....s..2}[email protected].[l....d)M...;....V.v....v.%..Q...
...G..e..e{]$..y\....:.............7u.. U..x.dC...R:.:....Gs.......&..
>A..B_..wln....:......x............v..~j.f...:...o'........\!.[..F.
....y.H...`..=E.~..#...w....|...g....F.....J.[.....I6.......5.tz-.Mow.
:.R.~H..y1...G.{..%5.e. ..].a.$..F....,.}...I..<.....kHk...Vr.tETX.
......MB;..]F#.o-.e@..[[email protected]..#.nI.L.."QKIL..(
...([email protected]^}E..OS......^.....eB.
=A..|.....K...........A..<.A!.K6.S..P.T.x#.MJk.....'........c..,.&g
t;....T...4%....?E......v.m..J..I2.3!\........T77.a.....?.i7.U....d...
..g...T......6z<.Ot..D.Sj..X...`i.=.........%.....q..PYX.}t....$%Wq
.......K..vKC...z(....E.-P..iC.WG.....g.Dx.X.......D.sU.f.nM...8Ul
<<< skipped >>>

GET /thumbnail/celebrity/SPL911075.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 19949
Last-Modified: Fri, 12 Dec 2014 18:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.;.."T~A..=..d{B.<....c...K.Gqk ..t._..q..N..cv.U..e..X._..d.h3..;.
...(8#>.~.e..Ta..B:.G"..-..7..p.....kEt.*.... ~.J....e...s......t..
S..{VsG..m.........-r.1.R.....kZap.4`..g$...z...Ai.....3..5.....gr?.w.
Z......~.hj..y....`q..I..DF7...{.MU(.60..*.......".!.|.....f ..*.'....
..%.{.....9.p:..S..O.....i.Dp.V..?Q..{UO.-4....m..d..Z..\.!_.F7..?...l
.......PB.-.k..y...BnK^.An.L0.g.1...h..J...z...|..8....io./Fg../..n3Ok
w...G..'......c,.e$.<.....>...l..j..H.....:d.9....Y..mv.S.g.V...
...SS5.....5..hYy..]...#......U.o...v...,32..c.9*B..lr..z.5....=W.w..[
?d2Zy.....cG2 .p.....8....WP.%..c....L.;.{...E|m*..'....7..f........p8
..O.F.......v.E..n#..-.OC...`P.=. ..q.....~O.sY{......r...............
.~..v....:...r.X'...Q...........j.1.'.....(..\.-.....-......~..9..m...
=.6...#.].D.,. t...^.I.q...t...T..S..^.....3.I..ZG....Il.#.....Z..)..u
...PH......4..F ...9E...{..I>...A).....;..c4...9$......&.Z4.....%z*
w...G....v.E.S..(.....(...)..QE..(....QL..(...(...(..QN$`.@q@...{.
<<< skipped >>>

GET /thumbnail/celebrity/SPL910865.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 15510
Last-Modified: Fri, 12 Dec 2014 10:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
.................................."").................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..(...(...Z.<.h.....)[email protected]...,.(..f.uO)..l../y..-
S.Fh..c....*"...U$sN.....x..I.f..J.i..)........V\,......:..b..s....`..
z..U.......}....ASf.3Nh...7...5sK../....*q.Z..?.......k.._y.).q..F.h..
...jO.Im.....#.i.O..V..#bhsX..i..kn.J......x.....kZ(....?.Eia"...S..#t
....C.*._....`~?.j.&?....2&.@....?.*?0...2.".w...M[.qU..v..9..Y.J._r.&
gt;.f.-HY..FcS.Q.c)[email protected]...)p=(._4.b........Z....ip..
[email protected].(............B.n....4...QHAE.P.E.P.E.P.E.S...(.h..@U.
.).(.........9..<..QU.S...A$8../..,t......_.*.Ni.......F....E8.m .n
y.:..|[email protected]@[email protected]%[email protected]..[..^=...3..0..q.).
4.t....j/..AP.g.2...e>.( .p.g..4h..6:[email protected]%-.-.RP..
..........)i.Jd.v.M.|...ii(.!h...(...(...(...(..`[email protected][email protected]
j'..B1VK...[.. .C5.ni.^aU.y.... ...Ux.....*.........U ..0..QMu....RR..
KIWl`Y..t.8....*l..Bx....sM._b....j."..2s.. ...SW:s..L....R.y.%.k....c
x.... g..V..[. .[..>..K...wS....1.|.0.y......s...dq.#.hS..Iss/.
<<< skipped >>>

GET /thumbnail/celebrity/SPL910341.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 18407
Last-Modified: Thu, 11 Dec 2014 19:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...Z....K..Mp.g.....t.1.......P....#:L.......7..:L.. ....S.|...R.;r.
.."W....)?.....5..y..y..V..t#..I.].e.Cu........&....h...............\.
]........G....R....U....\.I....>../e.9.....&[....e(w3m.r>`*..../
.7......~..V...........Iv..R.W.....b...:.r<jc(.(H-...c..&...p..^...
..1yn?..r@..||... .4.J.S....8d?y....=.j0R...H;.......O..j:..>@..O..
g.;.P=.....Ft......*/.....G......3....#..T<.s.[.e......_#...)...IE.
-.Q@.!.....]......$...:}.Q.W0<5....|..r?-.oR..."..e.|.p....7~...0..
.".)P.......vo..(.\....".......?....Y..6..=.......A V.."....uM.{......
.r.6..&f.##......8..p.Rn..."...cdwC. .x....}6H.*......x._M...=E,.&[...
.BP.1-.....{V..frN....y......p.R..,..$...$..j..6.m..:b....].s..A.$m.i.
.....R.i......E.C....OS......}...S.Ru...5O5j....UU..h.....4.e.....j ..
.^.hB..1...K...%G.......J.......]E..zU.....M.[I...x........Ma..2...%0.
.....9*..E......X.uYnf..tL.o.i.{.<....[.....2.ij.:.......V...q.M{9.
.2y...q.u.w.\...T.g.j.........E...`.].T0..z..(....5.....Oy....y#..
<<< skipped >>>

GET /thumbnail/celebrity/SPL909652.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 13389
Last-Modified: Thu, 11 Dec 2014 15:35:07 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..(.....(.........sP.D.).P..=g.\.6..)..j.)...`...-M.BZ..I...SEJ)...Z(.
...nj.Za.4.i...1..g..\....b.g:U..s....mWr.z.T.'...S.($JZnh......W. ..Z
NIn4.X.d.w1.q....<.:...z.{~...k..BO..U.:.^H..;n%.......'$.. .c...{.
....K......rNMJV.r>._\T.d.x...?....Oa.E...~..j.%.'.l.?.Q`/.&.?_....
.?qO........#.&........S.. U....X.. .?.V........M../.>r.r>...v.e
...=3.?.z..||.._Q[V......"..v!.=.~G.....5.zN....S...=...E.C).5...z....
='?J)kB....v.RBB..R......'..q.,......Q_0^.]..I.....XU...wf{T..j...H.CK
Hi...i.L. ...T"....EN*.S.....T"...L*u...Zb..iB 1 ^..K=".(...(...))i(..
.j..w..E) 6J...$.Y.....%5.-c.X.Q f.Z....#B...1EIL..4..c..a4..&..-Q....
.S..|>s.Z.....V.s..9.......j...| ..e.K..%.....)..A4..5..N.H.t.rpG.\
e... .....Q2...OST.7t.z...L|..O.....X..2.B.c...Gt..........4.94....MUb
......:Yv.........:..Z............ /.)..V..p.z.....q...Dg.Mb.........*
.......=....v.O.nX..AY.ns...=...5;.bM..j.Oz{6..9n....y).....*H.....s..
.o1:..rkx`0q.\n.....Xe.>........4=.. .F._.F.A..G..2.]......F."y
<<< skipped >>>

GET /thumbnail/celebrity/SPL910181.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 17754
Last-Modified: Thu, 11 Dec 2014 13:05:06 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...h....R..E...)h...u6.L..(.......Z(...(...(...(...Z(.)..I@.%.......
c......I.e..k..Es.....1.........Q..iXw:H..x...<7>.i..\D.&.)V$mb.
......k..u.....Q._:2....|?(.......g....../..?#.....T.>trd....]...?.
.......:.............Ub9...\..n&.^......M.F..P....[....?..3r<..4. .
..l{............<..{......P...V:..../.t...-....?...<'....?.....6
es#....89.y...........je...../..4..$y].8.v0..v....D....pi......o..Q...
.:...._........w.}........j.I..We.._..?6...w.m......N.qTf...[......d..
..1..."....=i2=Ew.e....1...".....(.......w...=E&.. ......8.......w....
O.... ..{....=Ez?..._..R._...P.......I............].........6..E.P.RR.
P.E.P..QE......)h....([email protected].{x.^......?v......n.J.%..Fk..!
...q...#.)>....O..R...J.......<....%...J9.c.....[...5.....v....~
m.4s..1Et.b....<..I..........2..............G. .........%t.......}S
..a=.......]..,.V4..].i.7....}..&.?....-....'...E......,.....V.../.#..
.......Z.........R.G..f....k.?...................C.....\...o.....t
<<< skipped >>>

GET /thumbnail/celebrity/SPL909578.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:22 GMT
Content-Type: image/jpeg
Content-Length: 17830
Last-Modified: Wed, 10 Dec 2014 20:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...O..O..p......&.2<...z......)...=.Z.........L......^M...2.. ..J
z...t...I$.....<1.{.z.j:Jut..E.R....C.i...fo...^]%..3.A.....L>E.
.zF...\'...G.....o.`.gMGe..<.P...w.C......J.m...(..GU..ns%..Q..U...
...T..N.*}...k.;->..%.$Q...$..\..... .(...@. ...........1J.R......R
U..UX.n-`..x..............bA......S.(..B.(....Q@..(..E.P0..(.QE..QE..(
..`.QP.*A..!...1.......<...4...~.......b......_.e..s...\v<....C.
[email protected]{......R4g>.....A...x...X.^#...a.m..=A.p..QY
R]1..,AK...f..R.G..I....Hl...l.....N......l.X.]<.rM...e....f.......
[M.NG.m...n....0..Ea..4..fKH..]..w.....4..:8s ...#..6;[email protected]
E..QE..QE..QE..QE...........'.....p..Z.....O`{3....R..k...;.'..O.M|.P.
.v.(...P......4....]...Z.......Wr.&q.IIv..=[.#..'...f..Yw..y`....Z~.q.
w...U?.5.7s...d?...Gy?1.w.]....{o.e...1.o.sM..M........Mhk...&..aG.U.O
D....f..G......G.j.t........[q......A^H.A.j...?*.o.H[R..Qq^.^!. VK....
"m..K....a.u:.kSC C"H....}A.(..... S.T.YP.......zW9.{..F8#..8V,.`&
<<< skipped >>>

GET /thumbnail/celebrity/SPL909460.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:22 GMT
Content-Type: image/jpeg
Content-Length: 15701
Last-Modified: Wed, 10 Dec 2014 18:05:28 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...4..P..H.:.0.M..}r.H.wS...z..g j..Y\..la...'M.3.P..]....}.K.....{.
&h.'.@.) `........Q......0....?..R...N?.\.......c;I.z/.P....,..5....zE
.._:".... .. ...;.....3..} .........~..h]..g .v#..s...)i..Zn.>.,..*
..y.q....tIt./|.'.H.A.^.../...a...o^z...j..n...# ....<~.\...V..S...
2<K#.*ew......i..:...qTG(..;....k.&.a._.g"4.^...b.L.D........S..q.w
...<...Q[.,.is.Kch.V..V...g...p......Wm.u....g.....~.nO$.......iX4.
Dx....S..)f..L....f..6...g...._.....dZq.S..;[email protected].;..H....q.4.=3.Us
7.'H....4...T.\=../..u5.D`..i..[....!=.......&.7.g'q.QEY.Q....hJ(..AE.
P .....j.....|.pDs`..I..G.[(.U.a 7.=O....wD..'....\..dK(o/_.,".......4
.o.^G.......D...t........U...........D.....vg.Q.....0.=...e..........i
6..M.....r...(.8.&..Y...;].e\L.i...z.z..o/.)..|~r.........K...)..=_.M.
z.......3o......j..f.uS.c......b..<.v.{OS.>..u<..t./.........
.c.....1...>.e.....m.-Z.M..@T)B....q.s.> .hY....J..q...*.......3
o......SE7......_..... ..Ws=....GL!?).;......_Z .f.O..5.x.~.......
<<< skipped >>>


GET /simgad/776638438837976361 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pagead2.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Fri, 08 Mar 2013 21:21:11 GMT
Date: Wed, 17 Dec 2014 10:25:34 GMT
Expires: Thu, 17 Dec 2015 10:25:34 GMT
Access-Control-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 68158
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 28959
Alternate-Protocol: 80:quic,p=0.002
......Exif..II*.................Ducky.......d......Adobe.d............
......................................................................
.................................................................,....
......................................................................
........................!.1a...AQ..q...."...2B.#..R.3C$.b.4.%E...Fr.c.
DT..5Uuf.Ss...dt....&'7g(..........................!1.AQ..aq."2.......
..BRb#.....3C..r.Sc..$.s..4DTd......%.t...Ueu6v8............?..0.pq.B.
....8K.^........%6....7g....O-8[R....' ..........u....?-8i4V@(...^..i.
i..z...-...G..~_W..N.YJ.....wS...`'..4......@8).&...{yp..J.R{......oEe
..}.<%-f.{.v....QY....|..qEe..x...n.Ef*~...8m.....@.|..B..X.T`..h..
....c$..Rs.........H{G.`.............P..bM...#[email protected]......=;..x
.Z..............M! Q...........4.h....t.7o...N1.'..E."b#..^......4.6T.
~.....&...D...0..N.7.y...eE.....%.zA.4(._.._G=4....}.._..k......_.O...
.....O...<M:5.....RC....Z.{.^...^.m...4..P........oL.i.#......k...Z
.....<.>.`.....o=x.M...[....C.M..^.}.k....T..uU!..{ ............
.o....|.......W.9....`.....G^.P...p.....4..t.......V..i..9Y.......S}$.
...z....b<IT...B...N,..%.x..F.]l.EE.DSn..-....G......._.}o......,..
..2zR..32y22$f."...g...9.......\L\N....R(..P..(.G/ .....=.=ZjA....D4..
.......n..$.9.@...._g..~T.......h..9s.i......r.^....on.o....>.v....
...=......^.8PxR....... .N...y.q.. ..|km...g.Fu.|J.n.f....VQr..A.1:..2
.Un..L.UR...w...k..g..c.k.}.....$...,........zo....:~..B0.:.o..2..m...
.\..$.....-,.<@.XK.......J.A.c..%...a..e.p'....&d.B.".).G.EE9.k
<<< skipped >>>

GET /simgad/9975433107761106746 HTTP/1.1


Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pagead2.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Fri, 08 Mar 2013 21:24:26 GMT
Date: Wed, 17 Dec 2014 10:23:19 GMT
Expires: Thu, 17 Dec 2015 10:23:19 GMT
Access-Control-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 49269
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 29113
Alternate-Protocol: 80:quic,p=0.002
......Exif..II*.................Ducky.......d......Adobe.d............
......................................................................
...............................................................Z......
......................................................................
........................!1..AQa.....q.....".2b..BR..#4T.5..3$...Ccde6F
'.(.r.S..ïG8*.........................!1.AQ"..aq2...#......B.T.Rbr..
.3..$4.....C%u..S.d57(.DtU.&'............?......_....[...7.jn.F.-F.F.-
F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-F.F.-
F.F.-F.Y.<....`....&N.W..G.b5../........(.,.T..E..|c...a...Mq.J....
..[=hr.....l.:.V..*..^...3..{u.N.b......:.. .....Q........m.U..^...o..
......J.h.Q..L....;u.......]F..l!.../>.o..eo.._a........C...>`..
.......m..|.?O.S......Ul!.O.>...}J..N.q........ .=.>.<..@kpjn
U..............s.r.*!....t.m..Y..[............HTD.........H.>.E.": 
=C....w.t...!...!...n.....[.Rc%./.~......%:~A...}.......Sx.T..........
(...C.>o.....<.O.~T..........k4..o....y{CN.Q{...HC....:ii50..O..
..:u..Lt..P}.p4.5.b.y7..hix.a..Ey.w.}.^"[email protected]|.=..=}..p<
;.C.Lb.;Co.=}t..x..LO..ixS.Rs......p6.<k......;4.cI............)C..
D.....Ks_`:u01.."~...i.R.i..;........e..&.O....v.....i/.O..v...V...nG.
.........]5]...4....M...}Z.....VB..`.....vJm.fe.6....* ....1..V..2[,v*
.3.-.q....M.m9.=..mZ.*....J...U...w."...._z.....l.2R.Ly.3)Uy...r......
.$....F./s.H..`....'..PR~"v.. ...fhQ.P$.^z`...y,..G...j..u.s........T.
./.g.~.vo.....lA.&.....g.........T?.o....r..,..#.-'.e..4...9.@.&3.
<<< skipped >>>


GET /knctr/knctr_with_phone_loader.php HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:55 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
15f7..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<!-
-..This is the loader page created to make it easier to use the Knctr 
alpha background loading functions...Because the LoadBackground functi
on MUST BE THE LAST JAVASCRIPT CALL...  It is easier for it to be..on 
a separate page like this one and when it is properly loaded for us to
 then load other pages.  It..is not the most efficient way of loading 
everything together and then displaying the page, but it is..probably 
too hard especially when there are variable code executed by the ad sy
ndication providers..-->..<!--...This page creates an iframe and
 puts the "knctr_with_phone.php" in it.    all the Knctr app content w
ill be inside the iframe.    .-->.<html xmlns="hXXp://VVV.w3.org
/1999/xhtml">.<head>..<style>..    body {..        over
flow:hidden;..        height:760px;..        width:749px;..        mar
gin: 0;..        padding: 0;...}.....html {..        overflow:hidden;.
.        height:760px;..        width:749px;..        margin: 0;..    
    padding: 0;...}.    </style>    ...<title>KNCTR Loadin
g...</title>. .  .<!--  <script type="text/javascript">
if (external) { external.LoadAPI(); }</script> -->.  .<scr
ipt type="text/javascript" src="js/phone_js/itibiti_phone_api.js?14188
40875" ></script> .  .<script type="text/javascript" src="
js/heros_code_here.js" ></script>..<script type="text/
<<< skipped >>>

GET /knctr/js/phone_js/itibiti_phone_api.js?1418840875 HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:55 GMT
Content-Type: application/x-javascript
Content-Length: 27154
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
//..// This is the main file that needs to be referenced by all..// ne
w Itibiti phone software.  Please DO NOT use the..// external commands
 directly they they will change without..// notice...//..// IMPORTANT 
NOTICE:..// All API calls through this file can ONLY be made from the.
.// MAIN browser phone window.  Calling the functions in this..// file
 from a pop-up child window will result in an..// "unspecified error".
  This behavior is intentional in the..// current version.  Future ver
sion may support API calls..// from multiple pop-up windows...//..// A
nything that is preceeded with an underscore (_)..// such as _StatusTe
xt is considered to be private and such..// functions and variables sh
ould not be accessed directly.....//..//..// The phone object wrappers
 all phone related functions...//..var phone = new function () {...// 
This is just a temporary buffer so Albert can add status in JavaScript
......this._StatusText = "";......this.initialize = function(SecurityK
ey) {....// We will potentially use the SecurityKey for making sure th
at no....// hackers tries to compromise our skin page and load whateve
r....// they want...  At least it will make it more difficult for them
.....if (external != null) {.....external.OnEventCallback = this._Even
tHandler;....}...};......// SetDialString - sets the dial string for t
he Itibiti browser phone...// - Any illegal characters are parsed out 
and alpha-characters are converted to...//   numeric numbers between 0
-9 according to the North American telephone...//   touch tone key
<<< skipped >>>

GET /knctr/js/phone_js/jquery-1.7.2.min.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:56 GMT
Content-Type: application/x-javascript
Content-Length: 94840
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*! jQuery v1.7.2 jquery.com | jquery.org/license */.(function(a,b){fu
nction cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.pa
rentWindow:!1}function cu(a){if(!cj[a]){var b=c.body,d=f("<" a ">
;").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){c
k||(ck=c.createElement("iframe"),ck.frameBorder=ck.width=ck.height=0),
b.appendChild(ck);if(!cl||!ck.createElement)cl=(ck.contentWindow||ck.c
ontentDocument).document,cl.write((f.support.boxModel?"<!doctype ht
ml>":"") "<html><body>"),cl.close();d=cl.createElement(
a),cl.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ck)}cj[a]
=e}return cj[a]}function ct(a,b){var c={};f.each(cp.concat.apply([],cp
.slice(0,b)),function(){c[this]=a});return c}function cs(){cq=b}functi
on cr(){setTimeout(cs,0);return cq=f.now()}function ci(){try{return ne
w a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ch(){try{re
turn new a.XMLHttpRequest}catch(b){}}function cb(a,c){a.dataFilter&&(c
=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k
=d[0],l,m,n,o,p;for(g=1;g<i;g  ){if(g===1)for(h in a.converters)typ
eof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d[g];if(k=
=="*")k=l;else if(l!=="*"&&l!==k){m=l " " k,n=e[m]||e["* " k];if(!n){p
=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[1] " " k]
;if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.error("No co
nversion from " m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(c)))}}ret
urn c}function ca(a,c,d){var e=a.contents,f=a.dataTypes,g=a.respon
<<< skipped >>>

GET /knctr/logme.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&timestamp=1418840876616 HTTP/1.1


Accept: */*
Accept-Language: en-us
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:27:56 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
d..<pre>..</pre>..0..HTTP/1.1 200 OK..Server: nginx/1.0.15
..Date: Wed, 17 Dec 2014 18:27:56 GMT..Content-Type: text/html..Transf
er-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3.
.d..<pre>..</pre>..0......


GET /knctr/knctr_with_phone_loader.php HTTP/1.1


Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:06 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
15f7..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<!-
-..This is the loader page created to make it easier to use the Knctr 
alpha background loading functions...Because the LoadBackground functi
on MUST BE THE LAST JAVASCRIPT CALL...  It is easier for it to be..on 
a separate page like this one and when it is properly loaded for us to
 then load other pages.  It..is not the most efficient way of loading 
everything together and then displaying the page, but it is..probably 
too hard especially when there are variable code executed by the ad sy
ndication providers..-->..<!--...This page creates an iframe and
 puts the "knctr_with_phone.php" in it.    all the Knctr app content w
ill be inside the iframe.    .-->.<html xmlns="hXXp://VVV.w3.org
/1999/xhtml">.<head>..<style>..    body {..        over
flow:hidden;..        height:760px;..        width:749px;..        mar
gin: 0;..        padding: 0;...}.....html {..        overflow:hidden;.
.        height:760px;..        width:749px;..        margin: 0;..    
    padding: 0;...}.    </style>    ...<title>KNCTR Loadin
g...</title>. .  .<!--  <script type="text/javascript">
if (external) { external.LoadAPI(); }</script> -->.  .<scr
ipt type="text/javascript" src="js/phone_js/itibiti_phone_api.js?14188
40886" ></script> .  .<script type="text/javascript" src="
js/heros_code_here.js" ></script>..<script type="text/
<<< skipped >>>

GET /knctr/js/phone_js/itibiti_phone_api.js?1418840886 HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:07 GMT
Content-Type: application/x-javascript
Content-Length: 27154
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
//..// This is the main file that needs to be referenced by all..// ne
w Itibiti phone software.  Please DO NOT use the..// external commands
 directly they they will change without..// notice...//..// IMPORTANT 
NOTICE:..// All API calls through this file can ONLY be made from the.
.// MAIN browser phone window.  Calling the functions in this..// file
 from a pop-up child window will result in an..// "unspecified error".
  This behavior is intentional in the..// current version.  Future ver
sion may support API calls..// from multiple pop-up windows...//..// A
nything that is preceeded with an underscore (_)..// such as _StatusTe
xt is considered to be private and such..// functions and variables sh
ould not be accessed directly.....//..//..// The phone object wrappers
 all phone related functions...//..var phone = new function () {...// 
This is just a temporary buffer so Albert can add status in JavaScript
......this._StatusText = "";......this.initialize = function(SecurityK
ey) {....// We will potentially use the SecurityKey for making sure th
at no....// hackers tries to compromise our skin page and load whateve
r....// they want...  At least it will make it more difficult for them
.....if (external != null) {.....external.OnEventCallback = this._Even
tHandler;....}...};......// SetDialString - sets the dial string for t
he Itibiti browser phone...// - Any illegal characters are parsed out 
and alpha-characters are converted to...//   numeric numbers between 0
-9 according to the North American telephone...//   touch tone key
<<< skipped >>>

GET /knctr/js/jquery.cookie.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
If-Modified-Since: Fri, 12 Dec 2014 20:32:01 GMT
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 304 Not Modified
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
....


GET /knctr/logme.php?product_key=undefined&product_name=undefined&product_version=undefined&timestamp=1418840888310 HTTP/1.1


Accept: */*
Accept-Language: en-us
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
d..<pre>..</pre>..0......


GET /knctr/logme.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&timestamp=1418840888466 HTTP/1.1


Accept: */*
Accept-Language: en-us
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone_loader.php
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
d..<pre>..</pre>..0..HTTP/1.1 200 OK..Server: nginx/1.0.15
..Date: Wed, 17 Dec 2014 18:28:08 GMT..Content-Type: text/html..Transf
er-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3.
.d..<pre>..</pre>..0......


GET /knctr/css/phone_css/jquery-ui-1.8.20.custom.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:08 GMT
Content-Type: text/css
Content-Length: 5544
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*!.. * jQuery UI CSS Framework 1.8.20.. *.. * Copyright 2012, AUTHORS
.txt (hXXp://jqueryui.com/about).. * Dual licensed under the MIT or GP
L Version 2 licenses... * hXXp://jquery.org/license.. *.. * hXXp://doc
s.jquery.com/UI/Theming/API.. */../* Layout helpers..-----------------
-----------------*/...ui-helper-hidden { display: none; }...ui-helper-
hidden-accessible { position: absolute !important; clip: rect(1px 1px 
1px 1px); clip: rect(1px,1px,1px,1px); }...ui-helper-reset { margin: 0
; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration
: none; font-size: 100%; list-style: none; }...ui-helper-clearfix:befo
re, .ui-helper-clearfix:after { content: ""; display: table; }...ui-he
lper-clearfix:after { clear: both; }...ui-helper-clearfix { zoom: 1; }
...ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; positi
on: absolute; opacity: 0; filter:Alpha(Opacity=0); }..../* Interaction
 Cues..----------------------------------*/...ui-state-disabled { curs
or: default !important; }..../* states and images */...ui-icon { displ
ay: block; text-indent: -99999px; overflow: hidden; background-repeat:
 no-repeat; }..../* Overlays */...ui-widget-overlay { position: absolu
te; top: 0; left: 0; width: 100%; height: 100%; }..../* Component cont
ainers..----------------------------------*/...ui-widget { font-family
: Verdana,Arial,sans-serif; font-size: 1.1em; }...ui-widget .ui-widget
 { font-size: 1em; }...ui-widget input, .ui-widget select, .ui-widget 
textarea, .ui-widget button { font-family: Verdana,Arial,sans-seri
<<< skipped >>>

GET /knctr/css/phone_css/phone_dialpad.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: text/css
Content-Length: 5740
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
#phone_container {background:url('../../images/dialpad/background2.png
') 0 0 no-repeat;width:300px;height:144px;margin:0px;padding:0px;}..#p
hone_content {float:left;background:none;width:190px;height:122px;marg
in:0px;padding:0px;}..#enter_number {width:160px;height:43px;float:lef
t;margin-top:2px;margin-left:2px;font-size:18px;font-family:Arial, Hel
vetica, sans-serif;color:#dedede;text-align:center;padding-left:30px;}
..#call_end {width:216px;height:34px;float:left;margin:-1px;}..#call_e
nd ul{margin:0px;padding:0; list-style:none; clear:both;}..#call_end l
i{overflow:hidden; text-indent:-9999px; display:inline; float:left;}..
#call_end li.call {width:68px; height:34px; display:block; margin:0px;
background:url('../../images/dialpad/talk2.png') 0 -68px no-repeat;}..
#call_end li.call:hover {background-position:0px 0px; cursor:pointer;}
..#call_end li.call:active {background-position:0px -34px;} ..#call_en
d li.settings{width:92px; height:34px; display:block; margin:0px;backg
round:url('../../images/dialpad/settings.png') 0 0 no-repeat;}    ..#c
all_end li.settings:hover{background-position:0px -34px; cursor:pointe
r;} ..#call_end li.settings:active{background-position:0px -68px;} ..#
call_end li.end {width:56px; height:34px; display:block; margin:0px;ba
ckground:url('../../images/dialpad/end2.png') 0 -68px no-repeat;}..#ca
ll_end li.end:hover {background-position:0px 0px; cursor:pointer;}..#c
all_end li.end:active {background-position:0px -34px;}../*#settings {w
idth:153px;height:24px;float:right;margin-top:-5px;margin-right:-2
<<< skipped >>>

GET /knctr/css/demos.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: text/css
Content-Length: 14440
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
..* {..    margin: 0;..    padding: 0;..}..body {..    font-size: 62.5
%;..}..table {..    font-size: 1em;..}..body {..    font-family: "Treb
uchet MS","Helvetica","Arial","Verdana","sans-serif";..}...layout-grid
 {..    width: 960px;..}...layout-grid td {..    vertical-align: top;.
.}...layout-grid td.left-nav {..    width: 140px;..}...layout-grid td.
normal {..    border-left: 1px solid #EEEEEE;..    font-family: "Trebu
chet MS","Helvetica","Arial","Verdana","sans-serif";..    padding: 20p
x 24px;..}...layout-grid td.demos {..    background: url("/images/demo
s_bg.jpg") no-repeat scroll 0 0 transparent;..    height: 337px;..    
overflow: hidden;..}...normal h3, .normal h4 {..    font-weight: norma
l;..    margin: 0;..}...normal h3 {..    font-size: 1.8em;..    paddin
g: 0 0 9px;..}...normal h4 {..    border-bottom: 1px dashed #999999;..
    font-size: 1.2em;..    font-weight: bold;..    padding-bottom: 21p
x;..}...normal p {..    font-size: 1.2em;..}...demos-nav, .demos-nav d
t, .demos-nav dd, .demos-nav ul, .demos-nav li {..    margin: 0;..    
padding: 0;..}...demos-nav {..    float: left;..    font-size: 1.3em;.
.    width: 170px;..}...demos-nav dt, .demos-nav h4 {..    color: #E87
B10;..    font: 1.1em "Trebuchet MS","Helvetica","Arial","Verdana","sa
ns-serif";..    margin: 0;..    padding: 0;..}...demos-nav dt, .demos-
nav h4 {..    border: 0 none;..    line-height: 1.2em;..    margin-bot
tom: 0;..    margin-top: 1.5em;..    padding-bottom: 5px;..    padding
-left: 8px;..}...demos-nav dd a, .demos-nav li a {..    border-bot
<<< skipped >>>

GET /knctr/js/phone_js/jquery-ui-1.8.20.custom.min.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: application/x-javascript
Content-Length: 35731
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*! jQuery UI - v1.8.20 - 2012-04-30.* hXXps://github.com/jquery/jquer
y-ui.* Includes: jquery.ui.core.js.* Copyright (c) 2012 AUTHORS.txt; L
icensed MIT, GPL */.(function(a,b){function c(b,c){var e=b.nodeName.to
LowerCase();if("area"===e){var f=b.parentNode,g=f.name,h;return!b.href
||!g||f.nodeName.toLowerCase()!=="map"?!1:(h=a("img[usemap=#" g "]")[0
],!!h&&d(h))}return(/input|select|textarea|button|object/.test(e)?!b.d
isabled:"a"==e?b.href||c:c)&&d(b)}function d(b){return!a(b).parents().
andSelf().filter(function(){return a.curCSS(this,"visibility")==="hidd
en"||a.expr.filters.hidden(this)}).length}a.ui=a.ui||{};if(a.ui.versio
n)return;a.extend(a.ui,{version:"1.8.20",keyCode:{ALT:18,BACKSPACE:8,C
APS_LOCK:20,COMMA:188,COMMAND:91,COMMAND_LEFT:91,COMMAND_RIGHT:93,CONT
ROL:17,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,INSERT:45,L
EFT:37,MENU:93,NUMPAD_ADD:107,NUMPAD_DECIMAL:110,NUMPAD_DIVIDE:111,NUM
PAD_ENTER:108,NUMPAD_MULTIPLY:106,NUMPAD_SUBTRACT:109,PAGE_DOWN:34,PAG
E_UP:33,PERIOD:190,RIGHT:39,SHIFT:16,SPACE:32,TAB:9,UP:38,WINDOWS:91}}
),a.fn.extend({propAttr:a.fn.prop||a.fn.attr,_focus:a.fn.focus,focus:f
unction(b,c){return typeof b=="number"?this.each(function(){var d=this
;setTimeout(function(){a(d).focus(),c&&c.call(d)},b)}):this._focus.app
ly(this,arguments)},scrollParent:function(){var b;return a.browser.msi
e&&/(static|relative)/.test(this.css("position"))||/absolute/.test(thi
s.css("position"))?b=this.parents().filter(function(){return/(relative
|absolute|fixed)/.test(a.curCSS(this,"position",1))&&/(auto|scroll
<<< skipped >>>

GET /knctr/js/phone_js/itibiti_phone_api.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:09 GMT
Content-Type: application/x-javascript
Content-Length: 27154
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
//..// This is the main file that needs to be referenced by all..// ne
w Itibiti phone software.  Please DO NOT use the..// external commands
 directly they they will change without..// notice...//..// IMPORTANT 
NOTICE:..// All API calls through this file can ONLY be made from the.
.// MAIN browser phone window.  Calling the functions in this..// file
 from a pop-up child window will result in an..// "unspecified error".
  This behavior is intentional in the..// current version.  Future ver
sion may support API calls..// from multiple pop-up windows...//..// A
nything that is preceeded with an underscore (_)..// such as _StatusTe
xt is considered to be private and such..// functions and variables sh
ould not be accessed directly.....//..//..// The phone object wrappers
 all phone related functions...//..var phone = new function () {...// 
This is just a temporary buffer so Albert can add status in JavaScript
......this._StatusText = "";......this.initialize = function(SecurityK
ey) {....// We will potentially use the SecurityKey for making sure th
at no....// hackers tries to compromise our skin page and load whateve
r....// they want...  At least it will make it more difficult for them
.....if (external != null) {.....external.OnEventCallback = this._Even
tHandler;....}...};......// SetDialString - sets the dial string for t
he Itibiti browser phone...// - Any illegal characters are parsed out 
and alpha-characters are converted to...//   numeric numbers between 0
-9 according to the North American telephone...//   touch tone key
<<< skipped >>>

GET /knctr/images/RSSIcon.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: image/png
Content-Length: 2729
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR................U....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:6CE68CAA3AFD11E19A9F8D0887
D62D11" xmpMM:DocumentID="xmp.did:6CE68CAB3AFD11E19A9F8D0887D62D11">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6CE68CA83AFD11E19A9F
8D0887D62D11" stRef:documentID="xmp.did:6CE68CA93AFD11E19A9F8D0887D62D
11"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>l.......IDATx..Vm.\W.~.._..;...m.M.ch........
.4M.E.?TP1..".O..H.....T..1..U....K,..65..S..v7Mwvwf........s.l...x..g
........W...6\.=|...iV..e..h...|._..'.........._.._{~.`.O..i.........g
.x..... ..FD.Y.u..(.... .sU..s...*..W........o......|'.7Q..O.a...?..=.
&@....\Y.....{..z...W....]....s..P..d}L..............(.9..u.......K..g
.\..........R..a4....0E.s......A.........:....T.(.5M#R..JCZCx<..2..
.P.t...Xg...........r:..! L. L...2.v...G(a-..1.R^..(..."FEj.Fj.....\..
Q.kk8 .3F.5.....4..F.._.....\.F....C.......=k6.~}...z...K...B4XcP.E.".
!.(...^..[{...[....X|....*.....|.... ...L..e..8...b....v.M.m.".u.(
<<< skipped >>>

GET /knctr/images/knctr_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: image/png
Content-Length: 1764
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR................U....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..V[l\...f........o.M...P;-.(..R..k.. .T...E<!...KU!$z.
...V.B%.J}HIi...4...4..............9.?.v.5.k....gg../...0..nVcS.^d_.?.
xu.p8....!x.D.:.8.6F....'.c......`.1..zTa.).......L..../=.o..S.....{..
.L.T\....J.:........\..!&.\..b..M.q.J|..om.g...7W.....h....a... .%.. .
A..l..*Q.^'.LAF1.(...0...i.b.yb.y.@!.S*...P)....F.Z.o.}..6.0}.)../C.bT
.y.U........L o8.mU.....F......9.].e...wC.?3.B1..G")c.U.8t.^...x!..v..
.j......:.wC.~....#;.)..z...`.Ea....H..G..(.P...\.a|g.Uzn..h{n..>..
.#...?l.......I..}................D..c.....z8C!.mnf.o.....p..-...c.. .
$._.....N...!.Vj.....'.ER...q..s.....s.\..1.\Z.../[email protected]..,h
.....8J.........pL...oP[..........6..;O..e.iM.a Q.G.8%b. ....f..V_....
..0.......g. ........~.uO......<q.*..u..^L.sdM.....z.....\.........
.....{....{...E._ /.C..O...._..%....,..."....o.9Ut*5...........z..P.d.
s,....|..C......s....:,#.|f......0..H....J.S..1..F.....~0.B.'5).^3Bu4.
R).......'>....v.T5L*t...{..F"...1&.i6}..z.).6..m.74.uN4AbWa.|....,
..E...........\'.......)......z.v...L.:.(...,. ._..3l....?\.|...].....
.....P....../....~D.#HE.tS.b...m.J...F#[email protected]....*..$M..^...w....
.p....|[email protected][email protected].$..'....V9........E..H...oL
..)Z...GD....FH.C...!....3:. i.}...COM..Wk...U.k...J.l'..~.......;.w..
8.....]............p...T.d<..-..`!....Q.b.O..uX...=..=...=..T?...Z.
\..%I..0N....x.......}%.....X.o..Og./[email protected]..
....sE.s.....mX...$........Cn.......m....1s.......~2.......}#...a 
<<< skipped >>>

GET /knctr/css/jquery.ui.base.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: text/css
Content-Length: 58
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
@import url("ui.core.css");..@import url("ui.tabs.css");......


GET /knctr/css/ui.core.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: text/css
Content-Length: 1393
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*.. * jQuery UI CSS Framework 1.8.17.. *.. * Copyright 2011, AUTHORS.
txt (hXXp://jqueryui.com/about).. * Dual licensed under the MIT or GPL
 Version 2 licenses... * hXXp://jquery.org/license.. *.. * hXXp://docs
.jquery.com/UI/Theming/API.. */..* { margin:0px;padding:0px; !importan
t }../* Layout helpers..----------------------------------*/...ui-help
er-hidden { display: none; }...ui-helper-hidden-accessible { position:
 absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,
1px,1px); }...ui-helper-reset { margin: 0; padding: 0; border: 0; outl
ine: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list
-style: none; }...ui-helper-clearfix:before, .ui-helper-clearfix:after
 { content: ""; display: table; }...ui-helper-clearfix:after { clear: 
both; }...ui-helper-clearfix { zoom: 1; }...ui-helper-zfix { width: 10
0%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; fil
ter:Alpha(Opacity=0); }..../* Interaction Cues..----------------------
------------*/...ui-state-disabled { cursor: default !important; }....
/* Icons..----------------------------------*/../* states and images *
/...ui-icon { display: block; text-indent: -99999px; overflow: hidden;
 background-repeat: no-repeat; }..../* Misc visuals..-----------------
-----------------*/../* Overlays */...ui-widget-overlay { position: ab
solute; top: 0; left: 0; width: 100%; height: 100%; }....
<<< skipped >>>

GET /knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code= HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:10 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
1fbb...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//E
N" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<h
tml xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en-us">.<head
>.<title>KNCTR</title>.<!--link href="css/phone_css/
style.css" rel="stylesheet" type="text/css" / -->.<!-- jCarousel
 skin stylesheet -->.<link rel="stylesheet" type="text/css" href
="css/video_menu.css" />.<!-- jQuery library -->.<script t
ype="text/javascript" src="js/jquery-1.4.2.min.js"></script>.
<!-- jCarousel library -->.<script type="text/javascript" src
="js/jquery.jcarousel.min.js"></script>...<script type="te
xt/javascript">..function activeVideo($videoID){..   try{.    ..if(
$("#" $videoID).html() != null){.        ..  $(".videoBox").removeClas
s("video_active");.        ..  $("#" $videoID).addClass("video_active"
);.....  $("#vidListScript").html("<script type='text/javascript'&g
t;setTimeout(function(){jQuery('#video_carousel').jcarousel('scroll',"
   $("#" $videoID).attr("jcarouselindex")   ");},250);<\/script>
");    ..}else{.                if(typeof(parent.movie.getChannelID) !
= "undefined"){.                    if(parent.movie.getChannelID == 1)
{.                        setTimeout(function(){activeVideo($videoID);
},1200);.                    }.                }.    ..}.        }catc
h(err){setTimeout(function(){activeVideo($videoID);},1200);}..}..    f
unction grabActiveVideo(){.        try{.            if(typeof(pare
<<< skipped >>>

GET /knctr/images/dialpad/talk2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/png
Content-Length: 5166
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...D...f.....rw7.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:FAF8CDF4E31F11E184838719
9AFAD1E5" xmpMM:DocumentID="xmp.did:FAF8CDF5E31F11E1848387199AFAD1E5"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAF8CDF2E31F11E184
8387199AFAD1E5" stRef:documentID="xmp.did:FAF8CDF3E31F11E1848387199AFA
D1E5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...M....IDATx..\[l..........ccL08.S.%.(....
..yh.*II.V..J..UU.D}.c..OU..7.*..j.^$.M.%.RHsQ..{ ..b0.{.;....9...3..$
$(.c.f...s.....3......{........W..MLLd=.s........u].u.Lq.!.b.."......^
5."..r..m....i.)%R ......d@BZ[[I..M........d..CB2* ....3......fU."..|S
(!..FU....H.^....:fT:...,..C*.j.R..g5M .'..a.6.-."..YTN./..,..$..z..b.
...6..R......p.'.'z.=.L&.v..#O^.~ ......r.j.....C....ST.....=.......V.
....2....h..}a.......^.{[email protected].,..SO....irr.^~..P...,.......[..
W^y..3.j....k......0.>|.n...hT.$$...7::..z..y........$g9.....n.:.2.
[email protected].......~:z....."7n..K..6...
<<< skipped >>>

GET /knctr/images/dialpad/end2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/png
Content-Length: 3830
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...8...f.......R.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:AE006172E31F11E1B9C7AA8C
9C5E638E" xmpMM:DocumentID="xmp.did:AE006173E31F11E1B9C7AA8C9C5E638E"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AE006170E31F11E1B9
C7AA8C9C5E638E" stRef:documentID="xmp.did:AE006171E31F11E1B9C7AA8C9C5E
638E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.3/....jIDATx..[.o.G....g...&..<.E!D..."
..c....r..........(..J.r.-.).K ..DH...H.8......!.m..m...=........5....
.ZeF]R.......]_O.......).L&..^..e..-..b.w..h....\. (q...Q..;.....)}%..
.0.TEq.G..NK.rP.....YD..R.TR...8...y.}_./}.....}...<..'h..l6...W.$.
[email protected].`. ..`.D.*@.BGG..9sFQ..^ .fgg...G.@9
}......;w.FFF*8w..).h.n..M...Wc....#.BjP......#.....7o....Y3.M.r.Csss.
..S....x...!....P......=,.}.`.999Y.!.0...4={.L.C|[[[.A.m.F.6l.K...~...
. 81>>N./^T...Q........fWW...q....-..ccct......_....h...J2P...W.
[email protected]..(.Z..m.fff..].v.E.....lG_.....k .......T..j*..5k.u.e.......
<<< skipped >>>

GET /knctr/images/phone/exit_normal.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/jpeg
Content-Length: 1533
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:516959EDAF3E11E183858C0968C9978B" xmpMM:DocumentI
D="xmp.did:516959EEAF3E11E183858C0968C9978B"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:516959EBAF3E11E183858C0968C9978B" stRef:doc
umentID="xmp.did:516959ECAF3E11E183858C0968C9978B"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
....................................1a4..8.23..6.."brCS$d5Ue.f7.......
...............!.1AQ.2.aq..B..............?.<......p`Z........R...T
 Y...r.W..pO(h.th....{......Jx..sf.0cVnW...............~..a[q.\(.....|
.L..A...n.X..... ..>[email protected].!.8>c.h.I.....ik42.
.....x..L...KE...v.i..g...Z.F.B2z....O.XH..$..Y...9......<K.=..d#..
.\..~.m...3.M......~....L...c.......H,./..0tV...E..........._5.=&l
<<< skipped >>>

GET /knctr/images/menutab.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: image/png
Content-Length: 6364
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...o...4.......fT....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:30BC7401750311E1A31CEF5F16
287CD1" xmpMM:DocumentID="xmp.did:30BC7402750311E1A31CEF5F16287CD1">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30BC73FF750311E1A31C
EF5F16287CD1" stRef:documentID="xmp.did:30BC7400750311E1A31CEF5F16287C
D1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.(.e...RIDATx..\.p.E.>...w [email protected]...
.h........jg.FYu]....q...{.....qE...U.AeH.2....&.B @H.;..=_....s......
.MWu....:}.>.Ow.{.Dd.h.h.h..ZXXX.x.b...H.--...Iv......N..\.N'..n...
o..S...W.EY5.....v..,/.9.....&}>...oZ...`0.^.w..-...n..dZ~3..w#....
H..'..w~...H.M....g.X(<<.....x.-Z4......c.G G.G.G.Y....v$L. ....
..h...!.<.....3.;.>_2]......}....H.......{[email protected]}....<..
...>GDDPdd..G.....U..*N"....N...l...0.c. -......drOi..xH.O.......I.
Q"..t.....-..g.a>Ch....."U..U|\:..f.1.........'y...S.I./i.%1.$._^..
..2^..R.....\.....P.g.Q.].*..UBJ...u.!.*...]..L..X_......o7..z.|..
<<< skipped >>>

GET /knctr/js/jquery-1.4.2.min.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:11 GMT
Content-Type: application/x-javascript
Content-Length: 72174
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
/*!. * jQuery JavaScript Library v1.4.2. * hXXp://jquery.com/. *. * Co
pyright 2010, John Resig. * Dual licensed under the MIT or GPL Version
 2 licenses.. * hXXp://jquery.org/license. *. * Includes Sizzle.js. * 
hXXp://sizzlejs.com/. * Copyright 2010, The Dojo Foundation. * Release
d under the MIT, BSD, and GPL Licenses.. *. * Date: Sat Feb 13 22:33:4
8 2010 -0500. */.(function(A,w){function ma(){if(!c.isReady){try{s.doc
umentElement.doScroll("left")}catch(a){setTimeout(ma,1);return}c.ready
()}}function Qa(a,b){b.src?c.ajax({url:b.src,async:false,dataType:"scr
ipt"}):c.globalEval(b.text||b.textContent||b.innerHTML||"");b.parentNo
de&&b.parentNode.removeChild(b)}function X(a,b,d,f,e,j){var i=a.length
;if(typeof b==="object"){for(var o in b)X(a,o,b[o],f,e,d);return a}if(
d!==w){f=!j&&f&&c.isFunction(d);for(o=0;o<i;o  )e(a[o],b,f?d.call(a
[o],o,e(a[o],b)):d,j);return a}return i?.e(a[0],b):w}function J(){retu
rn(new Date).getTime()}function Y(){return false}function Z(){return t
rue}function na(a,b,d){d[0].type=a;return c.event.handle.apply(b,d)}fu
nction oa(a){var b,d=[],f=[],e=arguments,j,i,o,k,n,r;i=c.data(this,"ev
ents");if(!(a.liveFired===this||!i||!i.live||a.button&&a.type==="click
")){a.liveFired=this;var u=i.live.slice(0);for(k=0;k<u.length;k  ){
i=u[k];i.origType.replace(O,"")===a.type?f.push(i.selector):u.splice(k
--,1)}j=c(a.target).closest(f,a.currentTarget);n=0;for(r=.j.length;n&l
t;r;n  )for(k=0;k<u.length;k  ){i=u[k];if(j[n].selector===i.selecto
r)) |(\s|\u00A0) $/g,Xa=/^<(\w )\s*\/?>(?:<\/\1>)?$/,P
<<< skipped >>>

GET /knctr/css/skin_channel.css HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:12 GMT
Content-Type: text/css
Content-Length: 4795
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
..jcarousel-skin-channel .jcarousel-container {.    background: url("i
mages/channel_bg.jpg") no-repeat scroll 0 0 transparent;.    border: 1
px solid #346F97;.    border-radius: 5px 5px 5px 5px;.}..jcarousel-ski
n-channel .jcarousel-direction-rtl {.    direction: rtl;.}..jcarousel-
skin-channel .jcarousel-container-horizontal {.    padding: 0;.    wid
th: 434px;.}..jcarousel-skin-channel .jcarousel-container-vertical {. 
   height: 245px;.    padding: 40px 20px;.    width: 75px;.}..jcarouse
l-skin-channel .jcarousel-clip {.    overflow: hidden;.}..jcarousel-sk
in-channel .jcarousel-clip-horizontal {.    height: 50px;.    margin-l
eft: 20px;.    width: 395px;.}..jcarousel-skin-channel .jcarousel-clip
-vertical {.    height: 245px;.    width: 75px;.}..jcarousel-skin-chan
nel .jcarousel-item {.    height: 79px;.    width: 78px;.}..jcarousel-
skin-channel .jcarousel-item-horizontal {.    margin-left: 0;.    marg
in-right: 0;.}..jcarousel-skin-channel .jcarousel-direction-rtl .jcaro
usel-item-horizontal {.    margin-left: 0;.    margin-right: 0;.}..jca
rousel-skin-channel .jcarousel-item-vertical {.    margin-bottom: 10px
;.}..jcarousel-skin-channel .jcarousel-item-placeholder {.    backgrou
nd: none repeat scroll 0 0 #FFFFFF;.    color: #000000;.}..jcarousel-s
kin-channel .jcarousel-next-horizontal {.    background: url("images/n
av_next.png") no-repeat scroll 0 0 transparent;.    cursor: pointer;. 
   height: 52px;.    position: absolute;.    right: 1px;.    top: -1px
;.    width: 20px;.}..jcarousel-skin-channel .jcarousel-direction-
<<< skipped >>>

GET /knctr/images/knvideo.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:12 GMT
Content-Type: image/png
Content-Length: 41416
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...V...F.......U.....bKGD.......X......pHYs...H...H.F.
k>....IDATx...y.$.u....u.....\.... .. [email protected],...0%Y...k.cWr
......Z.......Z.. ..:L..DB<.. ..\.90w.W..Y....o.'.k..>..~"....:.
./_U.o..KKDDd.~..e...7..........J.#:*=~...v._..x..o.qq...l|...........
y.n^..O..Ms......==A..A.y....q..j.Z.\....b.Z5.6...|...."..==.."..V*.R2
.o_.Z..A_.......q.}...V].V......<.........._^^\.....}.{E\..!..$.<
;..</...={..Y...m......z]..,..D\.u]W....$..D".......l......C....I..
.t..z]..g..9s....8............8...9|.....[_.U....._~..._^.=..._.{.....
.`k.:,.L&.I.r.\..E....{..G.k..._z...^z)\........x....K.R.TJ.T*.J%.{...
.{.m}..l...........[o...dr.....u7{...........T..=...>..[.7......y..
........,.y.4r..7.|..G...o..o..o<.................k.......YLA.6.x..
'.x..'....L.........:6k....3./.L.....{..|~l...~u...{...G..Je..c.|...us
.E.?`o.\...gY.X..o_..y...s.......33_........u..[o.LO.:U...JG..R.......
........R...|..~...J:j..~.........P"..d2...f.J.R.....zP...z.......]..z
..u.6.<q....'.B.|>....u....s?]7.........z{{{{{.......z..VD....\]
]]]]...z.......]...%.......;:.5.o|..g.y&.<z....GE~.'?...~t....vN...
^./.......G..;rD...~..6...OW..V<...?..........................?..3o
.E...?`bk..........:..w..w..w.....?..?..?...~.<ja.....[oTp....R.P(.
.rK...t....;.;3......p.T*.{...e.."...3...L.8..="..K/....J....}.....'N|
..g.............;g~.Phu...8}....b.(.........I..................a.l6..f
EL.....l=..UQ..(..........u\.......=mTq...../....zM...u....`k..L?..F..
.l.....u...B......z.........={....G.\......$.wD;^...T...;..8L#..^3
<<< skipped >>>

GET /knctr/images/ads.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:12 GMT
Content-Type: image/png
Content-Length: 6137
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...5.........@.F.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /knctr/images/dialpad/1.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:31 GMT
Content-Type: image/png
Content-Length: 2303
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......f......A!.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:B3E0675AE31711E1A950F48ED0
959628" xmpMM:DocumentID="xmp.did:B3E0675BE31711E1A950F48ED0959628">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3E06758E31711E1A950
F48ED0959628" stRef:documentID="xmp.did:B3E06759E31711E1A950F48ED09596
28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>]"i....uIDATx..Z.K W.?..Ib.e.R.]H.)B....P....
."H.`.eW../.B(J.O..j.}tS\t'..........V....q...].Lon&y&of.$.p.wn...3...
..............wvv..,whh.\....i.e.d...,.....k;....N...1.........t0>?
?.R.D...d....y..MA`....,..a.....Q.u%U.U.;.z..9._]]I.....@.)M0V/.// .V.
k....b).nx..b..OmG. az."[email protected]....`^..H..7.................n..D
..maa....i||\^...'........N...tttD'''....=.=......x...qH.F.\U....d....
..^..$V.^..V. .Y....V?|.lZ.I.YW..A.......m..T"....r...[.O=77..........
..%v$...x>.Y..1$4.......]J.)DJO...rO.o=....z....c.q.9]__....A.LP...
....JE.vX.......53..LLL.H.)...d.s.4..hE/Z.........H......".._^^...
<<< skipped >>>

GET /knctr/index_tabs2.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: text/html
Content-Length: 4611
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xml
ns="hXXp://VVV.w3.org/1999/xhtml" lang="en">.<head>.<meta 
http-equiv="Content-Type" content="text/html; charset=utf-8" />.<
;title>KNCTR</title>.<head>..<meta charset="utf-8"&g
t;..<title>jQuery UI Tabs - Default functionality</title>.
.<link rel="stylesheet" href="css/jquery.ui.all.css">..<scrip
t src="js/jquery-1.7.1.js"></script>..<script src="js/jque
ry.ui.core.js"></script>..<script src="js/jquery.ui.widget
.js"></script>...<script src="js/jquery.ui.tabs.js"><
;/script>..<link rel="stylesheet" href="css/demos.css">....&l
t;script>...$(function() {....$( "#tabs" ).tabs();....$( ".tabs-bot
tom .ui-tabs-nav, .tabs-bottom .ui-tabs-nav > *" ).....removeClass(
 "ui-corner-all ui-corner-top" ).....addClass( "ui-corner-bottom" );..
.});..</script>..  <style type="text/css">...#tabs {height
:30px; margin:0px; border:0px; } ....tabs-bottom {position: relative; 
  } ....tabs-bottom .ui-tabs-panel {height: 30px; overflow: hidden;  }
 ....tabs-bottom .ui-tabs-nav { left: 0; top: 0; right:0; padding:0; }
 ....tabs-bottom .ui-tabs-nav li {margin: 0px; border:0px; height:30px
; width:100px; }....ui-tabs-selected { margin: 0px !important; }..<
/style>..<link href="css/stylesheet3.css" rel="stylesheet" type=
"text/css" />.</head>..<body>.    .                
<<< skipped >>>

GET /knctr/kn_banner.php HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
583..<html>.    <head>.        <script type='text/javas
cript'>.            var googletag = googletag || {};.            go
ogletag.cmd = googletag.cmd || [];.            (function() {.         
   var gads = document.createElement('script');.            gads.async
 = true;.            gads.type = 'text/javascript';.            var us
eSSL = 'https:' == document.location.protocol;.            gads.src = 
(useSSL ? 'https:' : 'http:')   .            '//VVV.googletagservices.
com/tag/js/gpt.js';.            var node = document.getElementsByTagNa
me('script')[0];.            node.parentNode.insertBefore(gads, node);
.            })();.        </script>..        <script type='t
ext/javascript'>.            googletag.cmd.push(function() {.      
      googletag.defineSlot('/282654509/knctrC_leaderboard', [728, 90],
 'div-gpt-ad-1375898897251-0').addService(googletag.pubads());.       
     googletag.pubads().enableSingleRequest();.            googletag.e
nableServices();.            });.        </script>.    </head
>.    <body bgcolor="black" marginwidth="0" marginheight="0" top
margin="0" bottommargin="0" leftmargin="0" rightmargin="0">.       
 <div id='div-gpt-ad-1375898897251-0' style='width:728px; height:90
px;'>.            <script type='text/javascript'>.           
     googletag.cmd.push(function() { googletag.display('div-gpt-ad-137
5898897251-0'); });.            </script>.        </div>. 
   </body>.</html>..0......
<<< skipped >>>

GET /knctr/images/dialpad/astrix.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2881
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......W......g......tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:F6D06FBBE31911E1AA318FC201
65C7E0" xmpMM:DocumentID="xmp.did:F6D06FBCE31911E1AA318FC20165C7E0">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F6D06FB9E31911E1AA31
8FC20165C7E0" stRef:documentID="xmp.did:F6D06FBAE31911E1AA318FC20165C7
E0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>'.......IDATx...[l.E...{..l..-.............Oc
T.......m.V....b.1AA.$&>..?...&.i.Q.i "..*....V..`ikM[{w.=.wvg...n.
.q...y.9.9gG.........o.....H$.....(.)..B?......H)**..r... ........f.u.
am.:......H.0..e..=...b....,......`.CC.Y^[email protected]....
...lmm...)..F.........;4.t. [email protected]{{;\.t.N.<.]]].y....C........
.!..c.......8.7l..2.P.[Z..V.....Tj. :q.#r.d2eR.u.u.......kb...........
!.v...`/.~.......,...<.yyy........).sV.....,.)R....r..e.y.(... am..
E5_.qO..-..Ba.....r...S/.{-......U8:O..h)....S.D.....R......."..}....F
....H....R..o.?..}Y..v...:....I.[......k..a.jf<..r.....R.h...L.
<<< skipped >>>

GET /knctr/images/dialpad/number.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2413
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......W.............tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:34C25867E31A11E1AA22CBF32F
D5AE47" xmpMM:DocumentID="xmp.did:34C25868E31A11E1AA22CBF32FD5AE47">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:34C25865E31A11E1AA22
CBF32FD5AE47" stRef:documentID="xmp.did:34C25866E31A11E1AA22CBF32FD5AE
47"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.u......IDATx..X[H.W..gw..R..@.[..".j.F.|...&
JJ.mq ..>.....>.5-T....E$.-.Z.Z......F..x.*......=..:....J.X...3
...g........D.$....[.....@dE1.... :.D....F...D...........VWW....E....v
..Hrr2lll.......AW.X....X.....\'..}...a.8........***`yy.....S;//_.....
..Z[[...c..A.e...a.ONN.......I,Q.egw.P.<.,s...add.m....'''......zY.
..K...K]]....Q..zV..`&..p.....a.sssB.........Ft.......8==e..cKK..... ?
?..<x.eee....w......hjj...R.......Yx......~.-0.../:u........)...7|.
z..~..V|.8.........T.!....V.R.l#.`......\C.M......:.y.L......H.......;
^...p.e"...(.."k(.......,....=.d#N.-.........G.du..B >>.O~..
<<< skipped >>>

GET /knctr/images/dialpad/2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2761
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......f.....>.:w....tEXtSoftware.Adobe ImageReadyq
.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D12673EAE31711E1B63A938
1EBD5DA78" xmpMM:DocumentID="xmp.did:D12673EBE31711E1B63A9381EBD5DA78"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D12673E8E31711E1B
63A9381EBD5DA78" stRef:documentID="xmp.did:D12673E9E31711E1B63A9381EBD
5DA78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>..*....?IDATx..Y}HUg....d..P...2..X....d..
iNtB...#...Km.m...G9...\...&......C.V........i..S .....3....9.....Z..r
.}.=..........k.....'yxx.4e.I.J..F7........,...GGG.:22......Q{{;.Y....
.2#.41.RS{.4...C.!!!$..l.l..~..gJ..cFrs.......K..'..,. ...I..S ...'...
..cZ@. ..|}})>>....h........d./....'O.......i*^|-&..q#UTTPff&...
[email protected].._9w.\...g... g.............{..........K(...S.G.
...>{.l.H.[...,S.?R........5.h Ba.K...E......e..\. FG.....SSS....N.
>..$'.V....]K.....B..)q..4....PAA......66.<^..[..nQQ...'..'....F
..}.8C./....J.Wp..5...?.\...N.* .....3jbC4..]h......D......@>&g
<<< skipped >>>

GET /knctr/images/dialpad/4.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:32 GMT
Content-Type: image/png
Content-Length: 2919
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......Q......>......tEXtSoftware.Adobe ImageReadyq
.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:3400A8B4E31911E1B3EFB4E
A72676131" xmpMM:DocumentID="xmp.did:3400A8B5E31911E1B3EFB4EA72676131"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3400A8B2E31911E1B
3EFB4EA72676131" stRef:documentID="xmp.did:3400A8B3E31911E1B3EFB4EA726
76131"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?> .......IDATx..Y{LSW..z[.U!(.1...?.....ID#
!&....eF.!<J.........>..6a....<DB...l.... .n.. [email protected]..
=.......$...sO......G....Zm{.............[.J...A..BAw.......... 55.T S
3..`0....e... .Etyy..RF.5...0#p...x...<...B.....Dq... ())...O.:....
..z.v..y.....ONN:eV.C.yyyp...(//'....N..<....[.pUU...}........U.Z1S
I]].<z....=K....B.....M.........h.....9....a...?..zP.TV..%j..={....
..-...Z...=6.....J.......Boo/.......I.....[p....D-.....G.R\'....".....
.4....3g.8..[..DPt}}}V......A...{. ..=.16~!F.7@>FK.z.N........1.5..
.`.4..1...>##...1e..*Vm..{.l....]APH.z.2.j5.>}..............
<<< skipped >>>

GET /knctr/images/dialpad/6.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: image/png
Content-Length: 2753
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......Q.....'..b....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:765D3461E31911E18C9CCD245D
F3F278" xmpMM:DocumentID="xmp.did:765D3462E31911E18C9CCD245DF3F278">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:765D345FE31911E18C9C
CD245DF3F278" stRef:documentID="xmp.did:765D3460E31911E18C9CCD245DF3F2
78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>a.L6...7IDATx..XiLTW..fA*..\...f...R%..*"..F.
i4..`D[...Hbm.......*..6...--..e...BY....R....P.....>..of.,..7y....
...,.|.SL.>].QS(.........UCf..t.j..B.J.,.J9..?...RD.W......<{...
.F.....q..%TVVb.....K....ybcc....'''.;w.uuuhii....9..*#""p......"%%...
.7., ............k..Eoo....J.7.D.]JS..F>.........2.......f...I .b..
.(((.../...........:u...d2%_.84.C.............3f..=|...w.F@@......c2..
.......................DGG..c..c.;.vCM.R.....j..~~~. ."C...'N..!.5...0
6...j..1X.l.Ar.^......F...)%...G.",,.......ACC.....b.....3..i.}.....G.
.. .......}.....UUU,..%$....h....J..L..9..i.P=1..J%...9.?.~hh.QO.!
<<< skipped >>>

GET /knctr/images/phone/activate2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: image/png
Content-Length: 36867
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...'...y.......p%....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:8553CB2FA4F411E1BEE981D11C
C335AF" xmpMM:DocumentID="xmp.did:8553CB30A4F411E1BEE981D11CC335AF">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8553CB2DA4F411E1BEE9
81D11CC335AF" stRef:documentID="xmp.did:8553CB2EA4F411E1BEE981D11CC335
AF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>%......yIDATx...W.$..(.7}.....x?...X...K....R
..z...I/B?...P....B...>..........4.I...1.......io.We...W..4...3h.rI
a.....[7.9..{..o....4.]o^z..j.l.:..B.B......!..G.!..1....{..#./.AcL.kL
_.1m..#?......{....<...c....9N.%..=.6fM..D.F........Yc....G....g..1
..6.o"Ad=o..n.w{.@=.."U.d.=j~..,Y.]..}..............;8.%.X.(.......0..
.}N\m. .R......5.s..6.........y...yF.m...;.O|..7..^d.....7.j.........k
?...=|...............O....#>...{..:...b!.%...w.........g...^b......
.7.....=.(.(...%.b2..N..$.....?.W.......p_I.B..x...6.<*.a..,..m.u..
.;.....G........y..3..Fi.........._{B.,Y2d..$.D.(...xd....K..A.?=.
<<< skipped >>>

GET /knctr/js/jquery.ui.core.js HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:33 GMT
Content-Type: text/css
Content-Length: 2311
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
..html {..}..body {..    background: url("images/welcomebg_pur3.png") 
repeat-x scroll center top #FFFFFF;..    color: #37075A;..    font-siz
e: 11px;..    margin: 0;..    padding: 0;..}..h1 {..    font-size: 14p
x;..    padding-bottom: 4px;..}..b {..    font-size: 12px;..}..ul#menu
 {..    clear: both;..    list-style: none outside none;..    margin-l
eft: 14px;..    margin-top: 6px;..    padding: 0;..}..#menu li {..    
display: inline;..    float: left;..    overflow: hidden;..    padding
-right: 14px;..    text-indent: -9999px;..}..#menu li a {..    display
: block;..    height: 60px;..    margin: 0;..    width: 60px;..}..#men
u li.welcome {..    height: 61px;..    width: 60px;..}..#menu li.welco
me a {..    background: url("images/welcome_icon2.png") no-repeat scro
ll 0 -58px transparent;..    height: 60px;..}..#menu li.welcome a:hove
r {..    background-position: 0 -1px;..    height: 55px;..}..#menu li.
welcome a.selected {..    background-position: 0 -1px;..}..#menu li.ph
one {..    height: 61px;..    width: 60px;..}..#menu li.phone a {..   
 background: url("images/phone_icon2.png") no-repeat scroll 0 -58px tr
ansparent;..    height: 60px;..}..#menu li.phone a:hover {..    backgr
ound-position: 0 -1px;..    height: 55px;..}..#menu li.phone a.selecte
d {..    background-position: 0 -1px;..}..#menu li.social {..    heigh
t: 61px;..    width: 60px;..}..#menu li.social a {..    background: ur
l("images/social_icon2.png") no-repeat scroll 0 -58px transparent;..  
  height: 60px;..}..#menu li.social a:hover {..    background-posi
<<< skipped >>>

GET /knctr/images/sidebar_bg.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/sidebar.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 1141
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:1A555F0D696911E18A3A8BEB16
A7E6E6" xmpMM:DocumentID="xmp.did:1A555F0E696911E18A3A8BEB16A7E6E6">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1A555F0B696911E18A3A
8BEB16A7E6E6" stRef:documentID="xmp.did:1A555F0C696911E18A3A8BEB16A7E6
E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>........IDATx...... ........A....wME....e.E..
..3..~.?S.....M...$.B$.......ir....>.n.am.Z....e..Sm...q..M .$..F4.
..eB.]H.....eSV...`F.zN.Z)eT.b.T....... @....D..^.NzA/8.6.F...*.H'.p..
....-rA:.$Z..tr".........Z.a.v....SA1..>/[email protected]{8.2%;....`.......
......IEND.B`.....


GET /knctr/images/HelpBTN.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/sidebar.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 1325
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...*...".....).K6....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:156899FF784911E1B498B8E533
2D9D34" xmpMM:DocumentID="xmp.did:15689A00784911E1B498B8E5332D9D34">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:156899FD784911E1B498
B8E5332D9D34" stRef:documentID="xmp.did:156899FE784911E1B498B8E5332D9D
34"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>...a....IDATx...Kj.0...E..E.o.z..j.....#...t.
.{.\..&......W.....).6... u..`...?.G.I..0`...p.A..i/.......I&.p .[..W.
5...i...~.=z)ajG)Fc..;[email protected],.....(j..bI9.A.
...b$.MhciO.#1G....C...F...If...........92..B........r23q.J8e...%.4|..
........M..Ob2.....KK.......b2..?.7S)_.....BOb.r..1.....C[...`.t...W..
 .e.";21o.L[1..!.K...P.(......#T.....T....W.(..I.$......C5.f...9dY..1H
....Z.......c.u..-l..... o.e.-....2..o.L....IEND.B`.....
<<< skipped >>>

GET /knctr/images/INfoBTN.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/sidebar.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 1323
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...*...!.......9.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:FAC6AB5F784811E1A20CF1F285
4B0FB5" xmpMM:DocumentID="xmp.did:FAC6AB60784811E1A20CF1F2854B0FB5">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAC6AB5D784811E1A20C
F1F2854B0FB5" stRef:documentID="xmp.did:FAC6AB5E784811E1A20CF1F2854B0F
B5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>`.u.....IDATx..VMj.@.~..qQ....6t. .......B.-.
G.#..4 ..0W.;W.G.o..C..>.P....3.....(..:l..n9;#R.h.w.N....FNS......
.#|.n,N.P_.Q..8W0..m.][email protected].._.X..7....-%"o....Ty4...(
......Q.......T.=.A.eq..=y4.#Z.....S5.b"..>..,.b...@.)..B'3B/C.JI_h
x.o.!.i#.?...&.F..8......)r..O....N..1.............L...h..D.........g.
....q....T}$5.P..KS.;.=..A..b...As1U.m.4...ol2...]..BuM.....O...8...m.
i.`YV.y- ..}.Yq....,....ts.....<.#..#.'.z.!=....IEND.B`.....
<<< skipped >>>

GET /knctr/images/SettingsBTN.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/sidebar.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 3294
Last-Modified: Fri, 12 Dec 2014 20:32:01 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......2.....U.[\....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /knctr/css/images/welcomebg_pur3.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 7681
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR................I....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE.........=4E.....................*#1........"..............
..........%. .................................6-?............1)9......
.................!...... .&...............A8K..................'!.....
...........'.1........................ . .%6...4*=....................
...............................2(;.................................0)7
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..........................'6...............0'93 ;4,=.....').1...7/?...
...........&.....IDATx..V.|T..>T].. .@F#.>.*..B....UDh..N2S.....
;..n.e..n-T...c.....1...Q\6e...{c.c....K..vq...y.....d..~3.......s....
...s..=..g~.3...e0`.58S  d....-..`.!12....AS...|..B..S!!S....te...8..t
9.......F......3u.D...^.4e.p!..S..K..,.={..S!'........:{6.c.....#...3f
[email protected]..,\.d......3. ....g.Xrt!........~.......C.H..
.G.N_........BJ.N..IA....@>F`>./._...}.t.p..X.J.!......c.~.t.R..
......o.............8|....)....'.....?|.^..C...U.>}......B..f...>
;.`........K.CJnDW.|....`.1q.......K...dd8%....S...>9....}.3...F...
(.....qs ..x.......m.......p.....g?[..KWt........k...|.12.Q.V..W.b...?
..s..<.HK.z<.!M....Z.:]..i.d.b..l..l$i...[Z...$.I.wf...Q..Jd
<<< skipped >>>

GET /knctr/css/images/phone_icon2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:34 GMT
Content-Type: image/png
Content-Length: 14086
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...<...x......5......tEXtSoftware.Adobe ImageReadyq
.e<..6.IDATx..}..\.u.._....l...D%@.$H.b.D."U,..%.........4.NN..8q..
.$...'.t,.(.."..i..I.M$.B.}.....N..[...........~...............q.W..ul
..,.....@......(...E0...=..6....C....rK.EA........$.......>7..8..f.
Lh.}..H.I.g.4V{  .d......U3..!...s.A.U..T..J.4|_....|I.6}............%
QQ4I._).6Z...(..|.#.*.._.!.-.`..P.ea.......P.N|.-.#.D...E.avm..ZF.....
Mv.n..x:..2D`.1..(. FN3..X..8.%.D.........\.3......&J.......M.(.y.....
m..v......m.{bO.a.Z..]Te.dI..%..:H8.G.~.C....>...zR.5..3....>..x
P..7D..E..._....0.X..l.D....\]...?.z......2.....dA.e >z...a!. J./..
. .B.....$[...V'.#...hV.....m...7.^.-.X.......%....p.;k...'.V.....e..t
I/.Y5..F..M...z`.6xa.AL...&qZ$b....A^2.$...."..a.=Z}3.....;.w.. ....(.
.S.Ka}..&.....I...}.H..g.... .......3`....M..M$.....8;z../..<......
.....B.D..A.....T....b.......w...yW...-.......#..MQ........*?X[.......
.#`.>..k....#=.....)D.A.:...,.?f.k..G..cP..f.I....-V...............
x.0.|SV.Vq..vK8G......G.......w.T.l... .&.9 P.... 1.1K....q.../..W.?& 
.l...Q...u..va...ve.........O...-.p..M..m.........]C.2......~*..;6.7..
..Yk...U.b..LLs....]r..9;...Zk..D.,...qn}4`.Zo.t...6...;..?#.Rw....g..
.M_..9..."Y......'...."(.].......C..{.r...zy.Y.E\..'*r.J.F7. .D.....k"
.8i......p....E,B1.`F..;.;!.N{...&..o.....m.}...|..se..k.,.....=G^.<
;.......b.!.t.a%\..........y.."7.....yx`.m..|.....l04..........<D..
..!4.....2S.K.....TkNl.9.j...j..:.t%..ZF......^.X...... ......,..(f.7C
\yn...eo.....8.N..].n......].<5..|....g_.g....r....-@9B}?.VAl.p
<<< skipped >>>

GET /knctr/css/images/feedback_icon2.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/index_tabs2.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:35 GMT
Content-Type: image/png
Content-Length: 13861
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...<...x......5......tEXtSoftware.Adobe ImageReadyq
.e<..5.IDATx..}..^gy...s...=..-Y.-/...ll......@.!.)!..P.4.MHiiI...4
I3.R.!.8...^...e-K...{}{.....9...|.........s..}..YGB..x..N.F.a!.#...Q.
....(.........`p..V..R...s.I.D5...(....2.W....E...0.%U.DAl.].G.@V.....
[email protected]=.K.....eT......`./.C.E..E:.?R|70.A......IF.=b @..-..
..X#.....(.....\.eaV..f,.....|\...[.q(..a..43.*.}/...`...Q...i.B?..A..
..8.8..8.d.S4..2aS...Y.O..4.h....&JB....$..kA'i-t[v..i..n...p.t.......
....b.^Ib-1...-0.f..B...........y..,...la@;U.....N..MG......S'.5......
..l.....m.F..iE.c7.R.-#Ab"-.a.?.i...se.....@.$(.$.>r.-.9.....JaP?. 
5..o-./[email protected]}.0..A.....;...^Jl...
LME.[.%"X..........a.N)...~.k/FJxd|K..-;K............:..`......p...s..
..50q.....P..ob&...6..,NdD..'......c.$.&...*.....G.. ........M.;z.`m..
T{....F.7fF....].|M9,..z...:{...6moW.m.&.#]..._.._C7..G!..#.."..x...W|
....}2-'[email protected]#d.d4.Z....7.,?.}O..lI~D..zi wq.f.WQ.1...3u.......
...hg.y..Ig.-..8....uc<..k.....P$.....i2..Q}.;.M....#3...g..i._q...
.....J...$X 1.7....=....F.d..e>.y.]..../.!.S#nz..H.^....-N.:I.i:..h
.....l..q...lI.e.2.....{...G6....l.Y..=~..w....vu...q.p.-v%.1.fwv....f
.....2..../".a..0.I.d.x.>}`.:. ..a(....../|....>.u....b....w!...
......s..u.U.....pM..;.*.&)J.7d..p..R..>.gf...........)ro!.._.Ampl.
....OUZ#..NkF4........... .J..I........."vo.....$jhq...)W/2.d.........
.T...E..0...X...."..Kk.%_......_Xm.!{..u.....aZ.Z...~ew}.}]V.^EVS<e
.c..C$..jb.F/.._..H.CgV^L,..8-..i{.;.`.....4.@F&.m.l..Q.].....h.%.
<<< skipped >>>

GET /knctr/css/slider_images/ui-bg_glass_75_440a4d_1x400.png HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:28:56 GMT
Content-Type: image/png
Content-Length: 191
Last-Modified: Fri, 12 Dec 2014 20:31:56 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.............._:M....IDAT8.c..n......0.......&.{=.&e}E
z[>.>g.u...................\d`.R.d`.U.a`........1..|...n.....x8.
.x.x...E..........x........Y...KG.j..yV.]...U....IEND.B`.HTTP/1.1 200 
OK..Server: nginx/1.0.15..Date: Wed, 17 Dec 2014 18:28:56 GMT..Content
-Type: image/png..Content-Length: 191..Last-Modified: Fri, 12 Dec 2014
 20:31:56 GMT..Connection: keep-alive..Accept-Ranges: bytes...PNG.....
...IHDR.............._:M....IDAT8.c..n......0.......&.{=.&e}Ez[>.&g
t;g.u...................\d`.R.d`.U.a`........1..|...n.....x8..x.x...E.
.........x........Y...KG.j..yV.]...U....IEND.B`...



GET /tag/js/gpt.js HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_banner.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.googletagservices.com
If-None-Match: 2852351686543807347
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Date: Wed, 17 Dec 2014 17:39:58 GMT
Expires: Wed, 17 Dec 2014 18:39:58 GMT
ETag: 2852351686543807347
Age: 3030
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.002
HTTP/1.1 304 Not Modified..Date: Wed, 17 Dec 2014 17:39:58 GMT..Expire
s: Wed, 17 Dec 2014 18:39:58 GMT..ETag: 2852351686543807347..Age: 3030
..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.002..



GET /gampad/ads?gdfp_req=1&correlator=2301890974904160&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&eid=108809028,108809034&sfv=1-0-1&iu_parts=282654509,knctrC_bigbox&enc_prev_ius=/0/1&prev_iu_szs=300x250&cookie_enabled=1&cdm=web.itibitiphone.com&lmt=1418840893&dt=1418840893020&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=1144579259&oe=iso-8859-1&gut=v2&ifi=1&ifk=45333344&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ref=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418840893&ga_hid=1496577444 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pubads.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Google-LineItem-Id: 383110549
Google-Creative-Id: 40508800309
Date: Wed, 17 Dec 2014 18:28:13 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/javascript; charset=ISO-8859-1
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 3253
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.002
...........Z.s.8..W.... `s.pMQ...'.E...,...j[@[email protected].|HW.d....w
.P.#.3..\...D~.n. .J.^.... .4..5\.......W:...v{....].~%o..Ldxl.B^B`.-2
...*.2C..$6...M...2.qB'....vv^....` M%.za.........Gn.Rb.]s..... L..Y.$
I._.uyI...nD....!....Y..P,....q...F.U$....V.-...%..U*..'...[e.C.%`a.%7
H(.0c..1.(1..8`..=.......LI%Cg.c&Z,..8.!S.D.....]....4..Y.%...........
..?2re.....c0.....2..<[email protected].../...#...Ir....Ej...~.
.f.IE.d....R..;[email protected]..`(.u>..3.0.........>[email protected]
.u....0v....k#.....H..[rJ...]...-.........4..lf.%.2pF..U.sG.f.K....B..
.L.......\^..b.Q.m...........1.F1_....(3.......=..$.G...%.11..]b...kE.
..%M.i..cqDy_....y..%..(.XH8.....' ..).Y.. Yi#=...[.G//m...//........ 
.v.....r..........m...L9Y0...;.....7...........Q"o....J=k.....,..e...Y
.....P.c..g.I...5%...H....y!.ph.#j.l..g........L...]J..N..me.......S(.
.....y..T)...z...&'pV..3v..t;.$.|d.........A|)..b(..fNL,.)k.&Z.*f &ID.
oQ*3.Q....JT.b..DR.......$=....~.Z..H..U ([email protected]:wS
..)....H"=$.%m.7....29 c..QH@....>..4........O...H..B.!.....s.4e.tM
..]..XB..i.... ..)..x...m.2I..../..K.yK..BC.....T...M.....T/s.....$.X.
...|<[email protected]...;.*,....)..?......l...0.}6.m...'......./AH'...5.
r R....2...)....B:.....!.. ......cd....t~.B:..B.uE.!./.. ...; ........
B.:O...Gx3.....&p.....k..........~.,...Y<X.......l...i..w......c=..
J.,.:.L...X).B~.R...Y...:..:..E....vV....../..>Gw.4.G08u.J...D.o"..
.C.V.....aq.....m..4e....SE..z...........u..S.C..2T\..-.wp)....f.)s..z
.1`.....Z..0g>%.U.<.$E..4..Q..C.p..F..F..F..u.... E.[q....^.
<<< skipped >>>

GET /gampad/ads?gdfp_req=1&correlator=754948230998804&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_leaderboard&enc_prev_ius=/0/1&prev_iu_szs=728x90&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418840912&dt=1418840912369&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=3538004474&oe=utf-8&gut=v2&ifi=1&ifk=443509494&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&ref=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418840912&ga_hid=1390386811 HTTP/1.1


Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pubads.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Google-LineItem-Id: 383110549
Google-Creative-Id: 40508800789
Date: Wed, 17 Dec 2014 18:28:32 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 3130
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.002
...........Z.s.:..W.l.*. `.....9.0..".R.,l...-s...oK...03.....!SE...V.
...c.8:.....O...v.|P......b..48.:..$.}.....v.N...]....l...d<@..t...
....d...u\.[.....&a....1...C:qH........c{}i*a...../.....>.C..c....I
.v.aj...%I.....K..8..tI-...}l.......;.A-;...(]EbY..`..'!.....r.....l.V
.GW`.X._..B.<[email protected].>R^r.1..kls.D... ....)P....g.0..l.
h."..:.g....z8..B...\.e...=z... ..X......,...r...g{.`.[K....1.Mb8...t.
.O`...HMX../......M.....;|......... ..K.H.....rVZ.y....||.,C...._q/.a}
.$.:..jj....b.F.CC.D....-.J}.d....M.x.-............|n.%.2pF..U.c...j. 
...R...L...f...W7|9.m.q.....3)....!f.Q....>'J..SJ.iB...#..........}
..1n....J.........8../.:.X..F..-J*....s.(.!H.o.@V .HV.H.4x.-.........W
E{.)2|.4.X....W]n...f.Py.Kok..'....C.op.."P......./[email protected].......
$..e...Q.....Q....s. ..o...gdd......Q8....[...sEVx|.L.t..x....J'......
/.....ru...JZ...U.&.'.a..I....q..\.o..P.....<.....3./%-*.2.mf...7e.
[email protected].$...-Je. ....V.rX..J$.j.]/..H..0.|.6..Dz(,..A...S..}.B.'a..'.&.
.]...x>....oHa$.."........@'.".d...cD!..Fzg.0..H2.$..j.;..G=......#
(8[......6.....g....I.ks..-. ~.......$Y0...../.g-..s{...gl.b$.dZ.X...z
.k.... a.b.......*........s...YPa).6.I......4^.%.....h..|3.4?!.'......
BZ......}.J....!..L9.t...Z..n..Y.....!..kdf....~.BZ..B.uE.!.o..;...; .
.......B.:O^..Gx3.....&p..G.. .w.....N.-..Y....x.).Gz.......H]...&]_\.
..a.V.d....4Y.....e.zJ}."i..\G.\...H......^>......k).C.q2....R..f&.
x..?..C......G.-0w...d.i.........4..4...."..........X...........^.@..(
...-.....?.J.a~L..H.*J.i........}..O8.y..y..y....Q{Q..|.-.6.......
<<< skipped >>>


GET /VVV.adobe.com/images/shared/download_buttons/get_flash_player.gif HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Connection: Keep-Alive
Host: wwwimages.adobe.com


HTTP/1.1 200 OK
Expires: Wed, 17 Dec 2014 18:40:45 GMT
Last-Modified: Mon, 15 Dec 2014 17:49:44 GMT
ETag: "7268d5-6b8-50a44de1c3e00"
Cache-Control: max-age=900, s-maxage=300
Server: Apache
Accept-Ranges: bytes
Content-Length: 1720
Content-Type: image/gif
Date: Wed, 17 Dec 2014 18:28:13 GMT
Connection: keep-alive
GIF89ap.!....Y........sss...<<<...333.66....pp.......((...ccc
................DD.##t...ss.>>......lll..................TTT.ff.
...............33y.....k..JJJ.......bb....XXzzz.dd.........f..........
....................33.............UUb...uu...k...........q..BBB......
......{...FF...XXX....tt....DD.KK....}}....$$....54.kk.........^......
......DD.((...................................................!.......
,....p.!..............................................................
................2...."D.&&.................=.....D....................
j....N..w.>@.f...]........s=.M....4k.>.`..d...........&.(.....#,
(.....D~.X8...c4.(t].y3..].~.. ...-..`.....#X......V,>t..' ">...
..(J......$..S.....@.. E.];T....lc)3|. !...,^$..qd2.......sP...R{.....
$M..1R"'.O4h|Z.%K....x......**.P.E..-*.X.Cb...Xfdx...h....f.........M.
..O.@,xp...%...8.)...*..\%X...w..0..$T..eZ..Ew....').............z%.X.
........R......~..0.f;.X..:(...>d...X8....&YI...m.b5P......QC{'....
..........?tP.p.....3 G..?.........?.0...)I!.)..A..\s...pQ..Z...m~F*i.
..j.M{.....j....N*...T..^..WC Ut.*.<.!....j..K......f...JpB..Na...V
... ...|...m........0..,T.l.....'....|...,.?0{!..&.k...h..l......k....
...#......p............,<[email protected]......).b.Q
.......8.....C....J,...5<.%.kL...hC...}......5%'....-'..H...)...R..
?.|.......g:......B.....~.R.....y...8.A%..61...Y..J..T...;E...... ....
oCa:.rg..%.a2.. ,|...w@.&.w.:,.8..-.]r{...P.'..>...{...1.Az..3a...c
....= ...r.....x....hr..g>@..f.@<....~..'.I..6?...k...H..\..
<<< skipped >>>


GET /collect?v=1&_v=j31&a=1912250307&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MAEAAAgEI~&jid=&cid=1489344308.1418840893&tid=UA-42318620-2&z=368998375 HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 11 Dec 2014 02:30:50 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 575977
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *
..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options
: nosniff..Content-Type: image/gif..Date: Thu, 11 Dec 2014 02:30:50 GM
T..Server: Golfe2..Content-Length: 35..Cache-Control: private, no-cach
e, no-cache=Set-Cookie, proxy-revalidate..Age: 575977..Alternate-Proto
col: 80:quic,p=0.02..GIF89a.............,...........D..;..



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=402401, public, no-transform, must-revalidate
Last-Modified: Mon, 15 Dec 2014 10:19:02 GMT
Expires: Mon, 22 Dec 2014 10:19:02 GMT
Date: Wed, 17 Dec 2014 18:32:21 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2014121
5101902Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20141215101902Z....20141222101902Z0...*.H........
.....A.?v....x...R..IV..........9.%...OQ.&lm..L81!.l4......v,.....:e..
.....m.2\$K.I.GS..E95.J.G;...T...lj.....f.=.5!$..cM..0'....F.k.n.$.6s.
..V.<.xbrT....).nC...`Q.m18d.....V...?9O..X.$...bZ...[.....%z^.....
'...l..e....b.(q..CH. .........T.M.d.:[email protected]!..-,....#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=542640, public, no-transform, must-revalidate
Last-Modified: Wed, 17 Dec 2014 01:14:37 GMT
Expires: Wed, 24 Dec 2014 01:14:37 GMT
Date: Wed, 17 Dec 2014 18:32:16 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2014121
7011437Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20141217011437Z....20141224011437Z0...*.H........
[email protected].[k.2......."7..".m...".=....z.C.........(....F-Q\#.....P..
...;.....":W.......'(........3...r.....OB..............JV5...7X.*..QM.
...Uf...6.....g.p.#....98..&...<.......I.@.|../!.qT.....W..qB..o.x.
^(..3.#....}.....o...Lq...Y.~...X.\.?......~..opF.u......#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>


GET /knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0 HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:30:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
1fc4..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en">.&l
t;head>..<title>KNCTR</title>..<meta http-equiv="Con
tent-Type" content="text/html; charset=iso-8859-1" />..<script t
ype="text/javascript" src="js/jquery-1.4.2.min.js"></script>.
.<link rel="stylesheet" type="text/css" href="css/skin.css" />..
<link rel="stylesheet" type="text/css" href="css/skin_channel.css" 
/>..<script type="text/javascript" src="js/phone_js/itibiti_phon
e_api.js"></script>.....<script type="text/javascript">
.....    var getVideoID = '228392';..    var getChannelID = '1';....if
 (typeof console != 'object') {....eval("var console = new function() 
{this.log = function(debugString){}};");...}......if ((typeof external
 == 'object')&&(typeof external.Debug != 'undefined')) {....eval("var 
console = new function() {this.log = function(debugString){if(external
 != null){return(external.Debug(debugString, 1));}}};");...}.....funct
ion setActiveVideo(theID){...    try{..            if(typeof(parent.vi
deo_menu.activeVideo) == "function"){...        parent.video_menu.acti
veVideo(theID);..            }else{..                setTimeout(functi
on(){setActiveVideo(theID);},1000);...}..        }catch(err){..       
     setTimeout(function(){setActiveVideo(theID);},1000);..        }..
.}....function RWCall(fn,dv) {....if (typeof(fn)=='string') {.    
<<< skipped >>>

GET /knctr/kn_banner.php HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: web.itibitiphone.com
Connection: Keep-Alive
Cookie: first_load=yes; _ga=GA1.2.1489344308.1418840893; _gat=1; __gads=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w; _ga=GA1.3.1489344308.1418840893; _gat_SecondaryTag=1


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 18:30:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
583..<html>.    <head>.        <script type='text/javas
cript'>.            var googletag = googletag || {};.            go
ogletag.cmd = googletag.cmd || [];.            (function() {.         
   var gads = document.createElement('script');.            gads.async
 = true;.            gads.type = 'text/javascript';.            var us
eSSL = 'https:' == document.location.protocol;.            gads.src = 
(useSSL ? 'https:' : 'http:')   .            '//VVV.googletagservices.
com/tag/js/gpt.js';.            var node = document.getElementsByTagNa
me('script')[0];.            node.parentNode.insertBefore(gads, node);
.            })();.        </script>..        <script type='t
ext/javascript'>.            googletag.cmd.push(function() {.      
      googletag.defineSlot('/282654509/knctrC_leaderboard', [728, 90],
 'div-gpt-ad-1375898897251-0').addService(googletag.pubads());.       
     googletag.pubads().enableSingleRequest();.            googletag.e
nableServices();.            });.        </script>.    </head
>.    <body bgcolor="black" marginwidth="0" marginheight="0" top
margin="0" bottommargin="0" leftmargin="0" rightmargin="0">.       
 <div id='div-gpt-ad-1375898897251-0' style='width:728px; height:90
px;'>.            <script type='text/javascript'>.           
     googletag.cmd.push(function() { googletag.display('div-gpt-ad-137
5898897251-0'); });.            </script>.        </div>. 
   </body>.</html>..0..
<<< skipped >>>


GET /thumbnail/celebrity/SPL914321.jpg HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:42 GMT
Content-Type: image/jpeg
Content-Length: 3843
Last-Modified: Wed, 17 Dec 2014 18:05:31 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
......................................................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...
.(... .hC...%[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@..Q@
[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@..Q@..
[email protected].......%..oZR}...P).&:[email protected]..(...'JZ.$.RPKV.(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(....)..jR3M1.....&..!,i..Z~.@^(.
 w..D.*..!Ph.u..`.s.. lw...-.....D....R...e.`..(.QE..QE..QE..QE..QE..Q
E..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE.
.QE..QE..QE..QE..QE..QE..Q.(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...)3..Z(...(.....-......QE..QE..QE..QE..Q
E..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE.
<<< skipped >>>

GET /thumbnail/celebrity/SPL914257.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive



........T..F.....]}..qh..U.\p....&.q.V....J...X..s.J......F=k~ ..U.qS.
4?..\.....c..p ..r.... ..ls\..$.q...Gs*.j..k."...i...2..V..J...s:..,#S
.zf.P..#..][C.fb.$8.<..n.B..];..xb...6F.}~b?..5.S3{W.Q^.Wji.....eS.
r s.....`..)..'.R..W6................M....T..n..4..58R.W4.c....j`.....
W...)2....c....$m.:.m.[.7.j....q..j..z. [email protected];.W..bEc........
&.g5ZC..ZU..%..<..M7M..7i........){V...d..{zh..-'...U.O3.........?L
...E....F.H.....y...S......p....; v.... ....bmR........R"R.........WW.
HK(F......5ZuR3O.B..............<..u..H...>..\.3 ...~t.E{l~ .{Q;
H......%.......Q.K.....Mm..k.s...j>3s.mS...^}q}uy&.....oG.3...i...8
.Dg..:........[T3uI.B..z..:.k.y......GV...ES..k'Q..O....(.$NT......kNu
.k.f..~......>o...N.....iv.OF..-..zcr..F.:e..................r.B..'
..J.....,......h.AP.Gj.z..^.j.G.6.jB..P...TaI.Vyi......F.......bw.d...
..3..z.w:*..<c.zZ...3....<.._.?.L...J..d.-.U^..>...X...EW.U..
..._.7....Q..F.e..c.5.^.?...3\M...f..~...z4I..?.K...Ml...O.....*.*...~
......*..^...PJ......)..o7..Lo...S...............`%...dO..O..R2.(....$
^../_...d...fh.=X.. .C.'.... 4$d.__...y...1...c.Lg38=im.i.&......k.?*.
.f....X...5j...I.cWVR9.{..g.5.........I.2R..i..[g.1{F..VJ.w...FM.... X
....{...{K...;].$.....T.[-....j......\.U.....(..E8....it..#....:y.....
K....}.A.......R......}......Z..MK..V.....=.f.....%...PX......5u..5.=.
.D&..../..._........(...(E.9[u.?#...JQ.VO.m-....9<Rb.#..Q.3Mh.:H..4
.#.(..c.K...k.....~b .HUk..]..jd.2.{T..vQ..)-..ly9..'..<.i.[zU..p.t
..6rj... .Y.|`f...5.6z...7.......|.C8.B..u..$.Tc......W...U...W.j.
<<< skipped >>>

GET /thumbnail/celebrity/SPL914094.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:43 GMT
Content-Type: image/jpeg
Content-Length: 13764
Last-Modified: Wed, 17 Dec 2014 10:35:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
...x..........[.65Me..f.....QR2&..kI.:ZE..~.....n ..=i.....4.y..H..u..
 .:.N..6J......(....m!...IQ...tQRG....)fv..:............u.......?.zg..
...>._.....:.?.....0......I.............2) [.#T.......'...Q./Q...w.
.~d...h.6........u..~d...i.a....s..~d...h...h.][email protected]...?.@...
}..K........i.[..F....#@....([email protected]
[email protected]@GM.RV.2.~(..%--.)..L..GL.3K........5"u....j......]=.#Tk
.IQ.IRh..S.(...O.....;u2...9.ZF..5.....D..-....5gKZ.Y...#...s...\..^..
.l.jh.5.A...j'[email protected].\.".IQ..05T.......
..u]..i.Kv...@<Uv.v.rsfQI../mL[ehu.x..n...../....C.D..m..4..!..s...
..F[}U........=.F.V..kH$...f....t'........cP.D.?...r*..q.rI"i.W..5?./.
uV..O<.k....>.PoS..VP...I$..s..M..yn..s.U...(........V|....M...p
.pj...c...X.T...B7WQY>.K....?..2.$..............,...j...*..*...%...
B6....s.g....u..Z.....f..Msvc......-.V......k.....M0.._..o..~.. @R....
.._....._..}...}......*...C.>..}.....7.6.....?..hR..Q........_.
<<< skipped >>>

GET /thumbnail/celebrity/SPL913657.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:43 GMT
Content-Type: image/jpeg
Content-Length: 19301
Last-Modified: Tue, 16 Dec 2014 19:35:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.N..k....II.J.E%Rj.'J....d....j..]Q3ev....x....2z.O4...T&.b..Z.INjmn..
b..T..Rd.&.Zgj.X.Ru4...`...Jj.e......N...)...)..C.......Ja.O..h.T...O.
..H..........q.......>..q. bq......^......Z../C..6..._Hx.R0.:.`0.Rv
.'4.`%!.Q@..#...).........{...g"...........?}.A..5a.g...o.......B...4.
..4.Q..u....J ..Y.5|\I.P..W..PJx.j..%D.;u5..w:.......e..v.PM(.|.T`..x.
......{.WR.N. ......`t.r}......h.}.......Q.B.n".XW?.s...G.^d.o...r~..A
.....6d..... ..k.Y.]N:..#Ks)....K..p&...#k...M].E.dW3.....Z.Z"..~...Zn
.....0...\.f.........h7Y...?j..y..5QT.]qK.>.5.z.F.b.b.F...P.]2. ...
.JL.Ld2UCW$.T.m.....P.Nj...f..Q0...By....5.....9..3.aZk._..@.SZ.jt.).&
gt;....G5..s]!....3.....(.....b.......f.O.Y.f.....}.......F...._..V&.J
...t....5. l....'....e......?..U...{....O._.e..W.........}......._....
...'...*w.#...i..o..a.O.?..j...Q........F*_-..7.j=...*.I>...>.i)
p}..w]....C.IM#4.a..).*JbK[.<RS.4.&......O..ESC..~.._...G.^..'..R.J
....W[....O.c...x._...=j.K...'[email protected]
<<< skipped >>>

GET /thumbnail/celebrity/SPL913470.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 15511
Last-Modified: Tue, 16 Dec 2014 11:05:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
...A ::.J....&..MP.1..jF5X..1...)..a.W..I...d.t....5$.l........=..J.W.
..i.V.K\..Z.e.....wP..ou1..=.F2..z..Tk.s.T....;>.WK.$.z..d.Z3..z:..
W7q......}.g%..,.A...........H....KIVd%%-6...J(..RR...E...R.P....."..i
@y..."........W.h. .....U..7....7..j........M........5...f..Q...Z.....
.\....L.f....sU.ts69z...r ...j."...l..V.d.k....r..Z.....5....;..2.....
.>.Qw'.j...j..x4../.$.8.k^..Mc7Z`6.(...(....u.&))....i.S..Fj"jCP...
...V|u...%.T,i..v4....4.i...JZJ.(...8U...H...T.r......WA...2.....'...:
tl...j.OV$o..H...........V..f...R.O*.....Julb-:....;.JZ.0=..W......R..
.v....B.-?....0&.'h..@.....'.).. .*...g\..V3.#.Vv]..N 7$.Ql..f.?...R.Z
...o.s..*...RT.u......t..e..y.O.A......6.d|.....[X....... .........A..
..).....Fd.......a....)rG..4..Lj.k.....k7..y...?.z..-.....]....w......
..rz................5...g..~..Q.. uU.k3.Q....=...Ygg..Y.&A;.~....P\ ..
....t.y>.9'..9.".#;..O..V..p.V.}.I$Kl..3.......q4g.5f.vB.;.#M...L."
...l....e].y3K........8.............U....{r}f...C5.F..Z.^...7.Ta..
<<< skipped >>>

GET /thumbnail/celebrity/SPL912893.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:44 GMT
Content-Type: image/jpeg
Content-Length: 12407
Last-Modified: Mon, 15 Dec 2014 22:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
....o..'.)...C..<........J=.....O....R.;.....q..9...(...E$.FM.)i(..
[email protected]@[email protected]%-..RR..E%..QE..R.R..E.P.E%-...xCJMOR.....gpz.~U....\U}.
.m?..Y.a..r....x_....CG.../.^.j......z..F 2........A.../.r.....y..C...
.B..YH...u..Er..IW.1.?O.*....@.^.yZ6.TH.J~)..J(...(...([email protected]@..QH.
....(...(......(...(...).QE..J)h.....)..m>[email protected]...(..@-%.S.i(..
..J(..RQ@[email protected]@..QL.....ZJJ(........;g...... .......k..x.....acEE.(
.xw..>..It...N?...?%..z..C15......c...>.......R.T..pG....;....6@
..n}k....K.YG.b.3...e  ..r%..@[email protected]'...ZQ......8..\.:.$hTgy>.j..
.0=k.....s.>.c....1..v..:.9...f<[.......9.._....;nv..|.....$...w
..9......\.t.$E3....Y...S..[..W.......S.d.d.Ou*pj:..Z)(....(...(.)h...
JZJ.-%.P0..(...).QE..QE..(...(...))h..........(....).}%6...IIE .4SsI.`
>..3E!....)..)[email protected].@?4f..&h.\.....h.L..)sL..ni)..C.N...}&....k
a..-$P..9c.f.3......G.....3z......q].j.(.U.aT.......^.ai-...\.Oa....y.
.....1......f.z0..W.=O...W...Ms)........T..o.f.........VE....>.
<<< skipped >>>

GET /thumbnail/celebrity/SPL912827.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 21555
Last-Modified: Mon, 15 Dec 2014 18:35:17 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..Y&o...^k1.W.....'..W.t.d.....R.....,.......Tb....#.:.._.b.. ....._..
O}&..........3.I.z....9#..Q#.6.Wd.......x...........D.)...., ......C.G
F_..".......t*....)S...>......Ti.......U..a.5......w.jWr..Y........
EQ.o..Y...$L..T..#..Q.....x<P..:..5K%...'.(..hw.z..k..'r..i...Uea..
d......14..Gm...<-OiI7....."........=...\s.. .(.Z..E....,.#... ....
...I$...]xH./........[.C....A...VTg.......=)9.H.M........-..v...1L@MG.
..S.....n....I.(..=../.fh...H.*<.d...xv."..V80....~..I3..#...I>.
N)]..$..oqR/J......].3Q0..V..?....4.......*.)K.4....NdU;W.u>..'..7.
0..^....L.qK..i...:.(....K.&&)....V..ww.*...w`...$..V$I...]...C.../..O
..F._.............L5F...ka...?!.9....X.'..X... k.>X....7..}.f.A....
..<..K..Y..?.........[...........j...a.......TC..t........9...!...^
...S....~u.$....^...]...J./l....?.^Eg5..Qvg.F.y.W.......Lm.U.v).d..D.&
lt;.im.O.U|..A..mO.......6..x....3^O^...-.8....k..B...RdR.)M&i3@....*%
..Z#.[...A.A...../..p.d}k..5..e0.I..>...~.....)T......I$1...K.g
<<< skipped >>>

GET /thumbnail/celebrity/SPL911156.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 20876
Last-Modified: Mon, 15 Dec 2014 16:35:17 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
. .In"...O?N....\...!...X..~j............../4!3u/..0...p...9..}}.b..).
w .j...:_,.8.....s..n.....Y.=....,c.<f.8.m..dc.;\.63..x.Y7.m/...8.n
.........w...ws.>\J.k.y...*. ..Pg.H.j..*.xg.z..Tp..*..;......W[..^.
"..&0FG.Op*.*(..\.oZ................).5D...1..g..7s.I....G;J.......m..
.........k...R{[email protected]>.#.
....k..........EL@4...... 2A.[E.P..Q&ni...QQ.LFu....?..J....R.....V.(.
.`.QE...Q@..([email protected]. .E....bb;..TtQ@..(.0..).QE..(..`.<7.[...x..
.??Z..C..i(..!(.c.5e..2..d.....Y5.F.7t..b...2E..H.4Iu,.gh...Uz.SPH..(.
..i.V7...mJ.4.j..`.....Z2.j*..r...z.......j.dTQElbLE0..."....W.....'.T
.<....p.p.#..Tf.=2'&..q..a.......JL...q.Z....Zr..UH.y...ZM...{.v4..
.*...\.u<.5.x.FM&j.q...&....8.a..4../^..if....AX!..*_....Q$........
.f."..9....\..uw1..s...u..[..6..........0.j.;..G.............)70......
.z0.".....Tt..fX.(.y....X._8Vt.d.RH...sN...a4...V...R.....[w_.[..u..w.
QM.R.N..M_......._mi..z......[...s.]...v......}>.:..Q.?J..X.}..
<<< skipped >>>

GET /thumbnail/celebrity/SPL911115.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 19895
Last-Modified: Fri, 12 Dec 2014 19:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..jL.jPj.,.P...:..Dx.b..;m... 5h.C....5qV..kU#....S .R.... X^....... V
..Q..W%...d.x^?..Er........*.;..!R.N8..!....(..q..8.t..K.e..q..]......
...6c...H>RG.t.R6..c....\.&.p....=.'e..P.....#.......{{.z..3:..s.} 
5}F..DK..x!..q. .[9-.f....W.%...U..(..du.z........"...=~.9.%RQ.WN.s...
.B0Ku\`....WA...I.. `...n.`..uy=... ..........t8.......7.5...u...G?..P
[email protected].).....i..{f...?Z.....M.|.....i........v..W%.l9.../..
;T.1..x. .....q}o..g.k3.:.......pMg...5..[..`}..l.'...X./.>9d.Z.;..
...=EV}5.V..\.._h.j.B...L.....:A......axOj,I....~....G/....]..Q.....io
t....rvsP.,c;...f.7...3.....$..'....l..EX.R....N..V...N=*..\.8..{'.M..
...#.M>t...s[\.....v.J._.pi....d..~UmQ..7.[.."zU....,.#.....k1.uB..
;~T...... .c.9.?y.z...'..!....... .0....{.a]P....Z..R8..>.A.ri....-
U.Q...sN..f.....I..MX....Bj.UsC..)..#.*AL..@d.([email protected].&
.".u.j@.>[email protected]....]w...9...w.[.W9'..zcy9
.#.i...?.p......;..n.c.....H.. .)...9.-q.......>.N......`/..>
<<< skipped >>>

GET /thumbnail/celebrity/SPL910384.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 15999
Last-Modified: Fri, 12 Dec 2014 16:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?..JZJZ.;......(....(.......E.P!h...(...(....).."[email protected]
.P.E.P..E..R.zTfD^....&...q.m."....S.*A*[email protected]@[email protected]%-..Q
E.-....QE..)i)h...(...(.R.K@..(...(...(...(....(...(..Z(....(....(....
...Q@...(.RSKb.'4...G..(.c.E%..Z3IE.;5 j......uV..b..E.P ...N(...{.[..
....q:....k{b.N...{g....~Y..b.1?Z.0..V=....$[...#.}.S.W.>.{r..R}...
.8.m..R1m.W...#.'cnQ.......\..X..`.....)..{F...b;.J.......=...E*L...).
A....L.....].[.O.)bc=A...~.....2>...Z.Gw...........E..QE..R.R..E.P.
[email protected]%[email protected]@.KM.......Z)(......Z)([email protected]@.E%[email protected]
M.P ..(.j.jV5...QE..(....J(.h.....m........N.([email protected].>..
....o.....f?...R.K.i&l|....n......^.W.F..I'.Z.73...{.i..A.5&k....8....
[email protected]...&...R`......7_.x...4.v~..Z.a...Nq..k.4`..r.|.....{.
.u...../..~........._C......B.(...(.B.E..(...Z))h.QE..Z))h...([email protected]
[email protected]@[email protected]%...Ess_.~..=O-.t.j{.OYd?.,~....NG.Q^ %...H?.m.4...`?
-.....8.....j.<..=.......H[....D._.z..5..*L..eun.. .n-.'rjZJ*F-
<<< skipped >>>

GET /thumbnail/celebrity/SPL912727.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:45 GMT
Content-Type: image/jpeg
Content-Length: 16513
Last-Modified: Mon, 15 Dec 2014 12:35:19 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?..*m.P.E.P...I&*.-.:(..T.5....c..":.ik.'...`M!..........R.AK@.......
.(...(........1...S..=....S}[email protected]..
v.6...:...#.'5i..(..).-<-0..<1......X.=L.Uj(.)|S..P...'......CW.
8...'.h..... ~t..f.N j7....`.r.......xu...?X...*v".Z.N..?...'..U...A..
.x.....^t3uWzs[.#H./..Y...:..O.S....g.p2@'.:...2..]......-....Gv3.#...
..v.$.2."?.GE.....W.L.s5L. Ur.....p..=..G m..7.J...3L..-L.M...y.;.-Q.M
..!iE2.4...i3M....N...)i.."..IE...QE..QE....P....2......Qr...b.. 7....
.*A...i....k....U.7>[email protected].).QE..Z.H.J....
@J..985.......(.=z7.....QKH...(.i...R-.#u...i1.` ..HZ.Ni(...).QE..Z(..
.:..,.}. .".:....M...mS..g...{.G...H).g ....c..V.....Yi.i...I..2|.'..w
?.lv.MC..bIW.........?!J.C..M.1>d.......S....Q...HA........P...<
.>r....I..9?......k..."......{U#}....s....]}......8.....B...\.Y.VUe
....pG..W.S.#.{t.&....U...g.E.|.5.....zt^...)>b.&H.......=c...r.JEX
..6.............{...jW ......]m.;..y;..=OAH...f.J..3........O....r
<<< skipped >>>

GET /thumbnail/celebrity/SPL910890.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 15426
Last-Modified: Fri, 12 Dec 2014 10:35:12 GMT
Connection: keep-alive
Accept-Ranges: bytes
..E.G.Jy...JJZ(.&..~......%...?..C.:.S..Q.ZZ.J\[email protected]@...R
[email protected].^[email protected]..;..M...:.*(.=}[email protected]..$
..T.;c...'..4.c...._..W.\../}.h......./.........F{[email protected]
Ju%.4.S.%.%%:...E-%.6..M....R..mS5r..M....M..LC.....QE....RP..R. ST.-.
[email protected](...6.........V...Fi..L...)@..H.\WB.q.....d.......t.*
...:.S....RS..).R..b.S.(.))h...S....KH{.......R....Z....H....#........
s...99...........g~7..j.rSU#{.k=4..C....;?5d-*..L..c%W.Gl..b."..n....F
Y.."..._..6..TQ........|=%...h.......]D..(R..FK...$.V...M...;..;N.....
....l.M ..<.Q.R..b.i...W2.YWsom........._Z..Q.'......L.......z.\q..
er...F....m6....._.s..L.....S..1...!.x.......$..9K..................Ez
...K.$........t......|/.F..m...#>.:.....nu,..x.A,g.....0.....k:s[..
u.`9........ .G..Hq...z..[E. .......s.....&.)....s...r=.Wbm.. ..ZJ.%%-
%.%%-...)i(....m.%!.........SBd4T..".#i([email protected]*.S.E...)...Y..
[email protected].........#..oE..?._.X.. ~..I....*CD..@..
aN..P!1KKE..1KE.2.N.!.Ch4.... ....;.%.I2....Qq..899... ..g6..n@i#%O.~.
....i...:jajR.J...K..{5..gk...e{f. ...8......b...1.N.......j.M..AY.3.(
v..sU...Iw$.%.'..(..r...../.a...nT.. ...V.=[..F.M...M.z.P9.A...q.>.
....q..\.77..Z.d...(.I...p_1`.|.8..._Z#.Y._.`....j..l.. .Oc..v...w..W.
.~....."Y..ni...PrG.?.....L.......V.R...O.D...O...\....wa....K....>
..C..r....R.D'..?..?J...L....Z.\G..=2 g.....}".$.F.m..]........\...U.W
N..1......F.-..\Vt.`..#.p.<..'...U.Y..H......#L..zV..,.q)TKK...l>
;....^;8....'<...s.}..gy.....=2...../....%....@.%...s]8y....Oi.
<<< skipped >>>

GET /thumbnail/celebrity/SPL910478.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 18438
Last-Modified: Thu, 11 Dec 2014 22:35:28 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.......0....Keh.c...n&...k.`k.....=n_v>.[.E....e...[.)"....%......Z
..........n.d. .......QEmc...(...(.AEJ.c.......[...O.J."p...zW.Wk..fP.
...E.2u.8I.......L.k......r.J.w..y....R...D.P*.7w.D.....9...]Y..!8."..
..5*....n..;../z...wb.(<j...m........t.qne..:`..d..k....F.X:.v..n..
..wB*=.%...y....c....|..v[.U.....l.....C.=.X.......-.....7...Z........
......A #o...$2<..$..9.....(t.....Z..i.:[email protected]
{..*....?Z.;3.......i?..l..(5.Q...:..K-B....n...^....,.....W).h..#.5.1
R....F.1..=g{..T..s..\....s.....W..o.......3B...;.1..8uH...LU9..[M.=..
..<.7 v../c..v3.W=.5#.....Ac.L.D.Lr.....Q...N..Tl.q.*..kJT.j...g5..
n.v...R#9....*e.Q..@..=(.M...O.EV`A...:C&y.Klw;....}9..X..].)..=.h..#f
Dd.....e... .?"..z..X(..1R...]K....`.p{.NJ.....NN.....p..O>.[ ..:qV
.....[.R.7 .r.....OJ..........B.,M......WF......A..']..j..&7s.S`d...4"
tb....".....cd..z.........?Z......g......v.|..sZr.W#1.<..Z........z
S.o..........M...)o..YV.e...A..m..#8....L.......>.,#...:......*
<<< skipped >>>

GET /thumbnail/celebrity/SPL910404.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 15945
Last-Modified: Thu, 11 Dec 2014 21:05:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..(...d(...(...)i)h.QE-0.Z(. ....B..R...QKL.h.....R....Z......%-.S.QKE
1.KKE.%..P!(.....Z(.(........JJZ).JJu%!...........E.R.))i).JJu6.......
..(.........P.QE...QE..QE..QE..QE..QE.-.QLAKIKLB.E..ZZJu1.E.P!ii)i...R
......AN..S.QE-1..R..QE-...ZZ.JB@...:..T7..m.K!...O`.rk./.no........=\
.._..RQ......$.(.........d.....0'..f.K.k....I...G..j....}[....!;xC.(R.
....9....o...l.......w..K.kQ^...s.....>...t..8...?..............T."
O{..m.XMB?-..P..K........(...bQKE..E-%[email protected]..
ch...1))...J(.........(...(...(...(........QL..... ....B..KL.....!h...
.-.S...R...QE1.KIKLAE-..)h.. .......f..).M...1..>..vW..S.>.s.y..
#...r;....\\.}rmm.......>....i....F_.........#."...MK8.....c...\w..
5...z/.. .y@=.8.....{@..r;...N.k..P..<.o.D.H$} .....O.O.{Q..wd..C..
T>T..%.7..G<m....|t .E{.2,...*..}.x.....krpH%>..G..]..5.25...
..N...[..1....Z P.IN..1))h.ch...1...JC.E-%!.IKIHbRS...JJZ).m%-%"......
E.R.RR.P.E.R.QE..QE..QE..R.R..R.R..KE..--%-..KE..--%-1.-..........
<<< skipped >>>

GET /thumbnail/celebrity/SPL910298.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 17030
Last-Modified: Thu, 11 Dec 2014 17:35:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?...R..K[[email protected] .o.`.X.s..u.\.oK.....;..I.2OS
.q..<%..&.o........_....9..M.o.g......e......l...t...CO............
W...v.(6.o..h.H..*....9..O.G$.._..4-...ly.d..(?.(.u.Z..K.!L..=..G..2..
....c..>....?.&.m#M~.V...'.Qh..4....P..R... .........KY.?..7o..?\T.
....#..4.!W....p.2..4.,...U.......P#.....{)[;.$D..{....?..*...9.tm2...
[uWr:.V........i....Gp..0....x~...X.k.E.....q%....x.s.,...X....._.....
.....FO.........k....t.1..y.3.nI.N>PO\c...I....o..o...i.u.<.[.F.
..6..K .<..m6q...O.n..85....h....@#.Q.H8.G..:.C.S.{]?[....../.k2...
^..........z......".(....(...(...(....o... ...q.=...lt.....V.....QH..(
...(...(...(......#[email protected]..<i.......9. [.S.d..
..b>.....k.....Z...}....../.....?.i.N...%/....B~S... . ...cF.Q6.V..
n.=...rq...<........l.../..Q.%.k.O.9.........>.................D
...X.}.N>.......g.v*......W<...,.Z......#.;T~,.J..#...wS.o#...[y
q. .s.^.......n..Ei.=1....9.....q.t..W/..S. .~#5J..q.....Ue9.....}
<<< skipped >>>

GET /thumbnail/celebrity/SPL909503.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:46 GMT
Content-Type: image/jpeg
Content-Length: 14053
Last-Modified: Thu, 11 Dec 2014 16:05:16 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?..*))...BR.N....%.m...p>........V..Wo.......SX.$.-)...z...Y...QV.
5.-t..j......*.`.._.%.!B..(.z.....g}b%.....3z.a....\0\........R....d..
...Z... Kh..Nw1.g.~....F.[.....]"[email protected]..[.j.]&g.x..l..7..\.z
....n.... ....6..%X./Ju1zS..A7..?.?...]...........3...}0T.....R....).R
.R..E.P0..Zb.(....e........?..W.3M;.....~\V.|..'..Ml..Z*......>g...
..........|.7........^.....E-%z. QE...QE.%[email protected]
.....?.M\.vv-..I.SYF. .a..X b.`..X?...&.J...b......".~...."......Be.4k
.5...9?.9....z.y..S..._./..k..B..=....B.........&.m..o.......L.......L
.ZJZ.P.i.j.y...-5.F)........F.T..s...m-..UQ.....8..Q..zY.).R..aU..fFF.
[email protected]...*..._..aR.NX(..j.........HU........=.
8.j...RVN.s%....-.....k.....w.a.....W........w.......IJz.J..W.>..).
."..[.....q..I>.....qU..fJ*J.T........Z(....(.........f..9.r.......
>..|.....:E.{w....g[.J..a<.....a..t..^@.=y.=.8..&....$t8..##.W.&
lt;?4.R...*..V=....o/...G\7...s..]w..\B..-.1..y.k.Xz.kK..U..:...0.
<<< skipped >>>

GET /thumbnail/celebrity/SPL910136.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:47 GMT
Content-Type: image/jpeg
Content-Length: 12673
Last-Modified: Thu, 11 Dec 2014 12:05:07 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.JZJZ..h....J(....(.QE..QE..QE...V.l..R......N...I..;w. ....s....u...Z
n...".'"...G5u..i..[t:.-p9...u...T.Q.A.8U...@ F.....l:WO....t.....o..Z
....HV.52.......x....0.......Z#6..(.V.F..q....A.vi..;V<..$j...H..r.
.V$5.`..8.Z)[email protected]$y..J..il^.;qo..\...3^.$`....s]...8.}$x
..WMqo......S8..R..E6..(..b.(...(...([email protected]@.%-%.%4.....R..Z.......
..).(...(...(....$....SU....hV...wFSm.y#...^.5..$;......w.............
.B.I..H..'........R.x..........^.5..K...j...o.........../..dIv....j.T5
..V..i9n....34.(.(|v...*uS.Vu...:x..........x.....R.....\--.TW<..c.
...YM......T...I.........U.4R..^.^_q.....Y...9.......U.=............)h
.B.....T_.........UX....'.......^GN.5..'V^G............T..K..Y........
)..P.............?.,......~..n..T.....F............'.l.....|7.W.QK...~
G.6.fzH........b..z.......K.G..k/#...g..=......C....j?&.....Z^.>a..
.w..[.......E............Q.'.K....`...~....i.d.k....._V?..tG..^....x..
:.MF...._..y.-R.G...'...1.N.y.[........g.).k...QK.2u....A....f...y
<<< skipped >>>

GET /thumbnail/celebrity/SPL912686.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:47 GMT
Content-Type: image/jpeg
Content-Length: 19919
Last-Modified: Mon, 15 Dec 2014 10:35:06 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..(...(...ZJ(...(....m..U.1MU.5%......F.=...p.5lh...6=.....5...S.2...x
.Y[#...a.[.s\.r.8^.i...:...Q)\.YK.../.e".EM..=.....Ef8.......g`....J./
l^I.($....7^. .......z.%Y.Zi......[..F....g.$.k2D1......[=LV...)Lb.)..
.&W._e0....^.w.L..~..eGB.......^1...v..W.P.*.qV...Rc#....U.CE.&.R!....
[email protected]..?......*9....<....(..........R......T.SqI..
$....;..,.....B1N.1...i....Qr........%!.......{..S..F..c.......0......
rCL.....JZi..4.ZJ.}4..P.S.M.P.(...(...(...(.......R...)[email protected]....
r.../.?. ........p.....".. f.....YX...w.c.7?.......d..|. Zv...nk9...;x
...._37.H.H...Y..FB..hC0..zT.%..W:...'V.........l...=.T.S....A#q]. ..n
-t y....,..j....g..._c".K..-<!n..]WBj.}.J....Tt..i.....Z.7<S.4.,
.....A......x.TXU...i1.Z.j`7.~..P.dsE]..7.).Z.....W..(..4.z`...M.=i0%.
 ....f!3I...^....n)E..O..b._..jMtBS.2.. [email protected]....)..U6-.PE4.3....
....o...*}G/.H..o.j.....Q..}i.G......f.&..5.bR.......R.z.W...e......~=
[email protected].....(...(...(......6..B.4..G......>5.V.
<<< skipped >>>

GET /thumbnail/celebrity/SPL909646.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource8.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:24:47 GMT
Content-Type: image/jpeg
Content-Length: 17098
Last-Modified: Wed, 10 Dec 2014 21:05:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
.................................."").................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.Zu.........R.P..E..%-.S...(......E.R.h...ZZm-.;4Sih....KH.QIE.O...}..
..*.z......`...EK.^......#o..........K.]~...k..... ..)....aq\.\..u....
.. ......h.to.......u.....(.[...Q.2.jaaP....a...n..SwS..7SsL.M.L.sFj-.
...-% 4..i4.Ri...CM....\Rb.4...i..S..q.(...j^q...VaP...U....)3A...AE%.
.))i).J)i(.))i(.......L5!..1...ZD.KE-..QE..([email protected]@.......QH...J`-.
[email protected]..)[email protected]%0&Y.^......~UN.,.s@N..)....$R. ..
.F.........)r.r.isUVUn....R....f.....H.M.8.fikJ.E..<...y..JF.F}N1W.
JzE7.3,.q[.........H..yLT....XX..*..........QJ*.....`.:...........MY..
9.f.H.(^.E.hJ.{..*......Q.2.1.3.5...)....i.m....c...T... .....p..... .
..<..=.{[email protected].. .xQ.V.....
.(.......3.....}...x~U.I.~..o...H.............C..i........s;.g.....m..
....?......M.g..QV.#..*...].z)h...J(....)h.(..........RS. .)... Z.....
.R....V.4..R.".1...R.eP..E.C.....%...,.n=.z...T..R3.O'##8..Ze....P]...
"u..9.U...a.Z.z..h..o......9"..j.[x#...0.... !h^.{z..'....CH..s..~
<<< skipped >>>


GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT
If-None-Match: "a2f3ff97eeecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Thu, 23 Oct 2014 05:05:32 GMT
ETag: "a2f3ff97eeecf1:0"
Cache-Control: max-age=900
Date: Wed, 17 Dec 2014 18:32:02 GMT
Connection: keep-alive
....


GET /pki/crl/products/WinPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT
If-None-Match: "3e1c83923e1cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Mon, 06 Oct 2014 05:06:02 GMT
ETag: "3e1c83923e1cf1:0"
Cache-Control: max-age=900
Date: Wed, 17 Dec 2014 18:32:02 GMT
Connection: keep-alive
....


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT
If-None-Match: "58cddbea90dfcf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Sat, 04 Oct 2014 05:06:12 GMT
ETag: "58cddbea90dfcf1:0"
Cache-Control: max-age=900
Date: Wed, 17 Dec 2014 18:32:02 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Sat, 04 Oct 2014 05:06:12 GMT..ETag: "58cddbea90dfcf1:0"..Cach
e-Control: max-age=900..Date: Wed, 17 Dec 2014 18:32:02 GMT..Connectio
n: keep-alive..



GET /r/collect?v=1&_v=j31&a=344759030&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MECAAAgEI~&jid=1700144484&cid=1489344308.1418840893&tid=UA-42318620-2&_r=1&z=555905987 HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 17 Dec 2014 18:28:12 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 17 Dec 2014 18:28:12 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..



GET /images/shared/download_buttons/get_flash_player.gif HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.adobe.com
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Server: Apache
Location: hXXp://wwwimages.adobe.com/VVV.adobe.com/images/shared/download_buttons/get_flash_player.gif
Cache-Control: max-age=900
Keep-Alive: timeout=2
Content-Type: text/html; charset=iso-8859-1
Accept-Ranges: bytes
Connection: Keep-Alive
Date: Wed, 17 Dec 2014 18:28:12 GMT
Expires: Wed, 17 Dec 2014 18:43:12 GMT
Age: 0      
Content-Length: 300
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>301 Moved Permanently</title>.</head
><body>.<h1>Moved Permanently</h1>.<p>The d
ocument has moved <a href="hXXp://wwwimages.adobe.com/VVV.adobe.com
/images/shared/download_buttons/get_flash_player.gif">here</a>
;.</p>.</body></html>.HTTP/1.1 301 Moved Permanently
..Server: Apache..Location: hXXp://wwwimages.adobe.com/VVV.adobe.com/i
mages/shared/download_buttons/get_flash_player.gif..Cache-Control: max
-age=900..Keep-Alive: timeout=2..Content-Type: text/html; charset=iso-
8859-1..Accept-Ranges: bytes..Connection: Keep-Alive..Date: Wed, 17 De
c 2014 18:28:12 GMT..Expires: Wed, 17 Dec 2014 18:43:12 GMT..Age: 0   
   ..Content-Length: 300..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 
2.0//EN">.<html><head>.<title>301 Moved Permanent
ly</title>.</head><body>.<h1>Moved Permanently
</h1>.<p>The document has moved <a href="hXXp://wwwimag
es.adobe.com/VVV.adobe.com/images/shared/download_buttons/get_flash_pl
ayer.gif">here</a>.</p>.</body></html>...
<<< skipped >>>


GET /thumbnail/celebrity/SPL914301.jpg HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:18 GMT
Content-Type: image/jpeg
Content-Length: 23414
Last-Modified: Wed, 17 Dec 2014 18:05:42 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
[email protected].......<.Ghl....{.<.32....W.$]...l~H.
A....%.....$D.0Rc\...c...rkf._.....<e...=....*...%...~..2.8..u.p...
.n.ly..~.n8'.......fH.....X.....?......-a...,..=}.{..Au5.Yl.N.~.O.#.4.
...%-.2..`.]G.cta...r..O g....... F.T..?...<.'*.....>...{4c.-..f
.m....$.t..=.....x.....K......?6=.^.o...].....&Q.....{....-.$..%..... 
..Cq......=....}..6.\u.....k....X./.7......3.......O .. ..Q....f..8 s.
..<..,q..J...r.......m...r.!..S,M.?...:..\u.:.F.F..r?..o!.<.... 
.......?...y.F2wKc...FR.......C.5.zR.........5........N2.Ldg.. g.2.m..
l..[..1..............%VT...^I....f..Y.b..<...~k.i..f..=q.Xr..Wt....
.5....9<8..=2 ..9%m......]I"...=z..*.).O.U(...s.]/..CgJ.......X.M.Y
..!Kc#.....U..n..R....x%Cten.\f.x.......9U.F:{...5.....?.....PN:{...F:
..o$..I...R'~........sZ.R6...../#.........s.,o............>\.zv.U3U
>_....m.I>...K.:.....G*......\W=V.]....~.3]60=... [email protected].
Mx.J.E\5I...o06,.e.,i........c..........L2........^.m...h.P...9..a
<<< skipped >>>

GET /thumbnail/celebrity/SPL913635.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:18 GMT
Content-Type: image/jpeg
Content-Length: 17026
Last-Modified: Tue, 16 Dec 2014 19:05:19 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..v)...m%...(.....)@..K.5`[email protected]%....qFqP...i...0\P.*..EB...qoJm2...
1F)sK..m%:.h.(...(...(...)..(......(...-.P0.....JP)qR...-!..V.R...|.K.
*LQ..EI.#)[email protected]....,.T.....1U..T4I.......M.....SR3TT.J(..'V.>.
..VG4.*QL.....*.\T..y..S....i...\R...,[email protected](...b...(4....(...(...w..
d...u...\..IO..............s.......)......(..$.....1.6...s.2....i....P
.Y.TT.P.E.P.E.P....(.i(...:.OZ.n)*Z...(.....e<..R)..i(.)iij.%-:..R-
....y.4.lC.5.6.(.tyu..c.Q......H.)L.Zm.)..M.M...&..v.j.XJ...f-..UeQ.q.
-Q..c...d.. ......Y..Ci)i).QE...*.S).........K.qH..=.U.`).....{.q.9y}.
...T.s..Y..2\\w.?B:\.M4.!9...P..M4..h.J...8..-.CE.P.E...4.*.....i.....
..Ci.....nB.'.'..L-.*.!....B6.r..q.2@....}...tW....L.e.H....7.=P..c...
.H..47dA.^...#.t.F.....?..N..........c2....v....>O^..*.....p.R>.
..J."..9.a..@...*........Q..~.^..Z..#`.....d..^[email protected]..;..
R....>P...............*&....Z\......_LC.O........OFL..};.....Q..m d
|....py.)...\[email protected].~.o5...u.A...o..k.....b......
<<< skipped >>>

GET /thumbnail/celebrity/SPL912964.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:18 GMT
Content-Type: image/jpeg
Content-Length: 20003
Last-Modified: Tue, 16 Dec 2014 18:05:13 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...........................$$""** 33>..............................
................................................}........!1A..Qa."q.2.
...#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
..............................................:.0.."..................
.?......Qd...O.j.h._...w [email protected]:.M.A..V.Gc..KrOJ...K...V
..s.S....].B.G^{.\rE.s.1.Z...M!99.... ........d|P....N.z.HsSP....1a..*
'4..v.Z...T..Z.........f...~..L.....x...oZM....=i....'...ooZ.p.......]
...{z..C.7?Ec.)............e.....&......7...?H%...j..5F.ax.....M.dooSF
........a...,?.L<9.....~ .....noZ7.Z.........~/.....`xC^?..........
....!v...x/]?.......cS....7..._...).._Gs....}se.......^...'X..;.P.....
...{..WQD.|.........7...C._9]H.].=k.;.{..h..3..........4...FO....Q@...
.f.."d..I|!s1.....?.R...3%.......L......z.9...I.W.....x..d../...{7.(.o
%i.B..F...j.}.......~c.(.Q......z.R....E....8.s......|...N....G.c..k..
o...4_.?.....7d.......M.4?..O......-.I....'....'....O.R.1..O..P.~....7
.Q.xT.b..9......6/.G.(......'.........(..=..#G......|....P......9?....
.>....O....(."w.X.....%...bD-......P...2..y~l..U?.*...y.....]n.#.c 
..#g .......N....Y.9......fs..8.c.e{..S.v.....k9...).5...5..(....4...(
a$.....5...[...........[na.wV.,).M.........p(..Q.. ............sr6
<<< skipped >>>

GET /thumbnail/celebrity/SPL913503.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:19 GMT
Content-Type: image/jpeg
Content-Length: 25962
Last-Modified: Tue, 16 Dec 2014 12:05:07 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
..)3Eo(....(.yD.(.f.E`.Bi... 6k....M".:..b.#..plU..L.W...:.V..<...Y
..V...f.0d.H..-.l&jt.=.^Vq.z.F...V#...F*y..:3.x..kfT.bNq[.m2tfD..dnkBf
...r..8.!.....~.]....k....jk5E....3Fj*Z....>.N...]Sn.\AR.`.:...A..&
H.5.l. 2%.....8....^...........Z.... 1..9...>k..n..r.....ueb.K.i.f.
.b...*U... .4..9TlEZ....qJVFWlf)qRb..*B".........%..(.X I...H..mY.FEO5
..j..U..\.E...iaUwQ.. d......X.[D....0.y 2a.mrR...k...t.#.ss..gT`.R4..
j,.FsM.f.5.i3A..*:}\Fu-".. T.i....n...S...x..m.gm..Y.VI|....C.......j.
....L.H.n.._.?.....>.6.....CG...?......KY..fQ}j}....3....l..}O.L.l 
.'..z.&I.W=l..N.w...U.E,UO....N..J.wo.... c........\....Sv..~......6..
O...Du..../..0^...~_.z.#.=z.T...8...mm...U./.k...........o............
...'.5;..........X.:....h.qG|t..../oQ.....]~.......j.x..3.g..... .....
.0..x..N..[.1u%.wG...#........H. M..!........?<.I...n..c.[2y.s.....
[c....5.&.....?._.j.....*.D....].2z...ds.. #0s.........<g....$..n..
.KV_7.NB..j...r..eY..Z...2.7F..zq...`Cm.z.o.......T.L..[..=0...d.c
<<< skipped >>>

GET /thumbnail/celebrity/SPL911157.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:20 GMT
Content-Type: image/jpeg
Content-Length: 20966
Last-Modified: Fri, 12 Dec 2014 21:05:08 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.zQFh.#.}%&is@.\..'0...p..%.....t9.?.E.3....|..Q..... ....Wh._.... u..
[email protected]},......U.m....Z...p.I.R5.......R,J:.R1...DY.5}.......1J
.f2..W.>...j.F.. 21....'.....oCL.y..j.*\UA...V.0......k..k..S....._
1.X...J...nd..?S[.cQ....MKcC^...(5.....w.._.I..=..*3`..;...)..1.....L0
...LV..d..o..[ .$q...S..S..O;.~5lY/......o..../.N.7.4...4...K..?..N...
....m.4...........h.$~...m.4.'...o............4.d.........o...........
.8?......%....M....~O......_.._..........2x...kB..{.;8_S.k6....RU.[f..
h8.&...;c. .$\......g.......MH..B..........n.x....RX."...?...../.s..=.
..)..~...............]...O.....F......|...u......?.K.\...$.......@....
/.....,....z...... ..}.....Y..........F.q..x>......U}.;|.....~.....
.}...}3R.......Fs..O.X......_d....5.g.7...?.U..r...Y.......b....4.....
.f.@,.....,G....&U....,G.XG5.tq..\P#j.b!YR...z.E..9.X....[...}.K.v.mA$
..\.p.....EI...%M...b4.qX...b.f8Z..n..C4.]..IL..j...U..#W..5V1.>...
...N...N3./....i2`.{3T#......f.....$....j...5i................>
<<< skipped >>>

GET /thumbnail/celebrity/SPL910521.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 20057
Last-Modified: Fri, 12 Dec 2014 18:05:09 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.z.N.Du.%.P2........)......7.{Q<..L...FFh.@.#........"[email protected].]...#
...~.}[email protected]....))i...)i......."K.....^...p.........NH.`....t)..x.
....t/(.....m.Q.Y......S^}....G.w...8.C.t..kH|[email protected]...
.~....O.I.c.?.^z...w W.. Y....p..>...<..V....J.Yr.....;#.i.!....
......-&#..2;u'.U.;e..(..,..5~..~...M.O........sg56.4...vP?.. .)......
.8.5....B...}....i....M.ou7g...}.Tesd.Wq....S..\`pED.}[email protected]
.XIE..5W=7..=V...xw.4..A0...q....{%........\....m.N .2|b.P.o...oN\..F(
..x...M.}jb..E^Y.j..?.z}.........V'...p~......'5....T..rF6.wu....W.u..
...U......a4(...}]....i....>...R..U.....w.}...o....|......$....W.O.
....z.&..W..k..{'.|1supf..=k...7....'8&.I...U.........RMnbE.Hp...w...8
.H...u.o.....7t....q...Grk.....F..g%Z.5...,b{p......c.8.V. Q..[...c...
.z8...%Q=W14.P...<#y.oO....."h\...:....Q..E?..n.%.^.....]...s....cZ
[email protected]..%.(s..5:T......`O.fi....
..By..&..za8.-....T.1..g.|.:2.V.t..h..@n.........:..r....{z..%.8..
<<< skipped >>>

GET /thumbnail/celebrity/SPL910280.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 24271
Last-Modified: Thu, 11 Dec 2014 16:35:12 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
...............................##$  3.................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
."<U...Qp*..} ...R#V....,&.G. C...-.Q.M..e..r.dV&.u..W5g...Nd.op...
.8g.........z9ntQ........L..&_Z..p>.8.Mq...mp..K..K...?............
..S..P.n....y......c.aZq..ih.W....SM.) t.. >;.'...|.J... u..~.#.x..
.....6q.9...h.....U....-.d.=.\YmPF......Z....U.dh$.>..]..)b.....C4O
...w.>^...k...k..CW<..O.8... ..YA>..4...)m........d.......\M#
.......-;..Q[G..f..Z...........g......E.r...FZ-.M....1........W.<.3
...J.....J...*.......e.......J..s..j..ta).......6w...M..QC.*L......22z
..pOZJ...O2...b<..\WB...#{.U6...gR .W .........Iu.\O.Gz.........I..
...q....S..t......S...#5.%c&..4.&.#...F...L.....\T..f.}...km<.I.*.s
C.......**.,;..*~....mr........)6V...#:@Mg...1f.0W.N...../.Mo.z.m.F.`-
.YXq[[email protected]...&..)....b2<.i...WH...lZ.K...[[email protected]...:S
.X.H1CC..A.....{S-....)X..r..T.....b.......0...l0.].S)....Uc.l..r.U.v.
.U....3.....f,.......@..=x..lg.m.c..... [N.E*...7..........XS..\I!....
..."...w.$T2. Q..'=([.....&0......ubD..B\v.....~Xm....{..]..;b....
<<< skipped >>>

GET /thumbnail/celebrity/SPL909531.jpg HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/video_menu.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: resource7.itibitiphone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Wed, 17 Dec 2014 11:29:21 GMT
Content-Type: image/jpeg
Content-Length: 19427
Last-Modified: Wed, 10 Dec 2014 21:05:17 GMT
Connection: keep-alive
Accept-Ranges: bytes
......JFIF.....:.;......Lavc55.18.102....C............................
.................................."").................................
.............................................}........!1A..Qa."q.2....
#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....
......................................................................
..............w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
...........................................:.0.."...................?.
.$..UL-...x../..n.<....l..5...E=[[email protected] .....
.@dT'.VF..S.V,....1.....P%.6>R....OZ..N...s.....d.\2..H........5.T.
.k...}..~...v..........:..{..._........c..`g.rwV.e1.....z.khY.s./..._.
..j2h...._.."...I.......v.YH.}l....&D.... 68..'.j.75...u.f...\..0.B}"w
.'....SN..l.]..c.(......(...(...(..QE..(...(...(....(...K..Y..V..\...d
..<..cm..Ooz....'./...H...S.r. j..J..C..{W..T...e?......f.WS..\....
I_go....,..o...%q...7. K....2?.B.*^\.q..nFq.....=.C.270..N.E..9]JIG.'.
g.r....-.r.R....v/..h.{.c..2~.G..F.....G.S.U...z....~..!Z..Te^R.q.ce.#
.gk..N.M.i_.M..5e...{f..w..;....j.1US..2s..:.)..)>[..V_q.......QIKV
[email protected]...}......lg.x.Z..u...v..7..\Z..myCm.4kE.
.)..,_.........[.{....z..QW...O..v..t.t%...`..CS...W............ '.:~4
...z....]_..A..)AT.Z/gN..Yk.-I....9~H..i.o<.r?....L....W..Y/.}.aQ..
7..s.. ...= H.4RU*K....N ...?.o.M.*.....]#.f~.......5%.7W.U...g.{....R
Z.......k*........s..........4..I.G.{.%.73-.....G.e..p.....;....Y.
<<< skipped >>>


GET /collect?v=1&_v=j31&a=1912250307&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MAEAAAgAI~&jid=&cid=1489344308.1418840893&tid=UA-38306554-6&sf=25&z=1487364687 HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 11 Dec 2014 02:30:50 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 575977
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *
..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options
: nosniff..Content-Type: image/gif..Date: Thu, 11 Dec 2014 02:30:50 GM
T..Server: Golfe2..Content-Length: 35..Cache-Control: private, no-cach
e, no-cache=Set-Cookie, proxy-revalidate..Age: 575977..Alternate-Proto
col: 80:quic,p=0.02..GIF89a.............,...........D..;..



GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 17 Dec 2014 16:31:03 GMT
Expires: Wed, 17 Dec 2014 18:31:03 GMT
Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11158
Age: 7029
Cache-Control: public, max-age=7200
Alternate-Protocol: 80:quic,p=0.02
...........}{w.:.........Du..p8IMV.........,.ih.....6.g..{K..4<3..w
.....[..K..L.*...~ps!.{RFz.F...~...|<..a&N...0.].XF..}[email protected].
.....".nR.M..=....$.gy...P`(.5..P..T..z<.J{.W.%2..8..s..SO\!....'~.
........S......s.....Je;Y...i......A...;.MPn....>RO"o0R......O...r.
6..u.]c..T..z.'.....v1.t...h..c...=q.1He.|..x<@[email protected]..
>M<..F..>.Y......M.Q".'r:.>......g.t...a/C...x..12....}..s
?....W&S ..O.'...0/.R.{..z..L...8.yb$...~Of....1..LQ..v.'^F..Q...C....
.N....Z..c......=.u....?..PQ..}!;q7..g&. *U<..>U.QY...R..s.m.j5.
..][...0<..PP....h..{c{[..a...L..k!F........./^..z........G.>~..
..7. `.w..y68.....I6.....]olln=x......x.:..N.Ss....e7z.y..=/.z...f..y.
..f,..H..gZ.....x..E.-........E;...V...4..]T8....n...xU;O....^0...5t.b
.O.. .\[[ol.2T.!v.Ta#T1.N.I..=4...F....HR..E&K..m.y..~.{.xr|%...m.Z...
.jz.Ld...v8.L1..9....K..Q..S.....*..Z..T.w.L..k...Ky....."L?..../.X.z.
o<.....?7}.D..d....e..^....'....}...bE.J%....2.N9.mm......h<.)".
..n0....L\....8..>.]....@}.q.A.'z...g.{q)....f.D.5...?..,*.=K..*...
... CN...G.I.J1...A....C... X..O.\...7.{E..z..t>...k...D..k...h..[k
C~<.z.y....nka.z.....`G>..[@.L\/[email protected]....,.O....q...Lh.[..m
[email protected]%Z.....,oo....?M..=..|&~/Y.F...[[.N....
u.=C3..#/...N(v.XE81I4...h.-U."..i.T...4.*:[email protected].;=.....
8.`.g3=..{.)>...6..#...|S^nf#g.z.s.K.........Y.cC...U;c^..6.:@vU...
i/..m....i..L....|s......x.....[.v1@...(.g...]...bP..Z...=.....D.D.HM.
Y.....IXk..8..j. ..ag$....n.....A'...O..._..v..,.G..`..!...rM..o.V
<<< skipped >>>

GET /r/collect?v=1&_v=j31&a=344759030&t=pageview&_s=1&dl=http://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=&ul=en-us&de=iso-8859-1&dt=KNCTR&sd=32-bit&sr=1683x901&vp=740x256&je=0&_u=MECAAAgAI~&jid=1787667799&cid=1489344308.1418840893&tid=UA-38306554-6&sf=25&_r=1&z=857581271 HTTP/1.1


Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/kn_video_v400.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&country_code=
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 17 Dec 2014 18:28:12 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 17 Dec 2014 18:28:12 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..



GET /pagead/osd.js HTTP/1.1
Accept: */*
Referer: hXXp://web.itibitiphone.com/knctr/right_banner.php?SYSTEM_ACCOUNT_KEY=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pagead2.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 9604784682434440633
Date: Wed, 17 Dec 2014 17:38:29 GMT
Expires: Wed, 17 Dec 2014 18:38:29 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 18569
X-XSS-Protection: 1; mode=block
Age: 2984
Cache-Control: public, max-age=3600
Alternate-Protocol: 80:quic,p=0.002
............yW...8.?...tq.F..:..5.R...h..!.K..$%S3.i..g....,'........Y
[{...M...3....k1Z...vg...6B.X.%\T..ng.{U/`)....Z.._O....*oer..:..|..|.
s{.L.D.`.._FI. ..I{s..<....l..A.....z.I.k......B6.......P.x.b....1.
..r....... .!.......4.....'..`...H....LG}O......R!:.z..AQ...h0.`....l2
..[.Dt.P.5.B.`.s...n.......VHF..T.....b9.....8o.Oe......cq..yW,4t(G...
....#.w!..Fy.....`uplk_..7....G..k..M.........;..:.?.4..`Sm"X..V.b..'.
L..%e.,.8.....`......5..6,......q./...t ....,..wl...e}Y.;.8........gni
.&...%.V=.U1.vg........`...1.![....!.I{4.Y?...R.........&........T..3Y
.....%`....A..j.'X.....V t..f.X.u%.3 .6]..)7[...Grss..qW..@~P...=.....
..\O.)....af.y}...s...9j....j..w.{...s.....t.......c).Q".{SX....h,_t.b
.o....D...>.....=..Z(T.m.o|.^..A....j.!x...o.tM..xz...y.n..)......h
$...&....]..1......S.Q.7..f,.3.\...Y2....[...c.`..F... `...sq9....fen]
..[..`v_......P.....4..&.....pb...r-..)z..`.r.......;)K.t%.3L.*K....r.
.L.s:(-.....c.....,..m.....2.(.........!....|...)|.....9|...!|.XpN.y..
...._.m..jy..4).5..&..;.&.E......2~,&.jO.....L...Z...b.ln....U.....,..
.(........d..v.{..ez?......y-.....Q:.b'.O.....x.%..&;..*.[.G......hQ..
... .I..'.)T....=N...?.1..k....I.u.....c..l...`<..`q...6....X.,....
4Ke/nl.C.4n........r4x....a.{^../.........)-:...q......T]..~]v..}.P...
..../.......{Qi...........qyIU{....^.....D....Bp..h......]"..*~..`. q.
[email protected]...*[email protected]:g..}...1W...3OF35\..c..!,.S...A.n{$.
..R.7.SU...N3.Q.he.w..2i.p./ ......OM. j......b.~...)mbX....}`N.B(64..
......c.?.?.......(.j2..'.jKN>P.O.;.ch.l..6.....w..V../.e.!.(8.
<<< skipped >>>


GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Thu, 13 Nov 2014 06:02:42 GMT
Accept-Ranges: bytes
ETag: "88cab6f7ffcf1:0"
Server: Microsoft-IIS/8.5
VTag: 791936916300000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 554
Cache-Control: max-age=900
Date: Wed, 17 Dec 2014 18:32:21 GMT
Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..141112173206Z..150211055206Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......W0... .....7......150210174206Z0.
..*.H................].`...D..9.>LO.ey...Qx%.^.P.& ...D.......b}.K.
.[.....5.m....).....H..6R....G/ju.........:..A.#.9!......D5...|".w.x..
=.u..X6.7{..).XN....g......B.8.!&...........<7fS$..........t<X)%
.b([email protected]... ,...K\....U1cp).........y.T..?rm.t..Y.}.E..
-@...



GET /gampad/ads?gdfp_req=1&correlator=4191087010913227&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_leaderboard&enc_prev_ius=/0/1&prev_iu_szs=728x90&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418841028&dt=1418841028120&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=3538004474&oe=utf-8&gut=v2&ifi=1&ifk=443509494&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&ref=http://web.itibitiphone.com/knctr/knctr_with_phone.php?product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&phone_number=&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418841028&ga_hid=1200603661 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pubads.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Google-LineItem-Id: 383110549
Google-Creative-Id: 40508800549
Date: Wed, 17 Dec 2014 18:30:28 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 3135
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.002
...........ZYs.:.. N....v...(.B...Ig..dY..c.m....>G.mL.^........,.M
g....9..p.*....e.](..wk.Z.^.......A..t...vc..N'>y.nl[t.l...d.#[email protected]
....L.EF.:..-...Ib.0A....4$..N..<l.......n_.J.s..!....Is....M..v...
$X..0..d..$..Xua.....O........\Y..Q .....C..F.*..:_./x].ivW~.....#...[
e...K..>%..)r1ci...([email protected]?.....S....k.1$.(M.z.
fI..kx...y8c.......e...=..@'Av!.H.!.I-X.....k.....=l-...cc....a..tr...
~..LMX../...J..&.g7....n.?.......X..6..d.9....kn$.5>.o3..&.F.W..lX.
;I..y...i.z....w..6....nK.R.-Y.($A.$.eK}ej.......%2....f...Kg...)q..yH
o2......!...l=..._V..2....s~&....H..7.9&..q...;...&...7".!...,........
.._.....,.-.......Pu..4..<.[.t,$......C..n.@. .HV.H........kC~.....
.....g.Rh......7.l..`[email protected]......./s....'c.eS..^Jo.d.J.
...\.i.....u......g.......22.. $..C.6.4E..u..\......7.k#...a.r.qy[....
..d..\.}.....W.)y..#.........8ag....0T.OF<\..........6.]..>....J
..j...b.b.D..#...A.n........J$..:X/..H..0.|0h......p..r8.....W(4..&.|T
a.p|.5Q.....S..).d.P$Q....6...DP......F..Pa.w.....If.D.A..L..Q.UQ!C.v.
.g..P........v....T.d.6...B..;^..`[.L...... ..... ;..h<z..*F.&....A
$..X...F........>.,`b..Yh$....*.YPa).>.I......4^.%zV|.X..|..B...
..B~B...!..B..@..(%......Q..t:..i.B.A..Y.....!..kdf....~.BZ..B.uC.!.o.
...9.; ........B.N.U..G.a.....M....] ...u3...8-...T1..O...h...&?..\7G.
2..jr....}=...J.`].\...X..\v..4V)..>..H....4..;~....F..n...Z...a..a
pf....0.Y....k.A.....U#u....d<Y..2....KE$...hZ.i.aQ`.Y..Z...N,C.ul.
.i...n7....J.rC. ......Qk..S.3....e...;...7j.p...}..}..}....n.^.jY
<<< skipped >>>

GET /gampad/ads?gdfp_req=1&correlator=2823204564141822&output=json_html&callback=callbackProxy&impl=fifs&json_a=1&sfv=1-0-1&iu_parts=282654509,knctrC_bigbox&enc_prev_ius=/0/1&prev_iu_szs=300x250&cookie=ID=ad2c3fa5833620c8:T=1418840893:S=ALNI_Mb1g0p7SH5erPtnoWWuAgI7Vmfx0w&cdm=web.itibitiphone.com&lmt=1418841028&dt=1418841028289&cc=100&ea=0&frm=23&biw=749&bih=619&oid=3&adks=1144579259&oe=iso-8859-1&gut=v2&ifi=1&ifk=45333344&u_tz=120&u_java=true&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=32&flash=0&url=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&ref=http://web.itibitiphone.com/knctr/kn_video_v400.php?video_id=228392&category_id=1&product_key=ITI620F34775EF44486A01ACE5EAB4914ED&product_name=Itibiti_Knctr_C1&product_version=2.0.1745.0&vrg=55&vrp=55&ga_vid=1489344308.1418840893&ga_sid=1418841028&ga_hid=754552994 HTTP/1.1


Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: pubads.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Google-LineItem-Id: 232072429
Google-Creative-Id: 37271633389
Date: Wed, 17 Dec 2014 18:30:28 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/javascript; charset=ISO-8859-1
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 3147
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.002
...........ZYs.:.. N.....!..."k..F...I....om....>G.mL.^........,.st
t...1r]...U.....d....;...J...1...t....fs..F.!y.ln..s7..od."[email protected]...&.
"#z.....`.$.I. lraL...c:vI..........=i".........'.Ps...%..5;..h.......
K...%[....q..tA-...i......E.;.Am'..l.."...e.B`JHsL.e....N0e#...t....}J
..S.c..."4V"B.....{f..#.%...J..6.L.X([email protected]|.....i...PK.w|#.....9
....d....M....{:....EJ..-j..N...}[email protected]'>..I."5e.X.
.O.m.*...?.q..U...v.....$[,.#.O6...Yi........c...`]...{...c'....TK#M./
6c7J>.8..A..m.T..%...I...O.RO.Xl....A=..f.P.).g..Y.1....V.........t
..i:]Mpu....Z.."..u~&...s$..k.....8Qj..jjO...,.....DV...D.9t.qC...U...
4........}Q.....7J,nQZ..p<. A..AJq]..Z.B..DZ..%...^^...._^......=..
r.O._^t..d..F...).. ..*'..{............-.}. ,>....,[.(.\}m.'V.(....
O....2..JK....A...1.J....E19v.D..JK.nY....Y...1q..6.....K....H..=....(
.....U..]...,B.\......U)....2......2...=.k\L. ......$.....o.........I.
..[T...(\.TX&*`.G&...Eo.h."I..........ca....p!?....(4q.&@=.1Y8.j-.....
..zC...c(.H..qI...t.).L..P:D..Pa.....`.If.D.A...t..'[Q!C....g.9P.0.:..
..v{,.w.4.`m..q...O.dU.6w.$.....Z....%AvaG....5T...N.....D/c.....$.X..
.'.x...Q*d.#q...n%v.TX*.M.R..~.q7I...>K6a,.l6[.!.O...!?!._..v.!{  d
O.....E..*..:.9...!..CC.. ..k.i......!....._...].E...........i.#!.....
..S.....L>.<....A............i... ..8~....q..[./[email protected].]5....E_.
..R$........V....2..2E..s....NoB......U.b.c..Kh.e.......gNL......u..\^
......../n.......NS&8..<UDp...f........u..]....2T\..-..p)0...f.*...
-..0...q.V0?d.g....g.'.;...7j.p...}..}..}....n.. E.X}-fM.... .B..{
<<< skipped >>>






The Worm connects to the servers at the folowing location(s):







Itibiti.exe_3820:




.text
`.itext
`.data
.idata
.didata
.edata
@.tls
.rdata
@.reloc
.rsrc
System.Types
System.UITypes
TWindowState
poPortrait
biClrImportant
tagMSG
Winapi.Windows
HKEY
Try to replaced the Memory Manager used with the last FastMM4 Memory Manager (hXXp://fastmm.sourceforge.net).
BDS.EXE
ELeaks.pas unit Error
etNoMonitorSupportException
System.Internal.ExcUtils
TArray<System.Byte>
System.SysUtils
ENoMonitorSupportException
TArray<System.SysUtils.TLangRec>
TArray<System.Char>
;.uxC;
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
System.SysUtilsL
System.SysUtils0
&TArray<System.SysUtils.TUnitHashEntry>
TWMKey
MsgFiller
KeyData
KeyDataFiller
Winapi.ActiveX
grfLocksSupported
ISupportErrorInfo
System.Variants
Operator
System.VariantsX$@
EVariantBadIndexError
System.VariantsT
System.Variantsd:C
System.TypInfo
mkOperatorOverload
TPropSet<System.WideString>V
TPropSet<System.WideString>
TPropSet<System.string>V
TPropSet<System.string>
TPropSet<System.Single>K
TPropSet<System.Single>
TPropSet<System.Double>K
TPropSet<System.Double>d!D
TPropSet<System.Extended>K
TPropSet<System.Extended>
TPropSet<System.Comp>K
TPropSet<System.Comp>@$D
TPropSet<System.Currency>K
TPropSet<System.Currency>
TPropSet<System.IInterface>V
TPropSet<System.IInterface>
&TPropSet<System.TypInfo.TDynamicArray>V
&TPropSet<System.TypInfo.TDynamicArray>H D
System.Classes
ssShift
htKeyword
EInvalidOperation8DD
EInvalidOperation
TList.TDirection
AOperator
System.Classes$
TThread.TSynchronizeRecord
TOperation
TObservers.TCanObserveEvent
TObservers.TObserverAddedEvent
Operation
FOnExecute
OnExecute
TArray<System.string>
TArray<System.TObject>
ELoginCredendialError
"TLoginCredentialService.TLoginFunc
#TLoginCredentialService.TLoginEvent
Password
-TLoginCredentialService.TLoginCredentialEvent
Callback#TLoginCredentialService.TLoginEvent
FLoginFunc
'TLoginCredentialService.TLoginFuncProxy:
ALoginFunc
'TLoginCredentialService.TLoginFuncProxy
TLoginCredentialServiceM
RegisterLoginHandler
UnregisterLoginHandler
GetLoginCredentialEvent
GetLoginCredentials
TLoginCredentialService
TList.Sort$267$0$Intf
TList.Sort$267$ActRec
#TComponent.FindComponent$891$0$Intf
#TComponent.FindComponent$891$ActRec
"TComponent.GetObservers$902$0$Intf
"TComponent.GetObservers$902$1$Intf
"TComponent.GetObservers$902$ActRec
7TLoginCredentialService.GetLoginCredentials$1172$0$Intf
LPassword
7TLoginCredentialService.GetLoginCredentials$1172$ActRec
mtInformationMsgCaption
mtQuestionMsgCaption
mtErrorMsgCaption
mtDialog_ErrorMsgCaption
mtDialog_SupportMessage
mtMSDialog_ErrorMsgCaption
mtSendDialog_Login
mtCPU_Registers
mtCPU_Stack
mtCPU_MemoryDump
mtSend_SuccessMsg
mtSend_FailureMsg
mtSend_BugClosedMsg
mtSend_UnknownErrorMsg
mtSend_InvalidLoginMsg
mtSend_InvalidSearchMsg
mtSend_InvalidSelectionMsg
mtSend_InvalidInsertMsg
mtSend_InvalidModifyMsg
mtFileCrackedMsg
mtInvalidEmailMsg
EMsgsRec
Support message
Login message
Operating System Header
Invalid login
An error has occurred during program execution.
Go to the Support Page
We have created an error report that you can send to us. We will treat this report as confidential and anonymous.
To see what data the error report contains,
&Send Error Report
Operating System
Login...
Contact the program support to obtain an update.
Invalid login request.
Operating System|Type
Operating System|Build #
Operating System|Update
Operating System|Language
Operating System|Charset
_BugReport | Full EurekaLog bug report
_ExceptMsg | Last exception message
SystemDrive | The drive containing the Windows root directory
SystemRoot | The Windows root directory
WinDir | Windows directory
ftProcesses
ftCPU
sndShowSuccessFailureMsg
edoSendErrorReportChecked
edoShowSendErrorReportOption
csoShowWindowsThreads
boPauseWindowsThreads
boCopyLogInCaseOfError!boSaveCompressedCopyInCaseOfError
esmSMTPClient
esmSMTPServer
TWebSendMode
wsmHTTP
wsmHTTPS
wsmFTP
TTerminateBtnOperation
FSMTPFrom
FSMTPHost
FSMTPUserID
FSMTPPassword
FSMTPPort
FProxyURL
FProxyPassword
FProxyPort
FTrakerPassword
FZipPassword
FTerminateBtnOperation
FForcedTerminateBtnOperation
FWebSendMode
FSupportURL
FAutoCrashOperation
FWebURL
FWebPort
FWebPassword
FWebUserID
SMTPFrom
SMTPHost
SMTPPort
SMTPUserID
SMTPPassword
TerminateBtnOperation
ForcedTerminateBtnOperationdtF
WebSendMode
WebURL
WebUserID
WebPassword
WebPort
SupportURL
AutoCrashOperation
ProxyURL
ProxyPassword
ProxyPort
TrakerPassword
ZipPassword zF
.vshost
1111111
[email protected]
ECore.Done
TELVftPathSymbolInfo
sin_port
ExportModule
EHook.Done
ErrorMsg
FPort
Port
TEurekaClientSMTP$
TEurekaClientSMTP
Cannot close the socket: "%s"
Invalid socket: "%s".
Connection error: "%s"
Error into "send": "%s"
Error into "recv": "%s"
193.121.171.135
ESockets.Done
1.2.3
FPassword
srInvalidLogin
EWebTools
THTTPResponse6
THTTPResponse<EH
ssLogin
UseHTTPS
THTTPConnectionBaseB
AWebPage
THTTPConnectionBase
THTTPConnectionClass0NH
FHTTPConnectionClass
THTTPSendReport&
SetHTTPConnectionClass
ABaseURL
AProxyURL
APassword
THTTPSendReport
THTTPMantisSendReport4
THTTPMantisSendReport|QH
THTTPBugzillaSendReport4
THTTPBugzillaSendReporthSH
THTTPFogBugzSendReport4
THTTPFogBugzSendReport\UH
Content-Type: application/x-www-form-urlencoded
t.Vht
login.php
login_select_proj_page.php
password
bug_report_page.php">
my_view_page.php
set_project.php
view_all_set.php?f=3
view_all_bug_page.php
bug_update_page.php?bug_id=
bug_update_advanced_page.php?bug_id=
bug_report_advanced_page.php
bug_report.php
report_stay
bug_report_token
href="view.php?id=
bug_update_page.php
bug_update.php
reporter_id
view.php
enter_bug.cgi
Bugzilla_login
Bugzilla_password
relogin.cgi
index.cgi?logout=1
buglist.cgi
href="query.cgi?
show_bug.cgi?id=
action="post_bug.cgi"
post_bug.cgi
keywords
attachment.cgi
show_bug.cgi
<label for="component" accesskey="
process_bug.cgi
default.asp
sPassword
fRememberPassword
default.asp?pg=pgeditbug
default.asp?pgx=EV&ixBug=
default.asp?pre=preSubmitBug&sActionToken=
default.asp?pre=preSubmitBug
OperandSize
%c les #Gv , #Mp
%c punpcklbw #Pq , #Qd
%c punpcklwd #Pq , #Qd
%c punpckldq #Pq , #Qd
%c packusdw #Pq , #Qd
%c pcmpgtb #Pq , #Qd
%c pcmpgtw #Pq , #Qd
%c pcmpgtd #Pq , #Qd
%c packsswb #Pq , #Qd
%c punpckhbw #Pq , #Qd
%c punpckhwd #Pq , #Qd
%c punpckhdq #Pq , #Qd
%c packssdw #Pq , #Qd
EncryptPassword
IsValidEncryptPassword
CustomMsg
atSendingWebMessage
atSentWebMessage
eeEmailSMTPError
eeWebHTTPError
eeWebHTTPSError
eeWebFTPError
eeWebTrakerError
TPasswordRequestNotify
TCustomWebFieldsRequestNotify
WebFields
FPasswordRequest
FCustomWebFieldsRequest
OnPasswordRequestl
OnCustomWebFieldsRequestt
rtWeb
FExecuting
THTTPConnectionR
THTTPConnection
TActiveXExceptionW
TActiveXException$2J
Microsoft Windows
\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION
\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION
kernel32.dll
EurekaLog 6.1.04 critical bug.
[email protected]
0.0.0.0
Kernel32.dll
Content-Length: %d
<br><input type=button value="Ok" OnClick="history.go(-1)" style="width:75;height:25;z-index:100;font-style:normal;font-size:10pt;text-decoration:none;">
EurekaLog_IWShowMessage.html
IntraWeb: Cannot show the error page.
IntraWeb
IntraWeb: IntraWebApplication e/o IntraWebServerController are set to nil.
Screenshot.png
BugReport.zip
LastHTMLPage.html
EurekaLog_CustomWebFieldsRequestEvent
EurekaLog_PasswordRequestEventEx
EurekaLog_PasswordRequestEvent
EurekaLog.ini
WindowsState
user32.dll
\\.\mailslot\
RICHED20.DLL
mapi32.dll
AUTH LOGIN
SMTP
\*.zip
HTTPS
000.000.000.000
HardwareInformation.MemorySize
HardwareInformation.AdapterString
windows
EurekaLog 6.1.04
.FCOu
_ExceptMsg
_BugReport
5.0.0
7.2.32
VCL160.BPL
INDY160.BPL
INDYCORE160.BPL
HttpExtensionProc
57E8411D-873A-4B87-921F-B8A95569244B6.1.04 Professional
ExceptionLog.Done
Winapi.Wincodec
TTimeSpanParser.TParseError
System.TimeSpan
System.SyncObjs
TFunc<System.Boolean>
System.SyncObjsp
System.Generics.Collections
doOwnsKeys
System.DateUtils
TLocalTimeZone.TYearlyChanges,
TLocalTimeZone.TYearlyChangesh
ATPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>
AKey
ZTArray<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
_TEnumerator<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>(
_TEnumerator<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>L
_TEnumerable<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>-
_TEnumerable<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
MTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TItem
RTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TItemArray
System.Generics.Collectionst
IEqualityComparer<System.Word>
System.Generics.Defaults
#TCollectionNotifyEvent<System.Word>
FTCollectionNotifyEvent<System.DateUtils.TLocalTimeZone.TYearlyChanges>
TLocalTimeZone.TYearlyChanges
TArray<System.Word>
TEnumerator<System.Word>(
TEnumerator<System.Word>
TEnumerable<System.Word>-
TEnumerable<System.Word>4
VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyEnumerator;
VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyEnumeratorp
VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyCollection;
VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyCollection
6TArray<System.DateUtils.TLocalTimeZone.TYearlyChanges>
;TEnumerator<System.DateUtils.TLocalTimeZone.TYearlyChanges>(
;TEnumerable<System.DateUtils.TLocalTimeZone.TYearlyChanges>-
;TEnumerable<System.DateUtils.TLocalTimeZone.TYearlyChanges>
XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueEnumerator;
XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueEnumerator
XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueCollection;
XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueCollection4
WTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TPairEnumerator;
WTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TPairEnumeratorx
FOnKeyNotify
FKeyCollection
GTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>9
ContainsKey
GTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>
Keysl
OnKeyNotify
MTObjectDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>M
MTObjectDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>d
z:{System.Generics.Collections}TList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.:1
]IComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
jTCollectionNotifyEvent<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
ItemATPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>
_IEnumerable<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
eTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.TEnumerator5
eTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.TEnumerator
YTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>&
YTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
3:{System.Generics.Collections}TList<System.Word>.:1
IComparer<System.Word>
IEnumerable<System.Word>
TList<System.Word>.TEnumerator5
TList<System.Word>.TEnumeratorX
TList<System.Word>&
TList<System.Word>
V:{System.Generics.Collections}TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.:1
System.DateUtils(
9IComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>
;IEnumerable<System.DateUtils.TLocalTimeZone.TYearlyChanges>
ATList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.TEnumerator5
ATList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.TEnumeratorD
5TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>&
5TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>$
_TComparison<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>
]TComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>2
]TComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>\
z:{System.Generics.Collections}TList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.:3
TComparison<System.Word>
TComparer<System.Word>2
TComparer<System.Word>
3:{System.Generics.Collections}TList<System.Word>.:3
;TComparison<System.DateUtils.TLocalTimeZone.TYearlyChanges>
9TComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>2
9TComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>
V:{System.Generics.Collections}TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.:3
fTDelegatedComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>8
fTDelegatedComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>,'N
TDelegatedComparer<System.Word>8
TDelegatedComparer<System.Word>H)N
BTDelegatedComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>8
BTDelegatedComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>
System.IniFiles
System.Win.Registry
TRegKeyInfo
NumSubKeys
MaxSubKeyLen
FCurrentKey
FRootKey
FCloseRootKey
CloseKey
CreateKey
DeleteKey
GetKeyInfo
GetKeyNames
HasSubKeys
KeyExists
LoadKey
MoveKey
OpenKey
OpenKeyReadOnly
ReplaceKey
RestoreKey
SaveKey
UnLoadKey
CurrentKey
LastErrorMsg
RootKey
RootKeyName
Vcl.Graphics
EInvalidGraphicOperation
SupportsPartialTransparency
SupportsClipboardFormat
Monochrome
System.Contnrs
Vcl.ActnList
IsShortCut
FHelpKeyword
HelpKeyword
$:Crtc
1.2.5
System.ZLib
Ht.Ht3
Vcl.GraphUtil
Vcl.Controls
igoParentPassthrough
FAlwaysShowDragImages
AlwaysShowDragImages
toFlickFallbackKeys
Vcl.ControlsX
'TCustomGestureEngine.TGestureEngineFlag
(TCustomGestureEngine.TGestureEngineFlags
Supported
TKeyEvent
TKeyPressEvent
HelpKeywordh8D
FOnKeyDown
FOnKeyPress
FOnKeyUp
IsHintMsg
FNativeWheelSupport
FWheelSupportMessage
Vcl.StdCtrls
Vcl.StdCtrls4
Vcl.StdCtrls,
FPasswordChar
Vcl.StdCtrlsB
PasswordChar
OnKeyDown
OnKeyPress
OnKeyUp
ssHorizontal
Vcl.StdCtrls@
Vcl.StdCtrlsC
OnKeyUpX
TButtonControl\%S
TCustomButton.TButtonStyle
Vcl.StdCtrls:
Vcl.StdCtrls1
Vcl.StdCtrlsF
Vcl.StdCtrls*
!TScrollBarStyleHook.TScrollWindow6
!TScrollBarStyleHook.TScrollWindow
%TCustomEdit.ObserverAdded$3288$0$Intf
%TCustomEdit.ObserverAdded$3288$ActRec
)TCustomCheckBox.ObserverAdded$3495$0$Intf
)TCustomCheckBox.ObserverAdded$3495$ActRec
)TCustomCheckBox.ObserverAdded$3495$ActRecT
Winapi.UrlMon
System.Win.ComObj
Winapi.ShlObj
Vcl.Printers
APort
Vcl.ToolWin
Vcl.ListActns
Vcl.Clipbrd
Vcl.StdActns
Vcl.ComCtrls
Vcl.ComCtrls'
Vcl.ComCtrls:
Vcl.ComCtrls0
cdsShowKeyboardCues
Vcl.ComCtrls.
vsReport
Vcl.ComCtrls&
FCustomizeKeyName
Vcl.ComCtrlsU
CustomizeKeyName
acoUpDownKeyDropsList
FUpDownLeftPressed
TComboBoxExEnumerator5
TComboBoxExEnumeratorlBW
System.HelpIntfs
UnderstandsKeyword
Vcl.Dialogs
FURL
TDefaultLoginCredentials]
LoginEvent
LoginEventUsrPw
TDefaultLoginCredentialspUX
.TDefaultLoginCredentials.LoginEvent$833$0$Intf
.TDefaultLoginCredentials.LoginEvent$833$ActRec
3TDefaultLoginCredentials.LoginEventUsrPw$835$0$Intf
3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRecL[X
3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec
FProportional
Vcl.ExtCtrls$
Proportional
Vcl.ExtCtrls
Vcl.ExtCtrlsE
FOldKeyDown
Vcl.Themes
tcpCategoryPanelGroupDontCare
tcpCategoryPanelGroupRoot
tcpBackground
tcpGradientHeader
tcpThemedHeader
tcpChevronOpenedNormal
tcpChevronOpenedHot
tcpChevronOpenedPressed
tcpChevronClosedNormal
tcpChevronClosedHot
tcpChevronClosedPressed
tcpChevronClosedLeftNormal
tcpChevronClosedLeftHot
tcpChevronClosedLeftPressed
tcpThemedChevronOpenedNormal
tcpThemedChevronOpenedHot
tcpThemedChevronOpenedPressed
tcpThemedChevronClosedNormal
tcpThemedChevronClosedHot
tcpThemedChevronClosedPressed
tcDropDownButtonLeftPressed
tePassword
thHeaderItemLeftPressed
tsArrowBtnLeftPressed
ttbThumbLeftPressed
AuthorURL
TCustomStyleServices.TStyleFlag
TCustomStyleServices.TStyleFlags
 TCustomStyleEngine.TStyleEngineNotification
#TStyleManager.TStyleClassDescriptor
"TStyleManager.TStyleServicesHandle
TStyleManager.TSourceInfo
*TMouseTrackControlStyleHook.TMousePosition
"TArray<Vcl.Themes.TStyleHookClass>
'TEnumerator<Vcl.Themes.TStyleHookClass>(
'TEnumerator<Vcl.Themes.TStyleHookClass>
'TEnumerable<Vcl.Themes.TStyleHookClass>-
'TEnumerable<Vcl.Themes.TStyleHookClass>
B:{System.Generics.Collections}TList<Vcl.Themes.TStyleHookClass>.:1
%IComparer<Vcl.Themes.TStyleHookClass>
2TCollectionNotifyEvent<Vcl.Themes.TStyleHookClass>
'IEnumerable<Vcl.Themes.TStyleHookClass>
-TList<Vcl.Themes.TStyleHookClass>.TEnumerator5
-TList<Vcl.Themes.TStyleHookClass>.TEnumeratorL
!TList<Vcl.Themes.TStyleHookClass>&
!TList<Vcl.Themes.TStyleHookClass>
RTPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>
eTArray<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
jTEnumerator<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>(
jTEnumerator<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>X
jTEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>-
jTEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>$
^TDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TItem
cTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TItemArray
IEqualityComparer<System.TClass>
%TCollectionNotifyEvent<System.TClass>
UTCollectionNotifyEvent<System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>
Item!TList<Vcl.Themes.TStyleHookClass>
TArray<System.TClass>
TEnumerator<System.TClass>(
TEnumerator<System.TClass>
TEnumerable<System.TClass>-
TEnumerable<System.TClass>
gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyEnumerator;
gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyEnumerator
gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyCollection;
gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyCollection(
4TArray<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>
9TEnumerator<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>(
9TEnumerator<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>
9TEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>-
9TEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>L
iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueEnumerator;
iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueEnumerator
iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueCollection;
iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueCollection
hTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TPairEnumerator;
hTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TPairEnumeratorp
XTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>9
XTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>
KeysT
9TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>
LTArray<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>
QTEnumerator<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>(
QTEnumerator<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>
QTEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>-
QTEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>P
ETDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TItem
JTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TItemArray
IEqualityComparer<System.string>
%TCollectionNotifyEvent<System.string>
<TCollectionNotifyEvent<Vcl.Themes.TStyleManager.TSourceInfo>
TEnumerator<System.string>(
TEnumerator<System.string>
TEnumerable<System.string>-
TEnumerable<System.string>(
NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyEnumerator;
NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyEnumeratorh
NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyCollection;
NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyCollectionp
,TArray<Vcl.Themes.TStyleManager.TSourceInfo>
1TEnumerator<Vcl.Themes.TStyleManager.TSourceInfo>(
1TEnumerator<Vcl.Themes.TStyleManager.TSourceInfo>
1TEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>-
1TEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>L
PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueEnumerator;
PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueEnumerator
PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueCollection;
PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueCollection
OTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TPairEnumerator;
OTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TPairEnumerator
?TDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>9
?TDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>
Keys
6TArray<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
;TEnumerator<Vcl.Themes.TStyleManager.TStyleClassDescriptor>(
;TEnumerator<Vcl.Themes.TStyleManager.TStyleClassDescriptor>,
;TEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>-
;TEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
V:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.:1
9IComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
FTCollectionNotifyEvent<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
Item#TStyleManager.TStyleClassDescriptor
;IEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
ATList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.TEnumerator5
ATList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.TEnumerator`
5TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>&
5TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>@
*TArray<Vcl.Themes.TCustomStyleEngineClass>
/TEnumerator<Vcl.Themes.TCustomStyleEngineClass>(
/TEnumerator<Vcl.Themes.TCustomStyleEngineClass>
/TEnumerable<Vcl.Themes.TCustomStyleEngineClass>-
/TEnumerable<Vcl.Themes.TCustomStyleEngineClass>L
J:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleEngineClass>.:1
-IComparer<Vcl.Themes.TCustomStyleEngineClass>
:TCollectionNotifyEvent<Vcl.Themes.TCustomStyleEngineClass>
/IEnumerable<Vcl.Themes.TCustomStyleEngineClass>
5TList<Vcl.Themes.TCustomStyleEngineClass>.TEnumerator5
5TList<Vcl.Themes.TCustomStyleEngineClass>.TEnumerator
)TList<Vcl.Themes.TCustomStyleEngineClass>&
)TList<Vcl.Themes.TCustomStyleEngineClass>
'TArray<Vcl.Themes.TCustomStyleServices>
,TEnumerator<Vcl.Themes.TCustomStyleServices>(
,TEnumerator<Vcl.Themes.TCustomStyleServices>
,TEnumerable<Vcl.Themes.TCustomStyleServices>-
,TEnumerable<Vcl.Themes.TCustomStyleServices>H
G:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleServices>.:1
Vcl.Themes PY
*IComparer<Vcl.Themes.TCustomStyleServices>
7TCollectionNotifyEvent<Vcl.Themes.TCustomStyleServices>
,IEnumerable<Vcl.Themes.TCustomStyleServices>
2TList<Vcl.Themes.TCustomStyleServices>.TEnumerator5
2TList<Vcl.Themes.TCustomStyleServices>.TEnumerator
&TList<Vcl.Themes.TCustomStyleServices>&
&TList<Vcl.Themes.TCustomStyleServices>d
TArray<System.Types.TPoint>
TEnumerator<System.Types.TPoint>(
TEnumerator<System.Types.TPoint>
TEnumerable<System.Types.TPoint>-
TEnumerable<System.Types.TPoint> ^Z
;:{System.Generics.Collections}TList<System.Types.TPoint>.:1
IComparer<System.Types.TPoint>
 TCollectionNotifyEvent<System.Types.TPoint>
IEnumerable<System.Types.TPoint>
&TList<System.Types.TPoint>.TEnumerator5
&TList<System.Types.TPoint>.TEnumerator$aZ
TList<System.Types.TPoint>&
TList<System.Types.TPoint>
Uh.zZ
'TComparison<Vcl.Themes.TStyleHookClass>
%TComparer<Vcl.Themes.TStyleHookClass>2
%TComparer<Vcl.Themes.TStyleHookClass>,
B:{System.Generics.Collections}TList<Vcl.Themes.TStyleHookClass>.:3
:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.:1
hIComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
uTCollectionNotifyEvent<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
ItemRTPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>
jIEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
pTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.TEnumerator5
pTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.TEnumerator
dTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>&
dTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
5:{System.Generics.Collections}TList<System.TClass>.:1
IComparer<System.TClass>
IEnumerable<System.TClass>
TList<System.TClass>.TEnumerator5
TList<System.TClass>.TEnumerator|
TList<System.TClass>&
TList<System.TClass>
T:{System.Generics.Collections}TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.:1
7IComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>
9IEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>
?TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.TEnumerator5
?TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.TEnumeratorh
3TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>&
3TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>D
l:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.:1
Vcl.ThemesH
OIComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>
\TCollectionNotifyEvent<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>
Item9TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>
QIEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>
WTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.TEnumerator5
WTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.TEnumerator,
KTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>&
KTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>8
5:{System.Generics.Collections}TList<System.string>.:1
IComparer<System.string>
IEnumerable<System.string>
TList<System.string>.TEnumerator5
TList<System.string>.TEnumerator
TList<System.string>&
TList<System.string>\
L:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TSourceInfo>.:1
/IComparer<Vcl.Themes.TStyleManager.TSourceInfo>
1IEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>
7TList<Vcl.Themes.TStyleManager.TSourceInfo>.TEnumerator5
7TList<Vcl.Themes.TStyleManager.TSourceInfo>.TEnumerator
 TList<Vcl.Themes.TStyleManager.TSourceInfo>&
 TList<Vcl.Themes.TStyleManager.TSourceInfo>
;TComparison<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
9TComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>2
9TComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
V:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.:3
/TComparison<Vcl.Themes.TCustomStyleEngineClass>
-TComparer<Vcl.Themes.TCustomStyleEngineClass>2
-TComparer<Vcl.Themes.TCustomStyleEngineClass>
J:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleEngineClass>.:3
,TComparison<Vcl.Themes.TCustomStyleServices>
*TComparer<Vcl.Themes.TCustomStyleServices>2
*TComparer<Vcl.Themes.TCustomStyleServices>
G:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleServices>.:3
TComparison<System.Types.TPoint>
TComparer<System.Types.TPoint>2
TComparer<System.Types.TPoint>
;:{System.Generics.Collections}TList<System.Types.TPoint>.:3
.TDelegatedComparer<Vcl.Themes.TStyleHookClass>8
.TDelegatedComparer<Vcl.Themes.TStyleHookClass>
jTComparison<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
hTComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>2
hTComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.:3
TComparison<System.TClass>
TComparer<System.TClass>2
TComparer<System.TClass>P
5:{System.Generics.Collections}TList<System.TClass>.:3
9TComparison<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>
7TComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>2
7TComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>(
T:{System.Generics.Collections}TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.:3
QTComparison<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>
OTComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>2
OTComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>p
l:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.:3
TComparison<System.string>
TComparer<System.string>2
TComparer<System.string>
5:{System.Generics.Collections}TList<System.string>.:3
1TComparison<Vcl.Themes.TStyleManager.TSourceInfo>
/TComparer<Vcl.Themes.TStyleManager.TSourceInfo>2
/TComparer<Vcl.Themes.TStyleManager.TSourceInfo>
L:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TSourceInfo>.:3
BTDelegatedComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>8
BTDelegatedComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>
6TDelegatedComparer<Vcl.Themes.TCustomStyleEngineClass>8
6TDelegatedComparer<Vcl.Themes.TCustomStyleEngineClass>
3TDelegatedComparer<Vcl.Themes.TCustomStyleServices>8
3TDelegatedComparer<Vcl.Themes.TCustomStyleServices>l
'TDelegatedComparer<System.Types.TPoint>8
'TDelegatedComparer<System.Types.TPoint>
qTDelegatedComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>8
qTDelegatedComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>
!TDelegatedComparer<System.TClass>8
!TDelegatedComparer<System.TClass>
@TDelegatedComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>8
@TDelegatedComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>
XTDelegatedComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>8
XTDelegatedComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>X
!TDelegatedComparer<System.string>8
!TDelegatedComparer<System.string>\
8TDelegatedComparer<Vcl.Themes.TStyleManager.TSourceInfo>8
8TDelegatedComparer<Vcl.Themes.TStyleManager.TSourceInfo>
Vcl.ImgList
lrMonoChrome
Vcl.Menus
FAutoHotkeys
RethinkHotkeys
AutoHotkeys
AutoHotkeysDG\
Vcl.Forms
ssHotTrack
Vcl.Forms?
Vcl.Formsp
poProportional
fsShowing
FWindowState
FKeyPreview
WantChildKey
KeyPreview
WindowStateP
Vcl.Formsa
WindowState
Vcl.Forms0
FBiDiKeyboard
FNonBiDiKeyboard
FEnumAllWindowsOnActivateHint
FOnActionExecute
Keyword
EnumAllWindowsOnActivateHint
BiDiKeyboard
NonBiDiKeyboard
OnActionExecute8
!TScrollingStyleHook.TScrollWindow6
!TScrollingStyleHook.TScrollWindow4e]
1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem
(:TFormStyleHook.TMainMenuBarStyleHook.:1
FEnterWithKeyboard
$TFormStyleHook.TMainMenuBarStyleHook8
CheckHotKeyItem
$TFormStyleHook.TMainMenuBarStyleHook
EnterWithKeyboard
D$< FTP
Vcl.Imaging.pngimage
fKeyword
FLastErrorMsg
LastErrorMsg$
TRootKey
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
EJclMutexError
Vcl.Imaging.GIFImg
Vcl.Imaging.GIFImg0|a
ImportPalette
ImportColorTable
ImportDIBColors
ImportColorMap
ExportPalette
rmWindows20
rmWindows256
rmWindowsGray
rmMonochrome
rmQuantizeWindows
TMonochromeLookup7
TMonochromeLookup8
Vcl.Imaging.jpeg
Vcl.Buttons
Vcl.Buttons
System.WideStrings
aeoReportListAsValue
aeoReportRelative
flWindows
flExeFile
Supports
Uh!%f
Uh.cf
TSQLTimeStamp
TSQLTimeStampOffset
TSQLTimeStampVariantType0
TSQLTimeStampVariantType
Data.SqlTimSt
TSQLTimeStampOffsetVariantType0
TSQLTimeStampOffsetVariantType
TSQLTimeStampData6
ASQLTimeStamp
TSQLTimeStampData
TSQLTimeStampOffsetData6
ASQLTimeStampOffset
TSQLTimeStampOffsetData
Data.FmtBcd
dcrSQLWait
Data.DB
AMsg
Itibiti.IdException
EIcnCanNotBindPortInRange
EIcnInvalidPortRange
EIcnInvalidPortRangep
Itibiti.IdGlobal
Itibiti.IdBaseComponent
10.0.52
Itibiti.IdAntiFreezeBase
Itibiti.IdWinSock2
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
Itibiti.IdStackBSDBase
CheckIPVersionSupport
VPort
WSGetServByPort
APortNumber
WSTranslateSocketErrorMsg
EIcnIPVersionUnsupported
Wship6.dll
Itibiti.IdStackWindows
TIcn_SocketListWindows4
TIcn_SocketListWindows|
TIcn_StackWindowsg
SupportsIPv6
TIcn_StackWindows\
:TIcn_StackWindows.:1
Itibiti.IdStack
127.0.0.1
ftpTransfer
ftpReady
ftpAborted
Itibiti.IdComponent
Itibiti.IdExceptionCore
EIcnTCPConnectionError
EIcnObjectTypeNotSupported
FClientPortMin
FClientPortMax
FPeerPort
Itibiti.IdSocketHandle
ClientPortMin
ClientPortMax
PeerPort
Itibiti.IdStream
Itibiti.IdStreamRandomAccess
Itibiti.IdStreamVCLBase
Itibiti.IdStreamVCLWin32
Itibiti.IdStreamVCL
Itibiti.IdBuffer
Itibiti.IdIntercept
Itibiti.IdIOHandler
Itibiti.IdReply
Itibiti.IdCustomTransparentProxy
#EIcnTransparentProxyUDPNotSupported
#EIcnTransparentProxyUDPNotSupportedt
OpenUDP
CloseUDP
RecvFromUDP
VPeerPort
SendToUDP
Itibiti.IdIPAddress
IPAsStringL!g
TIcn_TCPClientCustom'
TIcn_TCPClientCustomx
Itibiti.IdTCPClient
TIcn_TCPClient
Itibiti.IdIOHandlerStack
&EIcnSocksUDPNotSupportedBySOCKSVersion
Itibiti.IdSocks
saUsernamePassword
FUDPSocksAssociation
0.0.0.1
FBoundPort
FBoundPortMax
FBoundPortMin
FDefaultPort
Itibiti.IdIOHandlerSocket
BoundPort
DefaultPort
BoundPortMax
BoundPortMin
Itibiti.IdReplyRFC
FLastCmdResult
TIcn_TCPConnectionB
RaiseExceptionForLastCmdResult
SendCmd
SendCmdS
TIcn_TCPConnectiont
Itibiti.IdTCPConnection
LastCmdResult
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
Itibiti.IdGlobalProtocols
Itibiti.IdHeaderList
Itibiti.IdCoder
Itibiti.IdCoder3to4
Itibiti.IdCoderMIME
Itibiti.IdAuthentication
Itibiti.IdHTTPHeaderInfo
Mozilla/3.0 (compatible; Indy Library)
Itibiti.IdYarn
Itibiti.IdTask
Itibiti.IdThreadSafe
Itibiti.IdThread
Itibiti.IdScheduler
Itibiti.IdServerIOHandler
fPassThrough
Itibiti.IdSSL
PassThrough
MakeFTPSvrPort
MakeFTPSvrPasv
CompressFTPDeflate
CompressFTPToIO
DecompressFTPFromIO
DecompressFTPDeflate
CompressHTTPDeflate
DecompressHTTPDeflate
Itibiti.IdZLibCompressorBase
Itibiti.IdURI
URLDecode
URLEncode
Itibiti.IdCookie
FCommentURL
FPortList
GetPort
SetPort
PortList
CommentURL
Itibiti.IdCookieManager
Itibiti.IdAuthenticationManager
AURL
Itibiti.IdMultipartFormData
TIcn_HTTPMethod
Itibiti.IdHTTP
TIcn_HTTPConnectionType
TIcn_HTTPOption
TIcn_HTTPOptions
TIcn_HTTPProtocolVersion
TIcn_HTTPOnRedirectEvent
FHTTP
TIcn_HTTPResponse7
TIcn_HTTPResponse
TIcn_HTTPRequest5
AHTTP
TIcn_HTTPRequest,
TIcn_HTTPProtocol;
TIcn_HTTPProtocol
FHTTPProto
TIcn_CustomHTTP'
TIcn_CustomHTTP@
HTTPOptions
TIcn_HTTP
TIcn_HTTP
EIcnHTTPProtocolExceptionn
EIcnHTTPProtocolException`
application/x-www-form-urlencoded
https
HTTP/1.0 200 OK
HTTP/
ECertStorageError
EDuplicateCertError
EDuplicateCertErrorP
CERT_PUBLIC_KEY_INFO
PublicKey
CERT_EXTENSION
PCERT_EXTENSION
PCERT_INFOt
CERT_INFOp
SubjectPublicKeyInfo
CERT_CONTEXT
dwCertEncodingType
pbCertEncoded
cbCertEncoded
pCertInfo
hCertStore
PCCERT_CONTEXT
crypt32.dll
CertEnumSystemStore
CertEnumPhysicalStore
IsAlgorithmSupported
EElHashFunctionUnsupportedError
EElHashFunctionUnsupportedErrorl
00010001
TSBCertificateExtension
ceAuthorityKeyIdentifier
ceSubjectKeyIdentifier
ceKeyUsage
cePrivateKeyUsagePeriod
ceCertificatePolicies
ceExtendedKeyUsage
ceNetscapeCertType
ceNetscapeBaseURL
ceNetscapeRevokeURL
ceNetscapeCARevokeURL
ceNetscapeRenewalURL
ceNetscapeCAPolicyURL
TSBCertificateExtensions
TSBKeyUsageType
kuKeyEncipherment
kuKeyAgreement
kuKeyCertSign
TSBKeyUsage
rfKeyCompromise
rfCessationOfOperation
rfCertificateHold
EElCertificateException
FKeyIdentifier
FAuthorityCertIssuer
FAuthorityCertSerial
"TElAuthorityKeyIdentifierExtension&
"TElAuthorityKeyIdentifierExtension
KeyIdentifier
AuthorityCertIssuer
AuthorityCertSerial
TElSubjectKeyIdentifierExtension
FKeyEncipherment
FKeyAgreement
FKeyCertSign
TElKeyUsageExtension
TElKeyUsageExtensionH
KeyEncipherment
KeyAgreement
KeyCertSign
!TElPrivateKeyUsagePeriodExtension
TElNetscapeCertTypeFlag
TElNetscapeCertType
FCertType
TElNetscapeCertTypeExtension(
TElNetscapeCertTypeExtension
CertType
TElNetscapeBaseURL
TElNetscapeRevokeURL
TElNetscapeCARevokeURL
TElNetscapeRenewalURL
TElNetscapeRenewalURLt
TElCertificatePoliciesExtension&
TElCertificatePoliciesExtension
TElExtendedKeyUsageExtension&
TElExtendedKeyUsageExtension0
FAuthorityKeyIdentifier
FSubjectKeyIdentifier
FKeyUsage
FPrivateKeyUsagePeriod
FCertificatePolicies
FExtendedKeyUsage
FNetscapeCertType
FNetscapeCARevokeURL
FNetscapeRevokeURL
FNetscapeBaseURL
FNetscapeRenewalURL
TElCertificateExtensions&
TElCertificateExtensions
AuthorityKeyIdentifier|
SubjectKeyIdentifierx
KeyUsage,
PrivateKeyUsagePeriod`
CertificatePolicies
ExtendedKeyUsage
NetscapeCertType$
NetscapeBaseURL
NetscapeRevokeURL
NetscapeCARevokeURL
NetscapeRenewalURL
FCertificateExtensions
CertExtensions
WriteExtensionKeyUsage
#WriteExtensionPrivateKeyUsagePeriod
WriteExtensionExtendedKeyUsage
!WriteExtensionCertificatePolicies
$WriteExtensionAuthorityKeyIdentifier
WriteExtensionNetscapeCertType
"WriteExtensionSubjectKeyIdentifier
SBMSKeyBlob
TRC4Key
TDESExpandedKey
TDESExpandedKeyEx
ExpandedKey
ExpandedKeyEx
T3DESExpandedKey
T3DESExpandedKeyEx
FPublicKeyAlgorithm
FPublicKeyAlgorithmParams
FPublicKey
FPrivateKey
FPrivateKeyBlob
TElCertificateRequest5
PublicKeyAlgorithm
SaveKeyToStream
SaveKeyToStreamPEM
Passphrase
SaveKeyToBufferPEM
SaveKeyToBufferPVK
SaveKeyToStreamPVK
SaveKeyToBuffer
GetPrivateKey
TElCertificateRequest$
EElCertificateRequestException
EElCertificateRequestExceptionH
NEW CERTIFICATE REQUEST
RSA PRIVATE KEY
DSA PRIVATE KEY
%TElAuthorityKeyIdentifierCRLExtension&
%TElAuthorityKeyIdentifierCRLExtension
TElCertificateIssuerCRLExtension&
TElCertificateIssuerCRLExtension
crlAuthorityKeyIdentifier
crlCertificateIssuer
FCertificateIssuer
CertificateIssuer
FSignatureAlgCertList
FSignatureParamsCertList
TElCertificateRevocationList5
Certificate
TElCertificateRevocationList
TRC2Key
TRC2ExpandedKey
TAESExpandedKey128
TAESExpandedKey256
C_GetOperationState
C_SetOperationState
C_Login
C_DigestKey
C_GenerateKey
C_GenerateKeyPair
C_WrapKey
C_UnwrapKey
C_DeriveKey
SBPKCS11CertStorage
mstPublicKey
voUseEmbeddedCerts
voUseLocalCerts
FCertStorage
FCertificates
FCertIDs
FCSCertIDs
GetCertIDs
GetCountersignatureCertIDs
CertStorage
CertIDs
CountersignatureCertIDs
Certificates
CertIDCount
CountersignatureCertIDCount0wo
FRecipientCerts
FIncludeCertificates
IncludeCertificates4
RecipientCerts
TElFakedX509Certificate
TElFakedX509Certificate0
TSBCertificateValidity
SBCustomCertStorage
TSBCertificateValidityReason
lcPublicKeyAlgorithm
lcPublicKeySize
lcAuthorityKeyIdentifier
lcSubjectKeyIdentifier
lcKeyUsage
TSBKeySizeLookupOption
TSBKeyUsageLookupOption
TSBKeyUsageLookupOptions
FPublicKeySizeMin
FPublicKeySizeMax
FKeySizeLookupOption
FKeyUsageLookupOptions
TElCertificateLookup6
TElCertificateLookup0
PublicKeySizeMin
PublicKeySizeMax
AuthorityKeyIdentifier
SubjectKeyIdentifier
KeyUsage
KeySizeLookupOption
KeyUsageLookupOptions
:TElCustomCertStorage.:1
TElCustomCertStorage5
CopyPrivateKey
ExportTo
KeyEncryptionAlgorithm
CertEncryptionAlgorithm
GetIssuerCertificate
GetCertificates
TElCustomCertStoraged
FCertificateList
TElMemoryCertStorage5
X509Certificate
TElMemoryCertStorageh
CertificateList
EElCertStorageException
:TElCustomCertStorage.:2
FKeyEncryptionAlgorithm
FKeyEncryptionAlgorithmParams
FEncryptedKey
KeyEncryptionAlgorithmParams
EncryptedKey
FOriginatorCerts
OriginatorCerts
FPrivateKeys
FCertEncryptionAlgorithm
FLastKeyId
SBWinCertStorage
:TElWinCertStorage.:1
FStoreIndexes
TElWinCertStorage5
Exportable
TElWinCertStorage
TSBCertFileFormat
TSBX509KeyFileFormat
TElSubjectPublicKeyInfo&
TElSubjectPublicKeyInfo
FSubjectPublicKeyInfo
TElTBSCertificate&
TElTBSCertificate
TElBaseCertStorage
TElBaseCertStorage,>q
FtbsCertificate
FCertificateSize
FCertificateOffset
FCACertType
FCACertTypeSign
FCAKeyIdentifier
FOurKeyIdentifier
FPublicKeyBlob
FPreserveKeyMaterial
FPrivateKeyExists
TElX509Certificate5
DetectCertFileFormat
DetectKeyFileFormat
PassPhrase
LoadKeyFromBuffer
LoadKeyFromBufferPEM
LoadKeyFromBufferMS
LoadKeyFromBufferPVK
LoadKeyFromStream
LoadKeyFromStreamPEM
LoadKeyFromStreamMS
LoadKeyFromStreamPVK
DWordsInEncryptKey
SaveKeyToBufferMS
SaveKeyToBufferNET
SaveKeyValueToBuffer
SaveKeyToStreamMS
SaveKeyToStreamNET
SetCACertificate
SetCAPrivateKey
PRSAPublicKey
RSAPublicKeySize
CACertificate
RSAPublicKey
GetPublicKeyBlob
IncludeCertificates
GetPublicKeySize
IsKeyValid
TElX509Certificate
CertificateBinary
CertificateSize
PrivateKeyExists
PrivateKeyExtractable
PreserveKeyMaterial
:TElX509Certificate.:1
CERTIFICATE
DH PRIVATE KEY
PRIVATE KEY
:TElX509Certificate.:2
:TElX509Certificate.:3
:TElX509Certificate.:4
1.2.840.113549.2.5
TIDEAExpandedKeyh
TSBCertificateValidateEvent
FOnCertificateValidate
OnCertificateValidate
TSBCamelliaExpandedKey
LongKey
TClientCertificateType
TSBChooseCertificateEvent
CertificateIndex
TSBCertificateNeededEvent
CertificateBuffer
PrivateKeyBuffer
PrivateKeySize
CertificateType
TSBCertificateNeededExEvent
TSBKeyExchangeAlgorithm
KeySize
stClientMasterKeySent
st3CertificateReceived
st3ServerKeyExchangeReceived
st3CertificateSent
st3ClientKeyExchangeSent
st3CertificateVerifySent
KeyExchangeAlgorithm
FOnCertificateChoose
FOnCertificateNeeded
FOnCertificateNeededEx
FCertificateRequestReceived
FSSL2ClientReadKey
FSSL2ClientWriteKey
FSSL2MasterKey
FSSL2ServerCertificate
FSSL2CertificateChallengeData
FSSL3ClientWriteKey
FSSL3ServerWriteKey
FTLS1ClientWriteKey
FTLS1ServerWriteKey
FKeyAvailable
FClientCertificates
Join
OnCertificateChoose
OnCertificateNeeded
OnCertificateNeededEx4
key expansion
client write key
server write key
OnCertificateNeededEx
Passthrough
EIdCanNotBindPortInRange
EIdInvalidPortRange
EIdInvalidPortRangexZt
AddServByPortToList
IdStackWindows
TIdSocketListWindows4
TIdSocketListWindows
TIdStackWindowsg
ReceiveMsg
TIdStackWindows
Uh.Ru
EIdIPVersionUnsupported
ReceiveMsg,
IdHTTP1
FUrl
sesExecuting
TScheduledEventExecute
hoBeforeMsg
hoAfterMsg
uMsg
ccIDSBinaryOperator
ccIDSTrinaryOperator
ccJoinControl
Uh%fx
SendCmdLineParams
TCmdLineReceivedEvent
CmdLine
FOnCmdLineReceived
FSendCmdLine
SendCmdLine
OnCmdLineReceived
JvExExtCtrls
00-00-00-00-00-00
TRODLComplexEntity&
TRODLComplexEntity
TRODLOperationParam
fOperationResult
TRODLOperation&
TRODLOperation lz
GetOperationsList
FindOperation
anOperationName
GetOperation
DigestKey
DigestKeySize
FKeySize
MaxKeySize
InitKey
HasHashKey
aKey
TROCryptoKey
FEncryptionSendKey
FEncryptionRecvKey
EncryptionSendKey4
EncryptionRecvKey
IROTransport
IROTransportChannelp
IROTCPTransportp
IROTCPTransportProperties0
IROHTTPTransport0
IROHTTPTransportEx
fPort
HTTPDispatcher
IROAsyncTransportChannel
IROActiveAsyncTransportChannel
IROTransportChannelEx
!IROTransportChannelAsyncException
fTransportChannel
fAsyncTransportChannel
fActiveAsyncTransportChannel
aTransportChannel
uROHTTPTools
TROHTTPAcceptEncodingMode
TROHTTPAcceptEncodingModes
IROHTTPClientCapabilities
<?xml version="1.0" encoding="utf-8"?><access-policy><cross-domain-access><policy><allow-from http-request-headers="*"><domain uri="*"/></allow-from><grant-to><resource path="/" include-subpaths="true"/></grant-to></policy></cross-domain-access></access-policy>
__TransportChannel
TStreamOperation
aTransport
TROTransportChannel
TROBaseConnectionOperation
fOnLoginNeeded
TROTransportChannel6
OnLoginNeeded
etcp10000_MacRoman
etWindows1250
etWindows1251
etWindows1252
ENot_Supported_Err
ENot_Supported_ErrP
ET_ENCODING_NOT_SUPPORTED
supportsDocumentFormat
supports
importNode
importedNode
FSupportedLanguages
supportedLanguages
%createCMExtParameterEntityDeclaration
%createCMIntParameterEntityDeclaration
XPATH_AND_OPERATOR_TOKEN
XPATH_OR_OPERATOR_TOKEN
XPATH_MOD_OPERATOR_TOKEN
XPATH_DIV_OPERATOR_TOKEN
XPATH_MULTIPLY_OPERATOR_TOKEN
XPATH_SLASH_OPERATOR_TOKEN#XPATH_SHEFFER_STROKE_OPERATOR_TOKEN
XPATH_PLUS_OPERATOR_TOKEN
XPATH_MINUS_OPERATOR_TOKEN
XPATH_IS_EQUAL_OPERATOR_TOKEN!XPATH_IS_NOT_EQUAL_OPERATOR_TOKEN
XPATH_LESS_THAN_OPERATOR_TOKEN'XPATH_LESS_THAN_OR_EQUAL_OPERATOR_TOKEN!XPATH_GREATER_THAN_OPERATOR_TOKEN*XPATH_GREATER_THAN_OR_EQUAL_OPERATOR_TOKEN
TdomXPathLeftParenthesis
TdomXPathSlashOperator
TdomXPathShefferStrokeOperator
TdomXPathShefferStrokeOperatorh
TdomXPathPlusOperator\
TdomXPathPlusOperator4
TdomXPathMinusOperator
TdomXPathIsEqualOperator
TdomXPathIsNotEqualOperator
TdomXPathIsNotEqualOperatord
TdomXPathLessThanOperatorT
TdomXPathLessThanOperator(
TdomXPathLessThanOrEqualOperator
TdomXPathGreaterThanOperator
#TdomXPathGreaterThanOrEqualOperator
#TdomXPathGreaterThanOrEqualOperatorx
TdomXPathAndOperator
TdomXPathAndOperatorL
TdomXPathOrOperator
TdomXPathModOperator
TdomXPathDivOperator
TdomXPathDivOperatorh
TdomXPathMultiplyOperatorH
TdomXPathMultiplyOperator
SL_NO_DOUBLE_SLASH3SL_XPATH_AXIS_NAME_DESCENDANT_OR_SELF_TOKEN_FOLLOWS#SL_XPATH_DOUBLE_COLON_TOKEN_FOLLOWS%SL_XPATH_NODE_TYPE_NODE_TOKEN_FOLLOWS!SL_XPATH_LEFT_PARENTHESIS_FOLLOWS"SL_XPATH_RIGHT_PARENTHESIS_FOLLOWS&SL_XPATH_SLASH_OPERATOR_TOKEN_FOLLLOWS
IROHTTPRequest
IROHTTPResponse
IROHTTPDispatcher
IROHTTPServer
WSUP_IICOptions_launch_url
fUpdateURL
fBrowserInitialURL
UpdateURL
BrowserInitialURL
fpassword
Vcl.AxCtrls
Vcl.OleCtrls
LicenseKey
Vcl.OleServer
'TServerEventDispatch.Invoke$7171$0$Intf
'TServerEventDispatch.Invoke$7171$ActRec
'TServerEventDispatch.Invoke$7171$ActRec(.
IWebBrowser
IWebBrowserApp82
IWebBrowser2l2
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowserWindowSetResizable
TWebBrowserWindowSetLeft
TWebBrowserWindowSetTop
TWebBrowserWindowSetWidth
TWebBrowserWindowSetHeight
TWebBrowserWindowClosing
TWebBrowserClientToHostWindow
TWebBrowserSetSecureLockIcon
TWebBrowserFileDownload
TWebBrowserNavigateError
%TWebBrowserPrintTemplateInstantiation
TWebBrowserPrintTemplateTeardown
TWebBrowserUpdatePageStatus
%TWebBrowserPrivacyImpactedStateChange
TWebBrowserNewWindow3
bstrUrlContext
bstrUrl
"TWebBrowserSetPhishingFilterStatus
TWebBrowserWindowStateChanged
dwWindowStateFlags
TWebBrowserNewProcess
TWebBrowserThirdPartyUrlBlocked
!TWebBrowserRedirectXDomainBlocked
StartURL
RedirectURL
FLastUrl
FOnWindowSetResizable
FOnWindowSetLeft
FOnWindowSetTop
FOnWindowSetWidth
FOnWindowSetHeight
FOnWindowStateChanged
FOnThirdPartyUrlBlocked
TWebBrowser&
cmdID
cmdexecopt
TWebBrowser
OnWindowSetResizable
OnWindowSetLeft
OnWindowSetTop
OnWindowSetWidthd=
OnWindowSetHeight
OnWindowStateChanged
OnThirdPartyUrlBlockedlG
LocationURL(
ServerPassword
ProductKey
registry.dat
SYSTEM_ACCOUNT_KEY=
SYSTEM_PASSWORD=
PRODUCT_KEY=ITI
:itibiti.com:
10.10.10.14
Software\Microsoft\Windows\CurrentVersion\Run
FProductUrl
FProductKey
FProductKeyCode
FItibitiExePath
JvScheduledEvents1Events0Execute
Error: HTTP/1.1 404 Not Found
Error: HTTP/1.1 505 HTTP Version Not Supported
WebExternalObjectAPI_TLB
IWebWindowControl
WebExternalObjectAPI_TLB"
WebExternalObjectAPI_TLB!
IRTCProfile
IRTCParticipant
!IRTCSessionOperationCompleteEvent
IRTCParticipantStateChangeEvent
IRTCProfileEvent
IRTCPresencePropertyEvent
IRTCPresenceDataEvent
IRTCPresenceStatusEvent
fTCP
TEvent_SessionOperationComplete
obEvent!IRTCSessionOperationCompleteEvent
FOnSessionOperationComplete
OnSessionOperationComplete
FRegPassword
<provision key="5B29C449-29EE-4fd8-9E3F-04AED077690E"
password="
protocol="udp"
GetSystemAccountKey
GetProductKey
PhoneApi.GetPhoneState()
PhoneApi.GetPhoneStateString()
PhoneApi.Cancel()
PhoneApi.Clear()
PhoneApi.Dial()
PhoneApi.Dial0()
PhoneApi.Dial1()
PhoneApi.Dial2()
PhoneApi.Dial3()
PhoneApi.Dial4()
PhoneApi.Dial5()
PhoneApi.Dial6()
PhoneApi.Dial7()
PhoneApi.Dial8()
PhoneApi.Dial9()
PhoneApi.DialAsterisk()
PhoneApi.DialPound()
PhoneApi.GetMD5Secret()
PhoneApi.GetRegistrationState()
PhoneApi.GetRegistrationStateString()
PhoneApi.GetSystemAccountKey()
PhoneApi.Get_DialString()
PhoneApi.Get_InfoText()
PhoneApi.Get_MicrophoneVolume()
PhoneApi.Get_Mute()
PhoneApi.Get_SpeakerVolume()
PhoneApi.Get_StatusText()
PhoneApi.Set_MicrophoneVolume()
PhoneApi.Set_Mute()
PhoneApi.Set_SpeakerVolume()
PhoneApi.SetupWizard()
PhoneApi.Redial()
PhoneApi.Send()
PhoneApi.Set_DialString()
PhoneApi.ParseDialChar()
PhoneApi.RegisterClient()
PhoneApi.UnregisterClient()
fTargetURL
TROBaseHTTPChannel6
TROBaseHTTPChannel
uROBaseHTTPClient
TargetURL
uIcnROIndySupport
TIcn_ROIndyHTTPChannel6
TIcn_ROIndyHTTPChannel
uIcnROIndyHTTPChannel
Icn_ROIndyHTTPChannel
fWebWindow
fWebWindowControl
WebWindow
WebExternalObjectAPI_Impl
TWebWindowControl9
TWebWindowControll
External.Get_Controller()
External.Get_OnEventCallback()
External.LoadAPI()
External.Set_Controller()
External.Set_OnEventCallback()
WebWindow.GetJSWindow()
WebWindow.GetVisibleState()
WebWindow.Get_BackgroundActive()
WebWindow.Get_Height()
WebWindow.Get_Left()
WebWindow.Get_Showing()
WebWindow.Get_Title()
WebWindow.Get_Top()
WebWindow.Get_TransparentColor()
WebWindow.Get_URL()
WebWindow.Get_Width()
WebWindow.Get_WindowID()
WebWindow.Close()
WebWindow.Hide()
WebWindow.Maximize()
WebWindow.Minimize()
WebWindow.Navigate()
WebWindow.Refresh()
WebWindow.RemoveBackground()
WebWindow.Restore()
WebWindow.SetBackground()
WebWindow.SetMenuVisible()
WebWindow.SetShowScrollBars()
WebWindow.SetAllowTextSelection()
WebWindow.SetDisableContextMenu()
WebWindow.SetStatusbarVisible()
WebWindow.SetToolbarVisible()
WebWindow.Set_BackgroundActive()
WebWindow.Set_Height()
WebWindow.Set_Left()
WebWindow.Set_Top()
WebWindow.Set_Width()
WebWindow.Show()
App.CheckForUpdate()
App.CreateWindow(true)
App.CreateWindow(false)
App.GetClientIdentifier()
App.GetIsRegistered()
App.GetProductKey()
App.GetProductName()
App.GetProductVersion()
App.GetWindowID()
App.Get_WindowCount()
App.SessionRegister()
App.SessionUnregister()
App.SetNextWindowHidden()
App.ShowTrayBalloon()
App.Shutdown()
App.Wait()
TITI_WebContainerP
HandleEnterKey
TITI_WebContainer
uWebContainer
Winapi.oleacc
Vcl.ActnColorMaps
Vcl.ActnCtrls
FControlHeightIndexes
Vcl.ShadowWnd
Vcl.ABAccessibility
Vcl.ActnMenus
FItemKeyed
PersistentHotKeys
Vcl.ActnMenusD
Keyed
Vcl.ActnMan
OnExecutePg
FAutoHotKeys
AutoHotKeys
TCommandProperties.TChangeState
0TCommandProperties.TCommandPropertiesChangeEvent
TButtonProperties.TButtonSize
TButtonProperties.TButtonType
TButtonProperties.TGroupPosition
"TButtonProperties.TTextAssociation
TGalleryProperties.TGalleryType
FKeyTip
KeyTip
FPersistentHotKeys
Vcl.XPActnCtrls
Vcl.StdActnMenus
Vcl.ThemedActnCtrls
!Vcl.PlatformDefaultStyleActnCtrls
Vcl.XPStyleActnCtrls
Vcl.ActnPopup
Vcl.RibbonActnMenus
Vcl.AppEvnts
Vcl.ScreenTips
Vcl.CheckLstH
Vcl.CheckLst
ResetActnExecute
ResetUsageDataActnExecute
RecentlyUsedActnExecute
ShowHintsActnExecute
ShowShortCutsInTipsActnExecute
LargeIconsActnExecute
ResetActnExecute
Vcl.CustomizeDlg
Vcl.Ribbon
TCustomRibbonGroup.TGroupAlign
TCustomRibbonGroup.TRowPosition
FKeyTipForm
BarHandleKeyTips
KeyTips
BarHideKeyTips
BarShowKeyTips
GetKeyTip
KeyTipClick
HandleKeyTip
HideKeyTip
SetKeyTip
ShowKeyTip
KeyTipL
TQuickAccessToolbar.TQATPosition
2TCustomRibbonQuickAccessToolbar.TMoreCommandsEvent
KeyTipForm
HandleKeyTips
HideKeyTips
ShowKeyTips
KeyTip|
%TRibbonSystemButton.TSystemMenuButton
tssHidden
TCustomTabData.TItemData
TCustomRibbon.TTabChangeEvent
TCustomRibbon.TContextMenuOption
!TCustomRibbon.TContextMenuOptions
FKeyTipsVisible
FAllowKeyboardNavigation
CustomFrameSupported
GlassFrameSupported
TabHandledKeyTips
TabHideKeyTips
TabShowKeyTips
.SVWU
.SVWUQ
Vcl.RibbonGalleryBar
Vcl.RibbonActnCtrls
TKeyTipPosition
TKeyTipHandled
TKeyTipMatchType
TKeyTipMatchItemi
TKeyTipMatchItem4
TKeyTipList&
TKeyTipListL
IRibbonBarKeyTip
IRibbonKeyTip
TKeyTipValidatorp
SrcKeyTip
CmdKeyTip
TKeyTipValidator
TKeyTipWindow6
TKeyTipWindow
Vcl.RibbonStyleActnCtrls
stKeyTipsActive
stScrollLeftPressed
%TCustomRibbonSkin.TRibbonSkinLoadType
Vcl.RibbonLunaStyleActnCtrls
SupportsMultipleDispatchers
uIPHttpHeaders
fTargetUrl
fAuthPassword
fIsHTTPS
TIPHTTPRequestHeaders&
TIPHTTPRequestHeadersL
AuthPassword
IsHTTPS
TIPHTTPResponseHeaders&
TIPHTTPResponseHeaders
IntExecute
TROHTTPDispatcher6
TROHTTPDispatcher
uROHTTPDispatch
TROHTTPMessageDispatchersA
TROHTTPMessageDispatchers
TROExtendedHTTPDispatcherList&
TROExtendedHTTPDispatcherList
TROSuperHTTPWaitingConnection8
TROSuperHTTPWaitingConnection(
uROBaseSuperHttpServer
IROSuperHTTPServerConnection
TROSuperHTTPServerConnection7
TROSuperHTTPServerConnection
IROSuperHTTPServerResponse
TROSuperHTTPServerResponseG
TROSuperHTTPServerResponse
TROBaseSuperHTTPServer6
TROBaseSuperHTTPServerT
:B%uT
GetTransportObject
GetTargetURL
SetTargetURL
iMaxUdpDg
sin6_port
255.255.255.255
rsmTCPIP4
rsmTCPIP6
fLocalPortOverride
fRemotePortOverride
GetLocalPort
GetRemotePort
aPort
LocalPortOverride
RemotePortOverride
uIPAsyncHttpServer
TIPAsyncHTTPRequestHandler
TIPAsyncHTTPServer&
TIPAsyncHTTPServer
TROIpSuperHTTPServer6
TROIpSuperHTTPServer(
uROIpSuperHttpServer
OnLoginNeeded
fRemoteSupportsOptions
DoExecute
fOnExecute
uROBaseSuperTCPServer
TROBaseSuperTCPServer6
TROBaseSuperTCPServerL0
EIdPortRequired
EIdTCPConnectionError4
EIdTCPConnectionError
EIdObjectTypeNotSupported
VMsgEnd
"EIdTransparentProxyUDPNotSupported
"EIdTransparentProxyUDPNotSupported,
SendToUDPm
IPAsStringU
TIdTCPClientCustom'
TIdTCPClientCustom
IdTCPClient
TIdTCPClient
TIdTCPClient4 
%EIdSocksUDPNotSupportedBySOCKSVersion
SendToUDP9
TIdTCPConnectionB
SendCmdf
TIdTCPConnection
IdTCPConnection
IdCustomTCPServer
TIdCustomTCPServer'
TIdCustomTCPServer
DefaultPort`
EIdTCPServerErrorh
EIdTCPServerError@
EIdTCPNoOnExecuteD
EIdTCPNoOnExecute
IdTCPServer
TIdTCPServer
TROSuperTCPServer
uROSuperTCPServer
"TROServerLocator_ThreadPoolSupport
EROSuperTCPChannelException
EROSuperTCPChannelExceptionTM
uROBaseSuperTCPChannel
TROBaseSuperTCPChannel6
TROBaseSuperTCPChannel
TROSuperTCPChannel
uROSuperTCPChannel
EROSuperHTTPChannelException
uROBaseSuperHttpChannel
fHTTPRequestTimeout
TROBaseSuperHTTPChannel6
TROBaseSuperHTTPChannel
HTTPRequestTimeout
TargetUrl
TROSuperHTTPThread6
TROSuperHTTPThread
THookVerifyCert
LT_SSHv2
ResolvePort
GetLocalSinPort
GetRemoteSinPort
FSocksPort
FSocksPassword
FSocksResponsePort
FSocksLocalPort
FSocksRemotePort
FBypassFlag
SocksPort
SocksPassword
FHTTPTunnelIP
FHTTPTunnelPort
FHTTPTunnel
FHTTPTunnelRemoteIP
FHTTPTunnelRemotePort
FHTTPTunnelUser
FHTTPTunnelPass
FHTTPTunnelTimeout
TTCPBlockSocket&
TTCPBlockSocket
HTTPTunnelIP
HTTPTunnelPort
HTTPTunnelUser
HTTPTunnelPass
HTTPTunnelTimeout,
HTTPTunnel
FOnVerifyCert
FKeyPassword
FCertificateFile
FPrivateKeyFile
FCertificate
FCertCA
FCertCAFile
FTrustCertificate
FTrustCertificateFile
FVerifyCert
FSSHChannelType
FSSHChannelArg1
FSSHChannelArg2
FCertComplianceLevel
GetCertInfo
GetVerifyCert
KeyPassword
CertificateFile
PrivateKeyFile
PrivateKey
TrustCertificateFile
TrustCertificate
CertCA
CertCAFile
VerifyCert
SSHChannelType
SSHChannelArg1
SSHChannelArg2
CertComplianceLevelx
OnVerifyCert
FTargetPort
TargetPort
httpsend
FAlivePort
FProxyPass
FAddPortNumberToHost
THTTPSend&
HTTPMethod
THTTPSend
ProxyPass
AddPortNumberToHost
FHTTPSend
AHTTPSend
uROSynapseSupport
TROSynapseSuperHTTPChannel6
TROSynapseSuperHTTPChannel
uROSynapseSuperHttpChannel
TROSynapseSuperTCPChannel
uROSynapseSuperTCPChannel
TROSynapseSuperTCPServer
uROSynapseSuperTCPServer
TWebPanelExtension_WndMethod
TWebPanelExtension
TWebPanelExtension@
uWebPanelExtensionF
TJSApiPermission
permWebWindowAccess
uFrmWebWindow
TJSApiPermissions
WebPanel4
txtURL8
URLNavigateRetryTimer=
WebPanel
txtURL
URLNavigateRetryTimer
FWebContainer
FApiPermissions
FBrowserInitialURL
EmbeddedBrowserWindowSetHeight#
EmbeddedBrowserWindowSetLeft(
!EmbeddedBrowserWindowSetResizable"
EmbeddedBrowserWindowSetTop$
EmbeddedBrowserWindowSetWidth#
actionStatusBarExecute
actionCloseExecute
actionToolbarExecute
actionMenubarExecute
actionBackExecute
actionForwardExecute
actionRefreshExecute
actionGoExecute
actionStopExecute
txtURLKeyPress
EditSelectAll1Execute$
!EmbeddedBrowserWindowStateChanged(
txtURLChange%
EditCopy1Execute
EditCut1Execute
EditPaste1Execute
EditUndo1Execute
actionTestExecute
actionSilentExecute
actionDebugPageExecute
ChangeBackgroundExecute
ActMinimizeExecute
ActMaximizeExecute
ActRestoreExecute
WebPanelWndProc
actionScrollBarExecute
actionAudioOffExecute
actionAudioOnExecute*
#EmbeddedBrowserThirdPartyUrlBlocked
URLNavigateRetryTime#
TfrmWebWindow
EmbeddedBrowserWindowSetHeight
EmbeddedBrowserWindowSetLeft
!EmbeddedBrowserWindowSetResizable
EmbeddedBrowserWindowSetTop
EmbeddedBrowserWindowSetWidth
EditSelectAll1Execute
!EmbeddedBrowserWindowStateChanged
txtURLChange
actionTestExecute
actionAudioOnExecute
#EmbeddedBrowserThirdPartyUrlBlocked
URLNavigateRetryTime
MsgHandler
NavigateUrl
TfrmWebWindowd
ApiPermissions
Action.AudioOff()
Action.AudioOn()
Action.Back()
Action.Close()
Action.DebugPage()
Action.Forward()
Action.Go()
Action.Maximize()
Action.Menubar()
Action.Refresh()
Action.Restore()
Action.ScrollBar()
Action.Silent()
Action.StatusBar()
Action.Stop()
Action.Test()
Action.Toolbar()
Action.Minimize()
OLE.Copy()
OLE.CopyUpdate()
OLE.Cut()
OLE.CutUpdate()
OLE.Paste()
OLE.PasteUpdate()
OLE.SelectAll()
OLE.SelectAllUpdate()
OLE.Undo()
OLE.UndoUpdate()
IE.DragOver()
IE.FileDownload()
EVENT_WINDOW_URL_CHANGED
IE.CreateWindow()
WebWindow.ClearPage
IE.StatusBar()
IE.WindowClosing()
WebWindow.URLNavigateRetryTime(
TWebWindowList&
TWebWindowList
uWebWindowManagement
actExitExecute
AppInstancesCmdLineReceived
debug.log
System.SysConst
System.RTLConsts
System.Character
Winapi.PsAPI
Winapi.SHFolder
Winapi.ImageHlp
System.VarUtils
Winapi.Messages
Vcl.Consts
System.UIConsts
System.IOUtils
System.Math
System.Masks
System.Diagnostics
System.AnsiStrings
System.StrUtils
System.Win.Crtl
Winapi.Dwmapi
Winapi.UxTheme
Winapi.CommCtrl
Winapi.MultiMon
Winapi.Dlgs
Winapi.ShellAPI
Winapi.IpExport
Winapi.Winsock2
Winapi.Qos
Winapi.CommDlg
Winapi.msxml
System.Win.ComConst
Winapi.StructuredQueryCondition
Winapi.PropSys
Winapi.ObjectArray
Winapi.WinInet
Winapi.RegStr
Vcl.ComStrs
Winapi.WinSpool
Winapi.RichEdit
Winapi.FlatSB
Winapi.Imm
System.WideStrUtils
Winapi.TpcShrd
Winapi.AccCtrl
Winapi.TlHelp32
Winapi.WinSock
Winapi.MMSystem
Vcl.OleConst
System.Win.StdVCL
Winapi.Nb30
Vcl.Imaging.JConsts
Vcl.Grids
Vcl.Mask
System.MaskUtils
Vcl.Imaging.pnglang
Vcl.Imaging.GIFConsts
Itibiti.IdResourceStringsCore
Itibiti.IdResourceStrings
Itibiti.IdWship6
Itibiti.IdTStrings
Itibiti.IdStackConsts
Itibiti.IdStreamVCLWin32"Itibiti.IdResourceStringsProtocols
Itibiti.IdIOHandlerStack Itibiti.IdCustomTransparentProxy
Itibiti.IdAssignedNumbers
Itibiti.IdCharsets
Data.DBConsts
Data.DBCommonTypes
Vcl.ExtDlgs
Vcl.FileCtrl
Itibiti.IdAntiFreeze
uWebPanelExtension
uROIndySupport
Vcl.ExtActns
Winapi.Mapi
Vcl.XPStyleActnCtrls!Vcl.PlatformDefaultStyleActnCtrls
Vcl.RibbonConsts
ECore.Init
EHook.Init
ESockets.Init
ExceptionLog.Init
hXXp://VVV.secureblackbox.com
MIIDtTCCAp2gAwIBAgIBATANBgkqhkiG9w0BAQUFADCByDELMAkGA1UEBhMCQ0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xIjAgBgNVBAoTGUZpZ21lbnQgVGVjaG5vbG9naWVzIEluYy4xIjAgBgNVBAsTGUZpZ21lbnQgQXV0aGVudGljYXRpb24gQ0ExIjAgBgNVBAMTGUZpZ21lbnQgQXV0aGVudGljYXRpb24gQ0Ex
MIIGvzCCBKegAwIBAgIBADANBgkqhkiG9w0BAQQFADCBoDELMAkGA1UEBhMCQ0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xFTATBgNVBAoTDEl0aWJpdGkgSW5jLjEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRQwEgYDVQQDEwtpdGliaXRpLmNvbTEgMB4GCSqGSIb3DQEJARYRYWRtaW5AaXRpYml0aS5jb20wHhcNMDkxMTA0MDY0MjE4WhcNMTkxMTAyMDY0MjE4WjCBoDELMAkGA1UEBhMCQ0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xFTATBgNVBAoTDEl0aWJpdGkgSW5jLjEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRQw
ZNOoaq CMhEf4VSbPP5j415rQUHOyvZJ/RHa1b7yPKX9qqxghnzm2PvM3je9e0g//UZkcxm0L/bkfQPmHkZvl7sXUTGLcbcmOj/nGZpb07CTRjTcp6ALfw/vtMW048llyVdf pX32SNwmwcybfBTgy1rgLSWQDwKT0/BiAiybDdDo8KatBYxsuUnOmdLOVjvVe29G8PqXRXrbhV6F45lVig4EKg6z1ulJtEyFqTU9PEQ/RCs4TP7fhk=
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
csshiftjis
windows-874
zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;<=
!"#$%&'()* ,-./0123
12005 The URL is invalid.
A12006 The URL scheme could not be recognized or is not supported.
I12012 The Win32 Internet function support is being shut down or unloaded.
12014 Password is incorrect.
)12016 The requested operation is invalid.
!12017 The operation was canceled.
B12018 The type of handle supplied is incorrect for this operation.
l12019 The requested operation cannot be carried out because the handle supplied is not in the correct state.
]12026 The required operation could not be completed because one or more requests are pending.
>12037 SSL certificate date is bad. The certificate is expired.
A12038 SSL certificate common name (host name field) is incorrect.
h12045 The function is unfamiliar with the Certificate Authority that generated the server's certificate.
*12055 The SSL certificate contains errors.
s12110 The requested operation cannot be made on the FTP session handle because an operation is already in progress.
12111 FTP session aborted.
212112 Passive mode is not available on the server.
@12135 The type of the locator is not correct for this operation.
~12136 The requested operation can be made only against a Gopher  server, or with a locator that specifies a Gopher  operation.
312154 The request made to HttpQueryInfo is invalid.
12156 The redirection failed because either the scheme changed (for example, HTTP to FTP) or all attempts made to redirect failed (default is five attempts).
*12160 The HTTP request was not redirected.
,12161 The HTTP cookie requires confirmation.
112162 The HTTP cookie was declined by the server.
612164 The Web site or server indicated is unreachable.
!12169 SSL certificate is invalid.
"12170 SSL certificate was revoked.
EAbout.pas
EBase64.pas
EBaseModule.pas
EBorlandDebug.pas
ECheck.pas
ECmdLine.pas
ECommon.pas
EConsts.pas
ECore.pas
ECrc32.pas
EDebug.pas
EDesign.pas
EDisAsm.pas
EEncrypt.pas
EHash.pas
EHook.pas
EIDEOptions.pas
ELang.pas
ELeaks.pas
EListView.pas
ELogManager.pas
EMain.pas
EMessages.pas
ENagScreen.pas
EOption.pas
EParser.pas
EResource.pas
ESockets.pas
EToolsAPI.pas
EToolServices.pas
ETypes.pas
EVariables.pas
EWait.pas
EWebTools.pas
EWinSock.pas
ExceptionLog.pas
EXMLBuilder.pas
EZip.pas
EZlib.pas
deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler
inflate 1.2.5 Copyright 1995-2010 Mark Adler
<4,$?7/'
(3-!0,1'8"5.*2$
/5061728394:
,-./01234567
/532016789
-Portions Copyright (c) 1999 by Hagen Reddmann
0|%U4
).XA 
h%c@m*
.ZTi5
*.yUW
;3 #>6.&
'2, / 0&7!4-)1#
oleaut32.dll
advapi32.dll
RegOpenKeyExW
RegCloseKey
GetConsoleOutputCP
UnhookWindowsHookEx
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MapVirtualKeyW
LoadKeyboardLayoutW
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetAsyncKeyState
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
msimg32.dll
gdi32.dll
SetViewportOrgEx
version.dll
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryW
GetCPInfoExW
GetCPInfo
RegUnLoadKeyW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryInfoKeyW
RegOpenKeyExA
RegLoadKeyW
RegFlushKey
RegEnumKeyExA
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
SHFolder.dll
ole32.dll
shell32.dll
ShellExecuteA
ShellExecuteW
comctl32.dll
msvcrt.dll
winspool.drv
winmm.dll
CryptImportKey
CryptExportKey
CryptDestroyKey
CryptGetUserKey
CertCreateCertificateContext
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CertOpenStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertDeleteCertificateFromStore
CertFreeCertificateContext
CertAddEncodedCertificateToStore
CertCloseStore
CertFindCertificateInStore
CertOpenSystemStoreA
netapi32.dll
oleacc.dll
wtsapi32.dll
RegDeleteKeyExW
windowscodecs.dll
uxtheme.dll
imm32.dll
DWMAPI.DLL
Itibiti.exe
stdole2.tlbWWW
WebExternalObjectAPI
IWebWindowControlWWW
WebWindowWWW
URLWd
GetSystemAccountKeyW
GetProductKeyWWW,
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
<<9876$8
>=<9887$8
hg<1)ú
E(.Fcn
<3"
3332322
-F'.lwBM
(f .nKJ@
F*Z.bpUT
cf%FT
6.ioO
^;%D 
w%D?ZiB
.Po$?
QzRq-p}
].ny6
\^b.pW
.ZS_{
Z!hP.bM
%2.xe
DG.ZH
.JZEX!V
/OCrtG
%c)5leN
n*R%U
.UF7X
.dMC@U%|#'
// IMPORTANT NOTICE:
// current version. Future version may support API calls
// from multiple pop-up windows.
this.initialize = function(SecurityKey) {
// We will potentially use the SecurityKey for making sure that no
external.OnEventCallback = this._EventHandler;
// touch tone key pad. For example, 'a' is converted to '2', and h is converted to '4'.
this.SetDialString = function(newValue) {
if (external.Phone != null) {
external.Phone.DialString = newValue;
this.GetDialString = function() {
return(external.Phone.DialString);
this.GetStatusText = function() {
this.GetInfoText = function() {
return(external.Phone.InfoText);
// Dial# - Dials a particular number as if on the telephone key pad
this.Dial1 = function() {
external.Phone.Dial1();
this.Dial2 = function() {
external.Phone.Dial2();
this.Dial3 = function() {
external.Phone.Dial3();
this.Dial4 = function() {
external.Phone.Dial4();
this.Dial5 = function() {
external.Phone.Dial5();
this.Dial6 = function() {
external.Phone.Dial6();
this.Dial7 = function() {
external.Phone.Dial7();
this.Dial8 = function() {
external.Phone.Dial8();
this.Dial9 = function() {
external.Phone.Dial9();
this.Dial0 = function() {
external.Phone.Dial0();
this.DialAsterisk = function() {
external.Phone.DialAsterisk();
this.DialPound = function() {
external.Phone.DialPound();
this.Clear = function() {
external.Phone.Clear();
this.Redial = function() {
external.Phone.Redial();
this.Mute = function() {
external.Phone.Mute = !external.Phone.Mute;
if (external.Phone.Mute) {
this.Send = function() {
external.Phone.Send();
this.Cancel = function() {
external.Phone.Cancel();
this.SetupWizard = function() {
external.Phone.SetupWizard();
this.GetMicVolume = function() {
return(external.Phone.MicrophoneVolume);
this.GetSpeakerVolume = function() {
return(external.Phone.SpeakerVolume);
this.SetMicVolume = function(volumeLevel) {
external.Phone.MicrophoneVolume = volumeLevel;
this.SetSpeakerVolume = function(volumeLevel) {
external.Phone.SpeakerVolume = volumeLevel;
this.Register = function() {
external.Phone.RegisterClient();
this.Unregister = function() {
external.Phone.UnregisterClient();
phone._StatusText = external.Phone.StatusText;
if (external.WebWindow.GetVisibleState()) {
} else if (eventId == "EVENT_WINDOW_URL_CHANGED") {
phone._OnEvent("EVENT_WINDOW_URL_CHANGED", windowId);
} else if (eventId.substr(0,18) == "EVENT_PHONE_STATE_") {
} else if (eventId.substr(0,19) == "EVENT_REGISTRATION_") {
this.GenerateEvent = function(selectorId) {
var select = document.getElementById(selectorId);
this._OnEvent(select.options[select.selectedIndex].value, "");
this.SetEventHandler = function(callBackFunction) {
// GetSystemAccountKey - Retrieves the good old "System Account Key"
// "System Accout Key" was a term invented by David Lucatch. :P
this.GetSystemAccountKey = function() {
return(external.Phone.GetSystemAccountKey());
this.GetMD5Secret = function() {
return(external.Phone.GetMD5Secret());
this.GetPhoneState = function() {
return(external.Phone.GetPhoneState());
this.GetRegistrationState = function() {
return(external.Phone.GetRegistrationState());
// The webwin object wrappers all browser window related functions.
var webwin = new function () {
// on the web page because the reloading of the background
// causes the web page to be reloaded... Any subsequent
this.LoadBackground = function(PNGFileName, TopMargin, LeftMargin, RightMargin, BottomMargin){
if (external.WebWindow != null) {
var backgroundFile = webwin._downloadImage(PNGFileName);
external.WebWindow.SetBackground(backgroundFile,TopMargin,LeftMargin,RightMargin,BottomMargin);
this.SetBackground = function(RawFile, TopMargin, LeftMargin, RightMargin, BottomMargin){
external.WebWindow.SetBackground(RawFile,TopMargin,LeftMargin,RightMargin,BottomMargin);
this.RemoveBackground = function() {
external.WebWindow.RemoveBackground();
this.GetBackgroundActive = function() {
return(external.WebWindow.BackgroundActive);
this.Minimize = function() {
external.WebWindow.Minimize();
this.Restore = function() {
external.WebWindow.Restore();
// Close - Close the current windows.
this.Close = function() {
external.WebWindow.Close();
this.Refresh = function() {
external.WebWindow.Refresh();
this.Hide = function() {
external.WebWindow.Hide();
this.Show = function() {
external.WebWindow.Show();
this.GetShowing = function() {
return(external.WebWindow.Showing);
// This is different from GetShowing() in that minimized windows are
this.GetVisibleState = function() {
return(external.WebWindow.GetVisibleState());
this.SetMenuVisible = function(value) {
external.WebWindow.SetMenuVisible(value);
this.SetStatusbarVisible = function(value) {
external.WebWindow.SetStatusbarVisible(value);
this.SetToolbarVisible = function(value) {
external.WebWindow.SetToolbarVisible(value);
this.SetShowScrollBars = function(value) {
if (document.body != null) {
if (typeof(document.body.scroll) !== undefined) {
document.documentElement.style.overflow = '';
document.body.scroll = 'yes';
document.documentElement.style.overflow = 'hidden';
document.body.scroll = 'no';
external.WebWindow.SetShowScrollBars(value);
this.SetAllowTextSelection = function(value) {
external.WebWindow.SetAllowTextSelection(value);
this.SetDisableContextMenu = function(value) {
external.WebWindow.SetDisableContextMenu(value);
this.GetTransparentColor = function() {
return(external.WebWindow.TransparentColor);
// - It is important to note that the R, G and B values must all be equal or
this.SetTransparentColor = function(value) {
external.WebWindow.TransparentColor = value;
this.DownloadRawFile = function(fileURL) {
return(this._downloadImage(fileURL));
this.GetURL = function(){
return(external.WebWindow.URL);
this.GetTitle = function(){
return(external.WebWindow.Title);
// Because the WebBrowser control can not be resized,
// web window (see hXXp://support.microsoft.com/kb/934363)
this.GetWidth = function(){
return(external.WebWindow.Width);
this.SetWidth = function(value) {
external.WebWindow.Width = value;
this.GetHeight = function(){
return(external.WebWindow.Height);
this.SetHeight = function(value) {
external.WebWindow.Height = value;
this.GetLeft = function(){
return(external.WebWindow.Left);
this.SetLeft = function(value) {
external.WebWindow.Left = value;
this.GetTop = function(){
return(external.WebWindow.Top);
this.SetTop = function(value) {
external.WebWindow.Top = value;
this._getXMLHttpRequest = function()
if (window.XMLHttpRequest) {
return new window.XMLHttpRequest;
return new ActiveXObject("MSXML2.XMLHTTP");
this._downloadImage = function(fileURL) {
var req = this._getXMLHttpRequest();
req.open("GET", fileURL, false);
req.setRequestHeader("Accept-Charset", "x-user-defined");
req.send();
if (req.status != 200){
alert(req.status);
return(req.responseBody);
setTimeout(function() {webwin.Show();}, 5000);
this.ShowTrayBalloon = function(title, info) {
if (external.Application != null) {
external.Application.ShowTrayBalloon(title, info);
// GetProductVersion - Retrieves the file version of the executable.
// the file version data from the executable and not the product version
this.GetProductVersion = function() {
return(external.Application.GetProductVersion());
// GetProductKey - Retrieves the product key used by Hero's original software
this.GetProductKey = function() {
return(external.Application.GetProductKey());
this.GetProductName = function() {
return(external.Application.GetProductName());
this.GetClientIdentifier = function() {
return(external.Application.GetClientIdentifier());
this.IsRegistered = function() {
return(external.Application.GetIsRegistered());
this.Debug = function(debugString, debugLevel) {
return(external.Debug(debugString, debugLevel));
// IMPORTANT - This is currently implemented as a BLOCKING SYNCHRONOUS
this.SessionRegister = function() {
return(external.Application.SessionRegister());
this.SessionUnregister = function() {
return(external.Application.SessionUnregister());
this.CheckForUpdate = function() {
return(external.Application.CheckForUpdate());
// CreateWindow - Creates a new web window
this.CreateWindow = function(hidden) {
return(external.Application.CreateWindow(hidden));
// JSWindow - Finds the web window referenced by the window ID
this.JSWindow = function(windowID) {
return(external.Application.FindJSWindow(windowID));
this.Wait = function(milliSeconds) {
return(external.Application.Wait(milliSeconds));
this.OpenHiddenWindow = function(newURL, windowName, windowParams) {
external.Application.SetNextWindowHidden(true);
return(window.open(newURL, windowName, windowParams));
this.Shutdown = function() {
external.Application.Shutdown();
this.GetWindowCount = function() {
return(external.Application.WindowCount);
this.GetWindowID = function(index) {
return(external.Application.GetWindowID(index));
this.GetAPIRevision = function() {
result = result.replace(/\$/g,'').replace("Rev:", "").replace(/^\s |\s $/g, '');
this.log = function(debugString) {
return(external.Debug(debugString, 1));
ISystem.Internal.ExcUtils
dSystem.SysConst
,System.Character
kWinapi.PsAPI
-Winapi.ImageHlp
%System.Classes
3Vcl.ActnMenus
RVcl.Dialogs
NSystem.Contnrs
System.StrUtils
yVcl.Consts
CVcl.ExtCtrls
eVcl.Forms
'System.UIConsts
iSystem.IOUtils
&System.DateUtils
YSystem.AnsiStrings
:Winapi.Imm
(Vcl.Menus
Vcl.ComCtrls
hWinapi.UrlMon
4Winapi.RegStr
WVcl.ComStrs
bVcl.Printers
8Vcl.ToolWin
jVcl.Clipbrd
CVcl.ActnColorMaps
bVcl.ExtDlgs
tVcl.Buttons
Vcl.PlatformDefaultStyleActnCtrls
mVcl.StdActnMenus
eVcl.RibbonConsts
'Vcl.AppEvnts
<uROBaseSuperHttpServer
 IdTCPServer
 uROIndySupport
uhttpsend
DuROSynapseSupport
"Winapi.WinSock
.JvProgressUtils
YSystem.WideStrings
UVcl.Mask
AItibiti.IdAntiFreeze
#Itibiti.IdResourceStrings
IItibiti.IdAntiFreezeBase
mItibiti.IdHeaderList
Itibiti.IdStack
kItibiti.IdStackWindows
tItibiti.IdWship6
rItibiti.IdStackBSDBase
"Itibiti.IdResourceStringsProtocols
xItibiti.IdCharsets
VItibiti.IdAuthentication
EItibiti.IdStreamVCLBase
=Itibiti.IdStreamVCL
uItibiti.IdStreamRandomAccess
SItibiti.IdCoderMIME
`Itibiti.IdCoder3to4
vItibiti.IdAuthenticationManager
luROBaseHTTPClient
Itibiti.IdIOHandlerSocket
Itibiti.IdCustomTransparentProxy
JItibiti.IdReplyRFC
>Itibiti.IdTCPClient
;Itibiti.IdIPAddress
4Itibiti.IdYarn
AItibiti.IdScheduler
SItibiti.IdThreadSafe
~Itibiti.IdThread
=SBPKCS11CertStorage
%SBSharedResource
_SBCustomCertStorage
1Vcl.Imaging.GIFImg
eVcl.Imaging.GIFConsts
<System.Win.StdVCL
BVcl.OleServer
sVcl.AxCtrls
=uROSynapseSuperTCPServer
:uROSynapseSuperTCPChannel
9uROBaseSuperHttpChannel
duFrmWebWindow
LWebExternalObjectAPI_TLB
=uWebPanelExtension
<xsl:stylesheet xmlns:xsl="hXXp://VVV.w3.org/1999/XSL/Transform" version="1.0">
<html xmlns="hXXp://VVV.w3.org/1999/xhtml">
<meta name="GENERATOR" content="XSL Rodl2Html.xsl"/>
<meta http-equiv="Content-Type" content="text/html"/>
.header
.body
.footer
.section
.spaced
<img src="favicon.ico" style="padding-right: 5px;"/>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.Services</xsl:attribute>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.EventSinks</xsl:attribute>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.Structs</xsl:attribute>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.Enums</xsl:attribute>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.Arrays</xsl:attribute>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.Exceptions</xsl:attribute>
<xsl:attribute name="href">#<xsl:value-of select="/Library/@Name"/>.Uses</xsl:attribute>
RemObjects Software, LLC. <a href="hXXp://VVV.remobjects.com">remobjects.com</a>.
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.Services</xsl:attribute>
The following table lists the Operations defined in "<xsl:value-of select="../../@Name"/>":
<xsl:for-each select="./Operations/Operation">
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.EventSinks</xsl:attribute>
<xsl:for-each select="./Operations/Operation">
<table xmlns="hXXp://VVV.w3.org/1999/xhtml">
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.Structs</xsl:attribute>
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.Enums</xsl:attribute>
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.Arrays</xsl:attribute>
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.Exceptions</xsl:attribute>
<xsl:attribute name="name"><xsl:value-of select="/Library/@Name"/>.Uses</xsl:attribute>
.header
.body
.footer
.section
.spaced
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
.header
.body
.footer
<img src="ºSEPATHúvicon.ico" style="padding-right: 5px;"/>%NAME%
%DOC%
<p><a href="ºSEPATH%doc">View full documentation</a> | <a href="ºSEPATH%rodl">View RODL</a></p>
%DISPATCHERS%
RemObjects Software, LLC. <a href="hXXp://VVV.remobjects.com">remobjects.com</a>.
}.ZvlB1(
.hnN?
o.Wlm
d[b%U
XF,gN%c
<Library Name="ItibitiComLib" UID="{6DCA0F35-32F4-446B-8B31-3DBF2E86E65F}" Version="3.0">
<Group Name="PhoneAPI" UID="{4766E883-11C2-40BE-894E-96B531D90942}">
<Service Name="ItibitiPhoneAPI" UID="{715B07D5-2873-49F4-A008-06712855E20D}">
<Group Under="{4766E883-11C2-40BE-894E-96B531D90942}" />
<Interface Name="Default" UID="{4230ED1F-5BC0-4047-8529-EBA69B1F0B7D}">
<Operations>
<Operation Name="NewMethod" UID="{AC5A95A2-922D-431D-AE45-4B9C48579564}">
</Operation>
<Operation Name="Dial1" UID="{B1481042-4E4A-4646-8958-35777313C0F9}">
<Operation Name="Dial2" UID="{4F9CFE3A-A8C7-4297-8934-643D8EAFC616}">
<Operation Name="Dial3" UID="{BC8F4F18-5A51-4C3B-94DD-B27C00F1EF9C}">
<Operation Name="Dial4" UID="{EF0AF940-D114-4EE7-9C84-AC81DBE5B1DC}">
<Operation Name="Dial5" UID="{17E36480-0F33-442B-8637-7DF839175AEF}">
<Operation Name="Dial6" UID="{D23CE280-DEB3-487D-AA9D-7B792A4749E6}">
<Operation Name="Dial7" UID="{B34644B5-B3A6-4228-AFFC-38DD7EC1DA05}">
<Operation Name="Dial8" UID="{2CDBD83C-D34D-4BAD-BBF5-A1940376B4DA}">
<Operation Name="Dial9" UID="{F15621DA-DD9D-4785-81F6-F32C6A6F7441}">
<Operation Name="Dial0" UID="{E2FFAAF7-1E6D-44BC-9677-CC105D2ED59C}">
<Operation Name="DialAsterisk" UID="{D0F68C40-967C-422E-9400-0866B866685F}">
<Operation Name="DialPound" UID="{B604D34A-2BE2-44BB-BCF2-5761D277CF8B}">
<Operation Name="Clear" UID="{CF720C8F-5248-4349-9B8D-7EDDECD84949}">
<Operation Name="Redial" UID="{9CCBC891-1CA6-423B-96C9-F021A0641A00}">
<Operation Name="GetMute" UID="{EFE33C1E-D3AC-4D37-856E-A88821F2D228}">
<Operation Name="SetMute" UID="{2550C9E5-DD1F-490D-A1D8-DBE170C5A592}">
<Operation Name="Send" UID="{7B383230-B360-4ECC-B634-7B31CFB732EE}">
<Operation Name="Cancel" UID="{43A52906-0AA1-44E1-814B-5E8825465340}">
<Operation Name="SetDisplayText" UID="{B3574D9B-867D-4DB0-88A9-8503F140A667}">
<Operation Name="GetInfo" UID="{2B1B900C-F128-4A59-A06B-4F24438C3DB9}">
<Operation Name="SetMicrophoneVolume" UID="{0EB1F5E5-2737-4295-9C73-F5784EDD32D1}">
<Operation Name="SetSpeakerVolume" UID="{5BEE40B3-0E6C-4F86-AFE5-D921F27C8518}">
<Operation Name="GetVolumeInfo" UID="{ACD39E89-A109-4908-9655-CCAADA640F7A}">
<Operation Name="SetupWizard" UID="{90B47C22-018F-442D-B674-A793376AD9CE}">
<Operation Name="RegisterClient" UID="{0F870B67-1CAC-40AE-958B-F8B1B9032092}">
<Operation Name="UnregisterClient" UID="{BA56A4E8-AFE9-4368-B4CB-2AE8DFA4F607}">
<Operation Name="Shutdown" UID="{B13088AD-EECF-4C45-8F2A-AE62CCBC219E}">
</Operations>
<Struct Name="PhoneInfo" UID="{E5E53182-D25C-4F0C-95E7-2D33D17CFD6D}" AutoCreateParams="1">
<Documentation><![CDATA[The PhoneInfo structure is used to passing status and display information from Delphi back to JavaScript.]]></Documentation>
<Struct Name="VolumeInfo" UID="{982296AA-2DB5-436F-A0FE-91503690DB6D}" AutoCreateParams="1">
Constraints.MinHeight
Constraints.MinWidth
Items.Strings
Show shortcut keys in tips
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
ImageMargin.Left
ImageMargin.Top
ImageMargin.Right
ImageMargin.Bottom
ImageSize.Height
ImageSize.Width
Strings.Strings
0var __iframe = document.getElementById('movie');
if (typeof __iframe.contentWindow.player !== 'undefined') {
var __player = __iframe.contentWindow.player;
__player.setMute(true);
__player.setMute(false);
frmWebWindow
Web Window
Margins.Left
Margins.Top
Margins.Right
Margins.Bottom
OnWindowSetWidth
OnThirdPartyUrlBlocked
ColorMap.DisabledFontColor
ColorMap.HighlightColor
ColorMap.BtnSelectedFont
ColorMap.UnusedColor
Picture.Data
Lines.Strings
127.0.0.1:80
IndyClient.IOHandler
IndyClient.AuthRetries
IndyClient.AuthProxyRetries
IndyClient.AllowCookies
*IndyClient.ProxyParams.BasicAuthentication
IndyClient.ProxyParams.ProxyPort
IndyClient.Request.ContentLength
"IndyClient.Request.ContentRangeEnd
$IndyClient.Request.ContentRangeStart
-IndyClient.Request.ContentRangeInstanceLength
IndyClient.Request.Accept
text/html, */*&IndyClient.Request.BasicAuthentication
IndyClient.Request.UserAgent
IndyClient.HTTPOptions
version="1.0.0.0"
name="Microsoft.Windows.Networking.Itibiti"
name="Microsoft.Windows.Networking.RtcDll"
version="5.2.1002.3"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
_com.eurekalog.eleaks.dataclass
PSAPI.dll
NTDLL.DLL
%s-%s
%s[%d]
%s_%d
.Owner
shfolder.dll
%s (Address: %s)
Critical error at: "%s"
Error: "%s".
.jdbg
C:\usr\delphi\Components\EurekaLog_6\Delphi16\EDebug.pas
wsock32.dll
ws2_32.dll
mswsock.dll
Cannot hook a null procedure ("%s").
Cannot hook the module "%s" located into the shared-area.
Cannot hook the procedure "%s".
Connected to %d.%d.%d.%d port %d
IPHLPAPI.DLL
Cannot resolve the "%s" MX record.
MSVCRT.DLL
MSVCRT20.DLL
wininet.dll
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestExA
HttpEndRequestA
HttpQueryInfoA
FtpOpenFileA
InternetOpenUrlA
Cannot create an HTTP connection with the host: %s
Cannot close the HTTP connection with the host: %s
[v%s - 1]: %s (%s)
%s (%s)
default.asp?pg=pgEditReleaseNotes
C:\usr\delphi\Components\EurekaLog_6\Delphi16\EWebTools.pas
Cannot assign a THTTPResponse class to a NIL value.
You used a 'TEurekaLog' component in module "%s" without activating EurekaLog.
%d %s,
%d %s
{\rtf1\ansi\ansicpg1252\deff0\deflang1040{\fonttbl{\f0\fmodern\fprq1\fcharset%d %s;}}
%s, %d %s %d %0.2d:%0.2d:%0.2d %s
- %s - %s - %s - %s[%s]
%s $%8.8x - [%8.8x] %s %s
$%8.8x - [%8.8x] %s - %s - %s - %s - %s[%s]
[ERROR] - Section: %s - Address: %s - Message: "%s"
6.1.04
Version : %s
Date : %s
OS : %s
RAD : %s
Dump : %s
Section : %s
LastExcept: %s
Address : %s
Exception : %s
Message : %s
Call Stack: %s
Error: '%s'
Send manually the "%s" file to the [email protected] email address, after click on OK button to close this box.
[WARNING] - Code: %s - Address: %s - Message: "%s"
[%s] %s
General '%s' error.
PSAPI.DLL
C:\usr\delphi\Components\EurekaLog_6\Delphi16\ExceptionLog.pas
<title>%s</title>
<!-- EurekaLog ID: %s -->
IntraWeb: Cannot create the "%s" template.
%s=%d; %s=%s
; %s=%s
%s: %s=%s; %s=%d; %s=%d
SMTP:
%s %d/%d:
@localhost.com>
- Cannot find the "%s" library.
%s error code: %d%s
Error Code: %d
Error Message: "%s"
%d x %d, %d bit
iphlpapi.dll
EAX: %s EDI: %s
EBX: %s ESI: %s
ECX: %s ESP: %s
EDX: %s EIP: %s
%s%s:
|%s|%s|%s|%s|%s|%s|
|%s|%s|%s|%s|%s|%s|%s|
|%s|%s|%s|%s|%s|%s|%s|%s|
Cannot use 'CurrentEurekaLogOptions' function in module "%s" without activate EurekaLog.
%s: %s=%d - %s=%d
Intraweb_
%s%s%.2d:%.2d
%s%s%.2d
\\?\UNC\
crSQLWait
claBurlywood
%s (*.%s)|*.%1:s
%s (%s)|%1:s|
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
TaskDialogIndirect
Invalid ZStream operation!
clWebSnow
clWebFloralWhite
clWebLavenderBlush
clWebOldLace
clWebIvory
clWebCornSilk
clWebBeige
clWebAntiqueWhite
clWebWheat
clWebAliceBlue
clWebGhostWhite
clWebLavender
clWebSeashell
clWebLightYellow
clWebPapayaWhip
clWebNavajoWhite
clWebMoccasin
clWebBurlywood
clWebAzure
clWebMintcream
clWebHoneydew
clWebLinen
clWebLemonChiffon
clWebBlanchedAlmond
clWebBisque
clWebPeachPuff
clWebTan
clWebYellow
clWebDarkOrange
clWebRed
clWebDarkRed
clWebMaroon
clWebIndianRed
clWebSalmon
clWebCoral
clWebGold
clWebTomato
clWebCrimson
clWebBrown
clWebChocolate
clWebSandyBrown
clWebLightSalmon
clWebLightCoral
clWebOrange
clWebOrangeRed
clWebFirebrick
clWebSaddleBrown
clWebSienna
clWebPeru
clWebDarkSalmon
clWebRosyBrown
clWebPaleGoldenrod
clWebLightGoldenrodYellow
clWebOlive
clWebForestGreen
clWebGreenYellow
clWebChartreuse
clWebLightGreen
clWebAquamarine
clWebSeaGreen
clWebGoldenRod
clWebKhaki
clWebOliveDrab
clWebGreen
clWebYellowGreen
clWebLawnGreen
clWebPaleGreen
clWebMediumAquamarine
clWebMediumSeaGreen
clWebDarkGoldenRod
clWebDarkKhaki
clWebDarkOliveGreen
clWebDarkgreen
clWebLimeGreen
clWebLime
clWebSpringGreen
clWebMediumSpringGreen
clWebDarkSeaGreen
clWebLightSeaGreen
clWebPaleTurquoise
clWebLightCyan
clWebLightBlue
clWebLightSkyBlue
clWebCornFlowerBlue
clWebDarkBlue
clWebIndigo
clWebMediumTurquoise
clWebTurquoise
clWebCyan
clWebPowderBlue
clWebSkyBlue
clWebRoyalBlue
clWebMediumBlue
clWebMidnightBlue
clWebDarkTurquoise
clWebCadetBlue
clWebDarkCyan
clWebTeal
clWebDeepskyBlue
clWebDodgerBlue
clWebBlue
clWebNavy
clWebDarkViolet
clWebDarkOrchid
clWebMagenta
clWebDarkMagenta
clWebMediumVioletRed
clWebPaleVioletRed
clWebBlueViolet
clWebMediumOrchid
clWebMediumPurple
clWebPurple
clWebDeepPink
clWebLightPink
clWebViolet
clWebOrchid
clWebPlum
clWebThistle
clWebHotPink
clWebPink
clWebLightSteelBlue
clWebMediumSlateBlue
clWebLightSlateGray
clWebWhite
clWebLightgrey
clWebGray
clWebSteelBlue
clWebSlateBlue
clWebSlateGray
clWebWhiteSmoke
clWebSilver
clWebDimGray
clWebMistyRose
clWebDarkSlateBlue
clWebDarkSlategray
clWebGainsboro
clWebDarkGray
clWebBlack
%s, ClassID: %s
Items.ItemData
{43826D1E-E718-42EE-BC55-A1E261C37BFE}
%s%s%s%s%s%s%s%s%s%s
Windows
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclResources.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclBase.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/JclWin32.pas $
JCL\source\windows
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclLogic.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclStringConversions.pas $
Windows-1252
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclCharsets.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/Jcl8087.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclMath.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclStreams.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclAnsiStrings.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclWideStrings.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclStrings.pas $
C:\usr\delphi\Components\jcl_231\source\common\JclStrings.pas
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/Snmp.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/JclSecurity.pas $
S-%u-
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclDateTime.pas $
C:\usr\delphi\Components\jcl_231\source\common\JclDateTime.pas
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclFileUtils.pas $
\\?\UNC
Psapi.dll
%s=%s
C:\usr\delphi\Components\jcl_231\source\common\JclFileUtils.pas
%u.%u.%u.%u
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/JclShell.pas $
@$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclIniFiles.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclSysInfo.pas $
P6 (Model %d)
%dx86
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/JclRegistry.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclSynch.pas $
C:\usr\delphi\Components\jcl_231\source\common\JclSynch.pas
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/JclConsole.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclSysUtils.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclUnitVersioning.pas $
$URL:
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/vcl/JclVclResources.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/vcl/JclGraphUtils.pas $
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/vcl/JclGraphics.pas $
FULLDIREXE
%dx%d
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclRTTI.pas $
[%s %d]
[%s %s $%p]
[%s=%s]
[%s=%s $%p]
index %d
@$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclMime.pas $
SQLTimeStamp
SQLTimeStampOffset
C:\usr\eclipse\workspace\ItibitiPhoneWSE\Indy10\System\Itibiti.IdGlobal.pas
%s, %.2d %s %.4d %s %s
.aiff=audio/x-aiff
.au=audio/basic
.mid=midi/mid
.mp3=audio/x-mpg
.m3u=audio/x-mpegurl
.qcp=audio/vnd.qcelp
.ra=audio/x-realaudio
.wav=audio/x-wav
.gsm=audio/x-gsm
.wax=audio/x-ms-wax
.wma=audio/x-ms-wma
.ram=audio/x-pn-realaudio
.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile
.bmp=image/bmp
.gif=image/gif
.jpg=image/jpeg
.jpeg=image/jpeg
.jpe=image/jpeg
.pict=image/x-pict
.png=image/x-png
.svg=image/svg-xml
.tif=image/x-tiff
.rf=image/vnd.rn-realflash
.rp=image/vnd.rn-realpix
.ico=image/x-icon
.art=image/x-jg
.pntg=image/x-macpaint
.qtif=image/x-quicktime
.sgi=image/x-sgi
.targa=image/x-targa
.xbm=image/xbm
.psd=image/x-psd
.pnm=image/x-portable-anymap
.pbm=image/x-portable-bitmap
.pgm=image/x-portable-graymap
.ppm=image/x-portable-pixmap
.rgb=image/x-rgb
.xbm=image/x-xbitmap
.xpm=image/x-xpixmap
.xwd=image/x-xwindowdump
.xml=text/xml
.uls=text/iuls
.txt=text/plain
.rtx=text/richtext
.wsc=text/scriptlet
.rt=text/vnd.rn-realtext
.htt=text/webviewhtml
.htc=text/x-component
.vcf=text/x-vcard
.avi=video/x-msvideo
.flc=video/flc
.mpeg=video/x-mpeg2a
.mov=video/quicktime
.rv=video/vnd.rn-realvideo
.ivf=video/x-ivf
.wm=video/x-ms-wm
.wmp=video/x-ms-wmp
.wmv=video/x-ms-wmv
.wmx=video/x-ms-wmx
.wvx=video/x-ms-wvx
.rms=video/vnd.rn-realvideo-secure
.asx=video/x-ms-asf-plugin
.movie=video/x-sgi-movie
.wmd=application/x-ms-wmd
.wms=application/x-ms-wms
.wmz=application/x-ms-wmz
.p7b=application/x-pkcs7-certificates
.p7r=application/x-pkcs7-certreqresp
.qtl=application/x-quicktimeplayer
.rtsp=application/x-rtsp
.swf=application/x-shockwave-flash
.sit=application/x-stuffit
.tar=application/x-tar
.man=application/x-troff-man
.urls=application/x-url-list
.zip=application/x-zip-compressed
.cdf=application/x-cdf
.fml=application/x-file-mirror-list
.fif=application/fractals
.spl=application/futuresplash
.hta=application/hta
.hqx=application/mac-binhex40
.doc=application/msword
.pdf=application/pdf
.cer=application/x-x509-ca-cert
.crl=application/pkix-crl
.ps=application/postscript
.sdp=application/x-sdp
.setpay=application/set-payment-initiation
.setreg=application/set-registration-initiation
.smil=application/smil
.ssm=application/streamingmedia
.xfdf=application/vnd.adobe.xfdf
.fdf=application/vnd.fdf
.xls=application/x-msexcel
.sst=application/vnd.ms-pki.certstore
.pko=application/vnd.ms-pki.pko
.cat=application/vnd.ms-pki.seccat
.stl=application/vnd.ms-pki.stl
.rmf=application/vnd.rmf
.rm=application/vnd.rn-realmedia
.rnx=application/vnd.rn-realplayer
.rjs=application/vnd.rn-realsystem-rjs
.rmx=application/vnd.rn-realsystem-rmx
.rmp=application/vnd.rn-rn_music_package
.rsml=application/vnd.rn-rsml
.vsl=application/x-cnet-vsl
.tgz=application/x-compressed
.dir=application/x-director
.gz=application/x-gzip
.uin=application/x-icq
.hpf=application/x-icq-hpf
.pnq=application/x-icq-pnq
.scm=application/x-icq-scm
.ins=application/x-internet-signup
.iii=application/x-iphone
.latex=application/x-latex
.nix=application/x-mix-transfer
.wbmp=image/vnd.wap.wbmp
.wml=text/vnd.wap.wml
.wmlc=application/vnd.wap.wmlc
.wmls=text/vnd.wap.wmlscript
.wmlsc=application/vnd.wap.wmlscriptc
.css=text/css
.htm=text/html
.html=text/html
.shtml=server-parsed-html
.sgm=text/sgml
.sgml=text/sgml
TIcn_Encoder3to4.Encode: Calculated length exceeded (expected
C:\usr\eclipse\workspace\ItibitiPhoneWSE\Indy10\Protocols\Itibiti.IdCoder3to4.pas
TIcn_Encoder3to4.Encode: Calculated length not met (expected
%d%s%d
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Type: %s
Content-Disposition: form-data; name="%s"
BinaryCertificates
C:\usr\delphi\Components\SecureBlackbox\Sources_D16\SBCustomCertStorage.pas
C:\usr\delphi\Components\SecureBlackbox\Sources_D16\SBPKCS12.pas
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
-----BEGIN DSA PRIVATE KEY-----
-----END DSA PRIVATE KEY-----
-----BEGIN DH PRIVATE KEY-----
-----END DH PRIVATE KEY-----
C:\usr\delphi\Components\SecureBlackbox\Sources_D16\SBZCompressUnit.pas
Cannot support SSL2 and TLS1 and not support SSL3
C:\usr\delphi\Components\SecureBlackbox\Sources_D16\SBClient.pas
MSWSOCK.DLL
WSARecvMsg
WSASendMsg
Fwpuclnt.dll
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclSchedule.pas $
Stamp.Date
Stamp.Time
Snooze.Date
Snooze.Time
SnoozeInterval.wYear
SnoozeInterval.wMonth
SnoozeInterval.wDay
SnoozeInterval.wHour
SnoozeInterval.wMinute
SnoozeInterval.wSecond
SnoozeInterval.wMilliseconds
Please report this to the JVCL team, detailing the precise conditions in which this error occured.
Thank you for your cooperation.
Mathematical Operators
Supplemental Mathematical Operators
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclUnicode.pas $
C:\usr\delphi\Components\jcl_231\source\common\JclUnicode.pas
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/common/JclSimpleXml.pas $
C:\usr\delphi\Components\jcl_231\source\common\JclSimpleXml.pas
%s:%s="%s"
%s="%s"
$URL: hXXps://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.3-Build4197/jcl/source/windows/JclAppInst.pas $
C:\usr\delphi\Components\jcl_231\source\windows\JclAppInst.pas
0123456789._:()-'!_ \/[]^&%.=$#
\StringFileInfo\%.4x%.4x\%s
Not Supported
C:\usr\delphi\Components\RemObjects Software\RemObjects SDK for Delphi\Source\uRODL.pas
Cannot find parameter %s
Cannot find operation %s
Cannot find service %s
Cannot find struct %s
{00000000-0000-0000-0000-000000000000}
Structure %s was found in imported RODL %s and was removed.
Enum %s was found in imported RODL %s and was removed.
Operations
EncryptionSendKey must be in hex format
EncryptionRecvKey must be in hex format
Invalid encryption method (%d): Newer Brazil DataSnap Server?
PIPE
TransportChannel does not support to receive responses without explicit polling.
There's already an async request to %s in progress.
TROAsyncProxyThread for %s calling %s
Call to Retrieve_%s does not match previous call to Invoke_%s.
Answer for %s has not been received yet.
C:\usr\delphi\Components\RemObjects Software\RemObjects SDK for Delphi\Source\uROAsync.pas
<Library Name="%s"
UID="%s" Version="3.0">
<Array Name="%s" UID="%s">
<ElementType DataType="%s" />
<%s Value="%s" />
<Group Under="%s" />
<Enum Name="%s" UID="%s" Prefix="0">
<Enum Name="%s" UID="%s">
<EnumValue Name="%s">
<EventSink Name="%s" UID="%s"
<Interface Name="%s" UID="%s">
<Operation Name="%s" UID="%s">
<Parameter Name="%s" DataType="%s" Flag="%s">
Ancestor="%s"
<Exception Name="%s" UID="%s"
<Element Name="%s" DataType="%s">
<Group Name="%s" UID="%s">
<Service Name="%s" UID="%s"
<Operation Name="%s" UID="%s" ForceAsyncResponse="1"
<Operation Name="%s" UID="%s"
<Parameter Name="%s" DataType="%s" Flag="%s" >
<Struct Name="%s" UID="%s"
SplitMode="%s"
<Use Name="%s" UID="%s" Rodl="%s" GenerateCode="1" AbsoluteRodl="%s"%s>
<Use Name="%s" UID="%s" Rodl="%s" AbsoluteRodl="%s"%s>
Error reading parameter %s:
Cannot Assign a %s t a %s
%s envelope isn't found
%s envelope can't be processed! TROMessageEnvelope should be assigned.
.TargetURL must be set.
.Host must be set.
hXXp://
hXXps://
hXXp://%s:%d/%s
C:\usr\delphi\Components\RemObjects Software\RemObjects SDK for Delphi\Source\uROClient.pas
structure %s
field%d %s
field%d %s: %s = %s
<struct name=%s>
<field name=%s type=%s><![CDATA[%s]]></field>
<![CDATA[%s]]>
<field name=%s type=%s>%s</field>
Abstract method called: TROArray.GetItemType.
Abstract method called: TROArray.GetItemSize.
<array name=%s type=%s>
<item id=%d>%f</item>
<item id=%d>%s</item>
<item id=%d>%d</item>
<item id=%d><![CDATA[%s]]></item>
%s:%s
item%d=%s
item%d=%d
item%d=%f
item%d = xml1
item%d=array1
item%d=structure1
item%d=binary1
Invalid ISO-8859-3 sequence "%s"
Invalid ISO-8859-6 sequence "%s"
Invalid ISO-8859-7 sequence "%s"
Invalid ISO-8859-8 sequence "%s"
Invalid cp10000_MacRoman sequence "%s"
Invalid Windows-1250 sequence "%s"
Invalid cp1251 sequence "%s"
Invalid Windows-1252 sequence "%s"
Invalid 7BitASCII sequence "%s"
Invalid ISO-8859-1 sequence "%s"
%S is not a valid notaName value.
%S is not a valid systemId value.
%S is not a valid publicId value.
%S is not a valid XmlCharRef value.
Not supported error.
List index out of bounds (%d)
Operation not allowed on sorted string list
hXXp://VVV.w3.org/2000/xmlns/
hXXp://VVV.w3.org/XML/1998/namespace
2.3.27
&#60;
&#38;
Parser exception in TdomCMParticle.contentModelTest
Syntax error in TdomCMEntity.refersToXyz
&%S; cannot be resolved.
%S must not start with a UTF-16 low surrogate.
%S must not end with a UTF-16 high surrogate.
%S contains an UTF-16 high surrogate without its corresponding low surrogate.
%S contains an invalid character.
%S contains an '&' without a ';'.
%S contains an invalid reference.
&%S; is an unparsed entity.
&%S; is an external entity.
&%S; refers to an undeclared entity.
&%S; refers to an external entity.
&%S; refers to itself.
Invalid UTF-8 sequence at position %d
Aborted UTF-8 sequence at position %d
Invalid UTF-8 encoding at position %d
in regel %d, positie %d
in regel %d, tussen positie %d en %d
tussen regel %d, positie %d en regel %d, positie %d
in line %d, position %d
in line %d, between position %d and %d
between line %d, position %d and line %d, position %d
Encoding not supported
la ligne %d, position %d
la ligne %d, entre la position %d et %d
entre la ligne %d, position %d et la ligne %d, position %d
in Zeile %d, Position %d
in Zeile %d, zwischen Position %d und %d
zwischen Zeile %d, Position %d und Zeile %d, Position %d
nella linea %d, posizione %d
nella linea %d, tra la posizione %d e %d
tra la linea %d, posizione %d e la linea %d, posizione %d
w linii %d, znak %d
w linii %d, pomi
dzy znakiem %d i %d
%d, znak %d i lini
%d, znak %d
na linha %d, posi
na linha %d, entre posi
o %d e %d
entre linha %d, posi
o %d e linha %d, posi
en la linea %d, posici
en la linea %d, entre las posiciones %d y %d
entre la linea %d, posici
n %d y la linea %d, posici
%S contains an '%' without a ';'.
%S contains an invalid parameter entity reference.
Encoding not supported error.
Namespace URI of prefix '%S' not found.
XPath version "%S" not supproted.
TROOpenXMLDocument.Transform:
TROOpenXMLDocument.Transform2:
.Message must be assigned.
olepro32.dll
%d - %s
\icn\password
\product\browser_initial_url
\product\product_key
C:\usr\eclipse\workspace\ItibitiPhoneWSE\MSRTC\RTCWrapper_TLB.pas
DefaultInterface is NULL. Component is not connected to Server. You must call 'Connect' or 'ConnectTo' before this operation
Must set transport to TLS if Basic Authentication is allowed.
Specified address and port are invalid.
Object state does not allow this operation to be performed.
Invalid port range.
The SIP URL is not valid.
Maximum number of pending operations reached.
Operation not allowed in current media controller state.
No valid profile for this operation.
Server cannot be specified without a transport protocol.
The operation failed because of too many participants in the session.
This operation is not supported on this Windows Platform.
The port manager interface is already set.
Port mapping cannot be obtained from the port manager.
Port mapping failure returned from the port mapper.
Refer operation is not allowed in this session.
Roaming operation interrupted. It may succeed or fail.
Participant could not support the requested security level.
Multicast is not supported.
The Authentication type requested is not supported.
Must set transport to TLS if high security model is needed.
A hold operation is currently pending.
Invalid certificate.
Join operation is in progress for another party.
Currently a refer operation is pending.
Cannot establish SSL tunnel to HTTP proxy.
Failed to make a TCP connection.
Currently an unhold operation is pending.
The Transport specified is not supported.
The SIP message size is greater than the UDP message size allowed.
This operation failed because the server is unreachable or busy at this time. Please try again later.
This feature is not supported when one of the servers in the profile has UDP transport.
Unsupported Media Type.
Version Not Supported.
Server does not support this type of roaming.
RT8201: COM Error: %s (0x%x).
.Channel must be assigned.
.ServiceName must be specified.
Service "%s" not found in library
hXXps://wsup175.itibiti.com:8443/BIN
External.Debug(
App.FindJSWindow(
C:\usr\eclipse\workspace\ItibitiPhoneWSE\WebWindow\uWebContainer.pas
Browser's Default interface does not support IOleObject
MAPI32.DLL
ActionClientItem%d
%s - %s
&%d. %s
RibbonPage%d
luna.bmp
Unsupported message type %d.
HTTP/1.1
/clientaccesspolicy.xml
/favicon.ico
Internal error: can not pass event event registration to server connection
%d.%d.%d.%d
owship6.dll
Invalid Address/Port:
HTTP/1.0
RemObjects SDK Super IpHTTP Server for Delphi
.ServerChannel must be assigned.
10.5.8.0
%s User
Synapse TCP/IP Socket error %d: %s
Operation would block
Operation now in progress
Operation already in progress
Socket operation on nonsocket
Protocol not supported
Socket not supported
Operation not supported on Socket
Protocol family not supported
Address family not supported
Winsock DLL cannot support this application
HTTP/1.0
HTTP/
SSL/TLS support is not compiled!
Without SSL support
Mozilla/4.0 (compatible; Synapse)
javascript:(function(F,i,r,e,b,u,g,L,I,T,E){if(F.getElementById(b))return;E=F[i 'NS']&&F.documentElement.namespaceURI;E=E?F[i 'NS'](E,'script'):F[i]('script');E[r]('id',b);E[r]('src',I g T);E[r](b,u);
(F[e]('head')[0]||F[e]('body')[0]).appendChild(E);E=new Image;E[r]('src',I L);})(document,'createElement','setAttribute','getElementsByTagName','FirebugLite','4','firebug-lite.js',
'releases/lite/latest/skin/xp/sprite.png','hXXps://getfirebug.com/','#startOpened');
IE.Navigate(
IE.FullScreen(
IE.MenuBar(
WebWindow.BrowserNavigateError(
IE.BrowserNewWindow(
IE.TitleChange(
IE.ToolBar(
IE.BrowserVisible(
notepad.exe
Portable Network Graphics
Keyscheduling
launch_url
Error loading Socket interface (ws2_32.dll)!
'"'"'"'"
'"=?'"#/
TFRMWEBWINDOW
To see what data this error report contains,
Send Error Report
%No IOHandler of type %s is installed.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%Authentication error to socks server.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
File "%s" not found
Object type not supported.
Press F1 for more help.HUnable to generate Screen Tips because there are no linked Action Lists.)UDP is not support in this SOCKS version.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s A Ribbon Pages parent must be TCustomRibbon
Specified TabIndex is invalidHA %s can only be placed on a Ribbon Group with an ActionManager assigned2Ribbon Group must have a Ribbon Page as its parent5Only Ribbon Groups can be inserted into a Ribbon Page
XX CodingPLength from Encryptionkey is invalid.
Keysize for %s must be within %d-%d bytes6%s is not initialized, call Init() or InitKey() first.~Invalid Ciphermode selected to produce MAC.
Negative stream size invalid-Odd byte position not valid for UnicodeString"'%s' is not a valid property value
OLE control activation failed*Could not obtain OLE control window handle<Marshaling of IDispatch (%d) type variants is not supported.
Unsupported variant type "%d" Variant must be Array, but is %d*Variant Array DimCount must be 1 but is %d@Cannot add Result parameter to collection. Use AddResult instead
Stream is read-only.,Cannot convert empty string to decimal value;Circular Protection detected, Protection Object is invalid."String Format "%d" does not exist.
Input is not a valid %s Format.'Input cannot be converted to %s Format.
MIME Base 64&Class "%s" does not support IROMessage Class "%s" is already registered
Unknown proxy interface "%s""Dispatcher for %s already assignedfCannot find message dispatcher. Maybe there is no message component configured for the requested path?&%s servers only support one dispatcher
Array index out of bounds (%d).CInvalid binary header. Either incompatible or not a binary message.rInvalid binary header. It seems that encryption is active on the other side of the communication, but not locally?#Unknown class "%s" found in stream.HUnexpected class found in stream; class "%s" does not descend from "%s".*Channel does not support IROMetadataReader,Too many sessions. Try again in %d minute(s)
DOMElement is NIL$Invalid or undefined data type "%s"..Structs cannot recursively contain themselves.(Invalid or undefined ancestor type "%s".3An item named "%s" already exists in ancestor "%s".-Circular reference detected between %s and %slContained items have been not checked for name duplicates in ancestors because of the ancestors' circularity4An exception of type %s was raised on the server: %s)An exception was raised on the server: %s
Cannot assign a "%s" to a "%s".!Invalid request stream (%d bytes)
Type "%s" not supported(Class factory for interface %s not found
Invalid index %d Invalid type "%s. Expected "%s""
Invalid TargetEntity "%s"
Invalid Parameter Flag "%s"-Stream read error: Invalid string length "%d"7Stream read error: Invalid class type encountered: "%s"
No data type specified.!Enum does not contain any values.%Struct does not contain any elements.0Service interface does not contain any elements.1The referenced RODL file "%s" could not be found.
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Address already in use. Cannot assign requested address.1Action is unsupported by current protocol version
Not implemented-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Unknown algorithm9Internal Error. Please contact EldoS support for details.
No certificate found
No private key found
Key length is too small
Certificate algorithm mismatch
Invalid cipher suite index [%d](Invalid compression algorithm index [%d])Compression failed, deflate returned [%d] Decompression failed, inflate returned [%d]
Cannot renegotiate.Session closed, ciphers cannot be renegotiated
No certificates found
Invalid password
Certificate already exists*Failed to retrieve certificate private key
Invalid private key:Failed to add certificate to Windows storage due to error
Unable to delete certificate)Invalid file format (possibly not a PVK?)
Incorrect password
Invalid certificate data
Private key not found
Shrowded key bag
Invalid certificate bag
Unsupported certificate type
Invalid private key
Not enough buffer space"Unsupported data encryption method
Invalid public key algorithm*DSA key length should be a multiple of 512
PKCS#11 error ÖCertificate algorithm (%d) does not support encryption3Certificate algorithm (%d) does not support signing
Not a PKCS#11 certificate
Not Acceptable(Request method requires HTTP version 1.1DThis authentication method is already registered with class name %s.
Error connecting with SSL.pUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.
Unsupported operation.
Invalid key size [%d bits]
Can not assign %s to %s
Unsupported algorithm: %s Unrecognized critical certificate extension
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.
Reply Code is not valid: %s4Failed attempting to retrieve time zone information.
Address type not supported."%d: Circular links are not allowed
IPv6 unavailable:The requested IPVersion / Address family is not supported.
End of stream: Class %s at %d)UDP is not support in this SOCKS version.
Stack already created.3Only one TIcn_AntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
%s is not a valid service."Operation not supported on socket.
Socket type not supported.
%s is not a valid BCD value$Could not parse SQL TimeStamp string
Invalid SQL date/time values*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
No item found with name "%s"
Item cannot be deleted'A context with that name already exists4Cannot create a context without a context list owner6You must specify a provider before setting the context"Provider has no context named "%s""Provider does not support contexts6The specified context is not part of the same provider3You must specify a provider before setting the item&Item not found in the selected context
Bad Graphic Signature8Cannot restart: Event is being triggered or is executing
'%s' is not a unique root path
%s: Mutex Timeout TJvCustomAppStorage.Synchronize:
Path '%s' does not exists
XML Node names cannot contain white space and the WhiteSpaceReplacement property is empty. Please set the WhiteSpaceReplacementProperty to a non empty value.CThe WhiteSpaceReplacement property cannot contain any white spaces.
XML Node names cannot contain invalid chars ("%s") and the InvalidCharReplacement property is empty. Please set the InvalidCharReplacement to a non empty value.9"%0:s" is not an allowed character for the %1:s property. %s: cannot be created without a valid Owner
JPEG error #%d
(unnamed)5(item does not support the IJvDataItemText interface)
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
Unknown GIF block type'Object type not supported for operation
Unsupported PixelFormat
Invalid stream operation
Library not found: %s
Function not found: %s.%s
Invalid extension introducerúiled to allocate memory for GIF DIB
128-Byte PrefetchingeCPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters
Unknown AMD (Model %d)
Invalid MMF name "%s"*The MMF named "%s" cannot be created empty*category Unicode character > $FFFFFF found
Win32 error: %s (%u)%s%s
]Invalid XML Element: Unexpected character in property declaration ("%s" found at position %d)rInvalid XML Element: Unexpected character in property declaration. Expecting " or ' but "%s" found at position %d(Unexpected value for lPos at position %dLInvalid XML Element: Expected beginning of tag but "%s" found at position ßInvalid XML Element: Expected end of tag but "%s" found at position %dGInvalid XML Element: malformed tag found (no valid name) at position %d]Invalid XML Element: Erroneous end of tag, expecting </%0:s> but </%1:s> found at position %d@Invalid Comment: expected "%0:s" but found "%1:s" at position %d@Invalid Comment: "--" not allowed inside comments at position ÖInvalid Comment: Unexpected end of data at position %d>Invalid CDATA: expected "%0:s" but found "%1:s" at position ÔInvalid CDATA: Unexpected end of data at position %d?Invalid Header: expected "%0:s" but found "%1:s" at position %d?Invalid Document: Unexpected text in file prolog at position %d
Variant type: &// Declaration for '%s' not supported.
Invalid time specification%End time can not be before start time Interval should be larger than 00At least one day of the week should be specified7Property IndexValue not supported for current IndexKind
IndexValue can not be 00Property Day not supported for current IndexKind Day values should fall in the range 1 .. 31-Month values should fall in the range 1 .. 12
The file %s does not exist
The value %s was not found.
Value out of range (%s).
Unknown identifier '%s'..The property %s of type %s has no string value
]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.
Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.oThe "Portable Network Graphics" could not be created because invalid image type parameters have being provided.(Failed to get ANSI replacement character
Unable to create directory%This windows version is not supported&The window with handle %d is not valid#The process with ID %d is not valid&The Module with handle %d is not valid$File contains no version information
=This control requires version 4.70 or greater of COMCTL32.DLLjThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid.
This "Portable Network Graphics" image is not supported because either its width or height exceeds the maximum size of 65535 pixels.
There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.
%s parameter cannot be nil#Feature not supported by this style
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d<MultiLine must be True when TabPosition is tpLeft or tpRight
Invalid ownerE%d is an invalid PageIndex value. PageIndex must be between 0 and %dÊnnot remove shell notification icon"PageControl must first be assigned"%s requires Windows Vista or later
Button%d
RadioButton%d
Unable to load style '%s'
Unable to load styles: %s
Style '%s' already registered#Style class '%s' already registered
Style '%s' not found
Style class '%s' not found
Invalid style format)Class '%s' is already registered for '%s'%Class '%s' is not registered for '%s'
%s does not allow hiding
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Unable to save settings9Would you like to reset to the default Priority Schedule?#No OnGetItem event handler assigned(A style named %s has not been registered
Your application must include either XPStyleActnCtrls, StdStyleActnCtrls or a third party ActionBand style unit in its uses clause/%s ActionManager property has not been assigned
LogineCannot assign a subitem to an actionbar when one of it's parent's is already assigned to an actionbar$Item %s has subitems, delete anyway?'You are not allowed to delete this item"Item %s is not allowed to be moved
ExpandMError loading previously saved settings file: %s
Separator Clipboard does not support Icons
Cannot open clipboard: %s
Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.7Length of value array must be >= length of prompt array
&Password
Value must be between %d and %d
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
%s property out of range
Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)
Unsupported clipboard format
Canvas does not allow drawing#Text format flag '%s' not supported
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 2000
Windows XP
Windows Server 2003
Windows Server 2003 R2
Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interfaceGNo single cast observer with ID %s was added to the observer collectionFNo multi cast observer with ID %s was added to the observer collection
No help found for context %d
No help found for %s
Duplicates not allowed,Specified Login Credential Service not found"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)
Windows Vista
The drive cannot be found The specified file was not foundWThe given "%s" local time is invalid (situated within the missing period prior to DST).$No help viewer that supports filters2Length of Strings and Objects arrays must be equal
Invalid Timeout value: %s
Timespan too longbThe duration cannot be returned because the absolute value exceeds the value of TTimeSpan.MaxValue
Timespan element too long#''%s'' is not a valid date and time#''%s'' is not a valid integer value
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d
Invalid property element: %s
Invalid property type: %s
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class
Error reading %s%s%s: %s
Failed to create key %s
Failed to get data for '%s'
Failed to set data for '%s'
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid file name - %s
Invalid stream format$''%s'' is not a valid component name
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Operation not supported
External exception %x
Interface not supported
Object lock not owned(Monitor support function not initialized
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
<unknown>('%s' is not a valid floating point value '%d.%d' is not a valid timestamp
'%s' is not a valid GUID value
I/O error %d
Integer overflow Invalid floating point operation
2.0.1745.0
1.0.0.0






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    %original file name%.exe:3224
    7a02c9f0fda15d12a976c745e50ad6cc.tmp:3304
    TrustedInstaller.exe:3980
    makecab.exe:3968
    

    2. 

  2. Delete the original Worm file.
    3. 

  3. Delete or disinfect the following files created/modified by the Worm:
    

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-BFS7E.tmp\7a02c9f0fda15d12a976c745e50ad6cc.tmp (50 bytes)
    %Program Files% (x86)\Itibiti Soft Phone\unins000.dat (4424 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\KNCTR.lnk (1 bytes)
    C:\Users\Public\Desktop\KNCTR.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-5B1S6.tmp\_isetup\_shfoldr.dll (47 bytes)
    %Program Files% (x86)\Itibiti Soft Phone\is-VDL36.tmp (12287 bytes)
    %Program Files% (x86)\Itibiti Soft Phone\is-7REBL.tmp (54184 bytes)
    %Program Files% (x86)\Itibiti Soft Phone\Itibiti.exe (1358 bytes)
    %Program Files% (x86)\Itibiti Soft Phone\is-9IQGD.tmp (8356 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-5B1S6.tmp\_isetup\_setup64.tmp (6 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KNCTR\KNCTR.lnk (1 bytes)
    C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.0.regtrans-ms (5720 bytes)
    C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f\c30b3226271ad001050000008c0ffc0f_catalog (15 bytes)
    C:\Windows\System32\config\SOFTWARE (30137 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db1a-917a-11e2-9ef7-000c29a8bd90}.TMContainer00000000000000000002.regtrans-ms (9064 bytes)
    C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f\9526cf26271ad0010c0000008c0ffc0f_catalog (15 bytes)
    C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f\39dbf226271ad001110000008c0ffc0f_manifest (509 bytes)
    C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f\0f8b9f26271ad0010b0000008c0ffc0f_dxmrtp.dll (6708 bytes)
    C:\Windows\winsxs\Temp\af299d26271ad001090000008c0ffc0f\af299d26271ad0010a0000008c0ffc0f_manifest (5 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.2.regtrans-ms (856 bytes)
    C:\Windows\Logs\CBS\CBS.log (33524 bytes)
    C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f\62aa2f26271ad001040000008c0ffc0f_rtcdll.dll (7482 bytes)
    C:\Windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin (566 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.0.regtrans-ms (20617 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.1.regtrans-ms (856 bytes)
    C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f\f99df726271ad001130000008c0ffc0f_catalog (15 bytes)
    C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf (656 bytes)
    C:\Windows\System32\config\SYSTEM.LOG1 (1099 bytes)
    C:\Windows\System32\config\SOFTWARE.LOG1 (29180 bytes)
    C:\Windows\System32\config\TxR\{016888cd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms (3944 bytes)
    C:\Windows\winsxs\Temp\39dbf226271ad001100000008c0ffc0f\39dbf226271ad001120000008c0ffc0f_rtcres.dll (808 bytes)
    C:\Windows\System32\config\COMPONENTS.LOG1 (62494 bytes)
    C:\Windows\winsxs\Temp\62aa2f26271ad001020000008c0ffc0f\62aa2f26271ad001030000008c0ffc0f_manifest (31 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.blf (4670 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\settings[1].png (922 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910384[1].jpg (800 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL909460[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912686[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\shadow3[1].png (508 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\RSSIcon[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\icons_dwn[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\f[1].txt (7546 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL911075[1].jpg (5338 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912827[1].jpg (4118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL913710[1].jpg (1004 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL912882[1].jpg (3857 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\776638438837976361[1].jpg (8948 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\S8IYTPF2.txt (517 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery.ui.theme[1].css (3673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\kn_video_v400[1].htm (1149 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\6[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery-1.7.2.min[1].js (46725 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912880[1].jpg (1600 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910181[1].jpg (1264 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\0[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\astrix[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4NL9WKW3.txt (237 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL914257[1].jpg (3564 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\facebookIcon[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\collect[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\f[2].txt (7074 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\itibiti_phone_api[1].js (8425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\ui.core[1].css (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\ui-bg_glass_75_440a4d_1x400[1].png (191 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\INfoBTN[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\header[1].jpg (5313 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\menutab[1].png (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910298[1].jpg (2257 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL913725[1].jpg (2094 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\2[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910171[1].jpg (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL912964[1].jpg (1164 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\skin[1].css (241 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (966 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FVYCXAZC.txt (95 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery-ui-1.8.20.custom.min[1].js (14853 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ECR3NVAR.txt (277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\logme[2].htm (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SettingsBTN[1].png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL913439[1].jpg (2163 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909504[1].jpg (4278 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\17877534288319335953[1].jpg (10330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\9[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\f[1].txt (33826 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL912835[1].jpg (3394 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\min_normal[1].jpg (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\pubads_impl_55[1].js (56054 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913503[1].jpg (7094 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EG9E1SRI.txt (89 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\4[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knctr_with_phone_loader[1].htm (1231 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911157[1].jpg (3658 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL914094[1].jpg (1561 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\kn_video_v400[1].htm (1149 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_49A9889B8F89F388F5CDBBE2AA579A5B (463 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\video_menu[1].htm (7447 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\itibiti_phone_api[1].js (10633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\T6YF3VKP.txt (519 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\8[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\icons_up[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6L0MAOIU.txt (275 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\faq_icon2[1].png (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913655[1].jpg (2714 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\1[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\right_banner[1].htm (2358 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\video_menu[1].css (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL910478[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL914293[1].jpg (1404 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\social_icon2[1].png (3093 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\ads[1].png (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910944[1].jpg (2064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\5[1].png (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\container[1].htm (393 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\get_flash_player[1].htm (300 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\jquery.ui.base[1].css (58 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\stylesheet3[1].css (73 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL914123[1].jpg (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL913685[1].jpg (960 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\jquery-ui-1.8.20.custom[1].css (361 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912904[1].jpg (1037 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery.jcarousel.min[1].js (4845 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\refresh_parent[1].htm (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\f[1].txt (28786 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\f[3].txt (8031 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\exit_normal[1].jpg (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\twitterIcon[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P5D2O52B.txt (277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911156[1].jpg (3821 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6SRWNV6A.txt (99 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910494[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\index_tabs2[1].htm (1236 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\kn_banner[1].htm (1411 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\style2[1].css (241 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\f[1].txt (8043 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (1056 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\ui.tabs[1].css (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\welcome_icon2[1].png (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912893[1].jpg (2334 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL911101[1].jpg (4040 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910136[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\container[1].htm (393 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\analytics[1].js (15208 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL911120[1].jpg (3693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery.cookie[1].js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\end2[1].png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\sliderbg[1].png (959 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\demos[1].css (2521 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\talk2[1].png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL910890[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\collect[1].gif (105 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knctr_with_phone_loader[2].htm (1033 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\skin_channel[1].css (241 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910262[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\knctr_icon[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL909652[1].jpg (880 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910406[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL913611[1].jpg (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL910341[1].jpg (2337 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\logme[1].htm (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\get_flash_player[1].gif (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910110[1].jpg (2621 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knvideo[1].png (4668 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\logme[1].htm (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Itibiti\registry.dat (369 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\HelpBTN[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909646[1].jpg (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL913506[1].jpg (2937 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\welcomebg_pur3[1].png (2221 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1XFNDMHT.txt (277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\phone_icon2[1].png (1634 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL912663[1].jpg (2938 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910521[1].jpg (1264 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\kn_banner[1].htm (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\heros_code_here[1].js (145 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E0702DFC20F36D954C803A3BAB6675C4 (463 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\activate2[1].png (7329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL908833[1].jpg (1637 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\sidebar[1].htm (856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\kn_video_v400[1].htm (1149 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\jquery-1.4.2.min[1].js (41841 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery-1.7.1[1].js (128562 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_49A9889B8F89F388F5CDBBE2AA579A5B (1432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL910865[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909585[1].jpg (1613 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\background2[1].png (1421 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL914321[1].jpg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913657[1].jpg (1937 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\17877534288319335953[2].jpg (21272 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\footter[1].png (2300 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\14465066621354102719[1].jpg (3280 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911203[1].jpg (2081 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\icons_bg[1].png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\right_banner[2].htm (1179 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL909531[1].jpg (1938 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL914146[1].jpg (3420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_E0702DFC20F36D954C803A3BAB6675C4 (1432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL913470[1].jpg (2853 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL911121[1].jpg (1024 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\jquery.ui.all[1].css (302 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\f[2].txt (7340 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\swfobject[1].js (13261 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL911115[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912727[1].jpg (1023 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\jquery.ui.tabs[1].js (7385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\7[1].png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\number[1].png (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL912932[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\nextapp[1].png (941 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL914301[1].jpg (2900 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL910280[1].jpg (2537 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\3[1].png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\phone_dialpad[1].css (361 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\SPL909503[1].jpg (1100 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\itibiti_phone_api[2].js (8973 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\knctr_with_phone[1].htm (3164 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\83S2NG2R.txt (519 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\collect[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery.ui.core[1].js (865 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\jquery.ui.widget[1].js (3145 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL912901[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\9975433107761106746[1].jpg (8717 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\SPL913635[1].jpg (3461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\collect[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\f[2].txt (7437 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\style[1].css (241 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL910404[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPSJOBBC\itibiti_phone_api[2].js (14969 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\bg3_DRAGVERSION_ALPHA[1].png (29582 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\sidebar_bg[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ4VW5QI\kn_banner[1].htm (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\feedback_icon2[1].png (1794 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6EO4JP02\SPL909578[1].jpg (2063 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\13540127826435132492[1].jpg (4644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1N6BA67\SPL913647[1].jpg (2553 bytes)
    C:\Windows\Temp\cab_3968_2 (564989 bytes)
    C:\Windows\Temp\cab_3968_3 (76 bytes)
    C:\Windows\Temp\cab_3968_6 (8 bytes)
    C:\Windows\Temp\cab_3968_4 (564989 bytes)
    C:\Windows\Temp\cab_3968_5 (76 bytes)
    C:\Windows\Logs\CBS\CbsPersist_20141217182742.cab (11744 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Itibiti.exe" = "%Program Files% (x86)\Itibiti Soft Phone\Itibiti.exe"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now