MD5: dd7ebc874b9cb6a3a8df8ffde087d2ab
SHA1: 40128056d9f060462a09d744c6aa9369e4ebf919
SHA256: 1b44dc43c72dfa7edb031ed4b37a1e8b2f1458eb34ebbe735d2376a443ee264b
SSDeep: 49152:fJYDvvXoq/WO91SaPd6PziPPY jkybKktITn:qv4HOPSmd7PPYmkhkqTn
Size: 2355453 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-06-07 00:41:54
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

_installB3E08.exe:4068
%original file name%.exe:2528
CheckInstall.exe:3596

The Malware injects its code into the following process(es):

FreeHideIP.exe:964

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process _installB3E08.exe:4068 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\System.dll (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\fpinstall.dll (20 bytes)
C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe (750 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\NSISArray.dll (804 bytes)
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe (9320 bytes)
C:\Windows\SysWOW64\Macromed\Flash\install.log (251985 bytes)
C:\Windows\SysWOW64\Macromed\Flash\Flash10e.ocx (130085 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjC9D4.tmp (98019 bytes)

The process %original file name%.exe:2528 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeHideIP\res\flag_short\MX.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\images\about.png (2392 bytes)
%Program Files% (x86)\FreeHideIP\res\hideip.dat (10 bytes)
%Program Files% (x86)\FreeHideIP\lang\English.lan (13 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DJ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GM.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KE.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PN.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BG.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ET.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KP.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AS.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FI.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BT.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LY.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\FreeHideIP.exe (119955 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\US.PNG (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp (4 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ER.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ML.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112140701.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CZ.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\const.dat (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ZM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TD.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\Privacy Policy.url (65 bytes)
%Program Files% (x86)\FreeHideIP\res\logo.png (7 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VC.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MANN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AR.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Help.lnk (338 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SA.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NG.PNG (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\ioSpecial.ini (16099 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ZA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SI.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DM.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TL.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SCOTLAND.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TH.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BJ.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VATICAN CITY.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\A.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SAINT HELENA.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GL.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\uninst.exe (1426 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LI.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\OM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TM.png (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AI.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PY.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\InstallOptions.dll (30 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GT.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\End User License Agreement.url (84 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IS.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\WALLIS AND FUTUNA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MG.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NA.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112138779.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MP.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ZW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LV.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NR.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\WALES.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PE.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SM.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BI.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BV.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\trialnotify.mht (1552 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SD.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UA.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DK.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MQ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GI.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LK.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ES.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IQ.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Free Hide IP.lnk (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BM.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ID.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\EC.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CV.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TT.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GQ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SY.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MD.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Get Free Hide IP Pro.url (83 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112135624.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MC.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IO.PNG (4 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KZ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PK.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\skins\default.skn (1856 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\QA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SB.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TV.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PT.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\ffextension.xpi (4 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HT.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112139176.png (4 bytes)
C:\Users\Public\Desktop\Free Hide IP.lnk (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LB.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CH.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CI.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\WS.png (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AL.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\map.tpl (269 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\EG.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SK.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Privacy Policy.url (65 bytes)
%Program Files% (x86)\FreeHideIP\End User License Agreement.url (84 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\JP.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SV.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NORTHERN IRELAND.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BB.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AU.PNG (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\modern-wizard.bmp (5520 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KY.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AM.png (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GE.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NI.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Uninstall Free Hide IP.lnk (816 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112142681.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CA.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\CheckInstall.exe (45705 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ST.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CK.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VE.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso2481.tmp (142800 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GY.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SC.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KI.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\EE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\YE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AE.png (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\background.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GP.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\JM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FJ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BR.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IL.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\modern-header.bmp (784 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\JO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MV.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NP.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TJ.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Free Hide IP Site.url (89 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LC.png (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BZ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CS.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GA.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FR.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CO.PNG (1 bytes)

The process FreeHideIP.exe:964 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\update[1].htm (1116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\FreeHideIP\UserFlag.ini (22 bytes)
C:\ProgramData\FreeHideIP\setting.dat (2153 bytes)

The process CheckInstall.exe:3596 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_installB3E08.exe (14071 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\flash_player_ax[1].exe (59131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sgDEF74.tmp (62984 bytes)

Registry activity

The process _installB3E08.exe:4068 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}]
"Policy" = "3"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
"(Default)" = "FlashBroker"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper\DefaultIcon]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe,1"

[HKCR\MIME\Database\Content Type\application/futuresplash]
"Extension" = ".spl"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper]
"(Default)" = "Macromedia Flash Paper"

[HKCR\ShockwaveFlash.ShockwaveFlash]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX\Components]
"Main" = "1"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"8.0" = "42"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"VersionMinor" = "0"

[HKCR\ShockwaveFlash.ShockwaveFlash\CurVer]
"(Default)" = "ShockwaveFlash.ShockwaveFlash.10"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"(Default)" = "Adobe Flash Player"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
"(Default)" = "IShockwaveFlash"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"URLInfoAbout" = "http://www.adobe.com/go/getflashplayer"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
"(Default)" = "Macromedia Flash Factory Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.1]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
"(Default)" = "IFlashBroker3"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
"(Default)" = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"URLUpdateInfo" = "http://www.adobe.com/go/flashplayer/"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"VersionMajor" = "10"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
"(Default)" = "1.0"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
"(Default)" = "ShockwaveFlash.ShockwaveFlash"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"9.0" = "16384000"

[HKCR\ShockwaveFlash.ShockwaveFlash.6\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\MIME\Database\Content Type\application/x-shockwave-flash]
"CLSID" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
"(Default)" = ""

[HKCR\FlashFactory.FlashFactory.1]
"(Default)" = "Macromedia Flash Factory Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.8]
"(Default)" = "Shockwave Flash Object"

[HKCR\FlashFactory.FlashFactory\CurVer]
"(Default)" = "FlashFactory.FlashFactory.1"

[HKCU\Software\Macromedia\FlashPlayer]
"FlashPlayerVersion" = "10.0.45.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}]
"AppPath" = "C:\Windows\SysWow64\Macromed\Flash"

[HKCR\ShockwaveFlash.ShockwaveFlash.10\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"NoModify" = "1"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\0\win32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"10.0" = "2949122"

[HKCR\.mfp]
"(Default)" = "MacromediaFlashPaper.MacromediaFlashPaper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"DisplayVersion" = "10.0.45.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Locale" = "EN"
"ComponentID" = "Flash"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
"(Default)" = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe -osint -url %1"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
"(Default)" = "Shockwave Flash"

[HKCR\.spl]
"Content Type" = "application/futuresplash"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
"(Default)" = "IShockwaveFlash"

[HKCR\.swf]
"Content Type" = "application/x-shockwave-flash"

[HKCR\FlashFactory.FlashFactory.1\CLSID]
"(Default)" = "{D27CDB70-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"6.0" = "88"

[HKCR\ShockwaveFlash.ShockwaveFlash.8\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
"(Default)" = "FlashFactory.FlashFactory.1"

[HKCR\ShockwaveFlash.ShockwaveFlash.6]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx, 1"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\ShockwaveFlash.ShockwaveFlash.3]
"(Default)" = "Shockwave Flash Object"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"HelpLink" = "http://www.adobe.com/go/flashplayer_support/"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShockwaveFlash.ShockwaveFlash.7]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}]
"AppName" = "FlashUtil10e.exe"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer]
"currentVersion" = "10,0,45,2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"RequiresIESysFile" = "4.70.0.1155"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
"(Default)" = "_IShockwaveFlashEvents"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
"LocalizedString" = "@C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe,-101"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags" = "0"

[HKCR\FlashFactory.FlashFactory]
"(Default)" = "Macromedia Flash Factory Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.5]
"(Default)" = "Shockwave Flash Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.7\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Version" = "10.0.45.2"

[HKCR\ShockwaveFlash.ShockwaveFlash.10]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx, 1"

[HKCR\ShockwaveFlash.ShockwaveFlash.9]
"(Default)" = "Shockwave Flash Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.4\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"UninstallString" = "C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe"
"DisplayName" = "Adobe Flash Player 10 ActiveX"

[HKCR\ShockwaveFlash.ShockwaveFlash\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\.sol]
"Content Type" = "text/plain"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKCR\MIME\Database\Content Type\application/x-shockwave-flash]
"Extension" = ".swf"

[HKCR\.sor]
"Content Type" = "text/plain"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled" = "1"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"7.0" = "73"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents]
"Flash" = "application/x-shockwave-flash"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"Publisher" = "Adobe Systems Incorporated"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
"(Default)" = "ShockwaveFlash.ShockwaveFlash.10"

[HKCR\MIME\Database\Content Type\application/futuresplash]
"CLSID" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\.swf]
"(Default)" = "ShockwaveFlash.ShockwaveFlash"

[HKCR\.spl]
"(Default)" = "ShockwaveFlash.ShockwaveFlash"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
"(Default)" = "FlashBroker"

[HKCR\ShockwaveFlash.ShockwaveFlash.4]
"(Default)" = "Shockwave Flash Object"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"IsInstalled" = "01 00 00 00"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
"(Default)" = "FlashFactory.FlashFactory"

[HKCR\.mfp]
"Content Type" = "application/x-shockwave-flash"

[HKCR\ShockwaveFlash.ShockwaveFlash.5\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX]
"Path" = "C:\Windows\system32\Macromed\Flash"

[HKCR\ShockwaveFlash.ShockwaveFlash.1\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
"(Default)" = "_IShockwaveFlashEvents"

[HKCR\ShockwaveFlash.ShockwaveFlash.3\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\FlashFactory.FlashFactory\CLSID]
"(Default)" = "{D27CDB70-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"DisplayIcon" = "C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe"

[HKCR\ShockwaveFlash.ShockwaveFlash.9\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

The Malware deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Programmable]
[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable]

The process %original file name%.exe:2528 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF" = "01 00 00 00 00 00 00 00 66 70 48 96 2A 2A D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"DisplayName" = "Free Hide IP"
"HelpLink" = "http://client.free-hideip.com/client/?PID=FHI&&ACTION=?uninstallhelp"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionMinor" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"InstallLocation" = "%Program Files% (x86)\FreeHideIP"
"VersionMinor" = "0"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionBuild" = "6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"DisplayVersion" = "4.0.1.6"
"URLInfoAbout" = "http://client.free-hideip.com/client/?PID=FHI&&ACTION=?uninstall"
"NoModify" = "1"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionMajor" = "4"
"VersionRevision" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"DisplayIcon" = "%Program Files% (x86)\FreeHideIP\FreeHideIP.exe,0"
"VersionMajor" = "4"
"UninstallString" = "%Program Files% (x86)\FreeHideIP\uninst.exe"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionTest" = ""
"(Default)" = "%Program Files% (x86)\FreeHideIP"
"CHL" = "c:\%original file name%.exe"

The process FreeHideIP.exe:964 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=;ftp=;https=;"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 01 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The Malware disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Free Hide IP"

The process CheckInstall.exe:3596 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FA B7 B3 8D 2A 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "FA B7 B3 8D 2A 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "FA B7 B3 8D 2A 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://clientn.super-mp3-download.com/install/flash_player_ax.exe	173.230.157.214
hxxp://clientn.free-hideip.com/map/getinfo.php?MagicWord=FHI	69.164.212.52
hxxp://clientn.free-hideip.com/update/?ACTION=Update&39955&PID=FHI&SN=&MCD=00000000B48A115F&UNL=&LANG=English&DAY=0&RUNTIME=0&VER=04000106&SVER=0&WVER=6_1_Service Pack 1&WLANG=1033&CHL=64643765626338373462396362366133613864663866666465303837643261622E657865	69.164.212.52
hxxp://clientn.free-hideip.com/client/?PID=FHI&ACTION=installed&IVER=4.0.1.6&ILAN=	69.164.212.52
hxxp://free-hideip.com/free-hide-ip-installed.html
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://pagead46.l.doubleclick.net/pagead/show_ads.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/grid-12.css
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry.css
hxxp://free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style-ie6.css
hxxp://free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style.css
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla.css
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry-ie6.css
hxxp://www.trialpay.com/mi/?rc=v&ri=1379108&p=Hu5zu11&t=9ahOMV9&type=img	199.68.156.31
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/joomla.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/joomla-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/suckerfish.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/style2.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/style2-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/demo-styles.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/template.css
hxxp://d261sv3xac0f7i.cloudfront.net/store/1731321/18800433.gif	54.230.45.143
hxxp://free-hideip.com/templates/rt_dominion_j15/css/template-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/typography.css
hxxp://free-hideip.com/components/com_jcomments/js/jcomments-v2.1.js?v=2
hxxp://free-hideip.com/components/com_jcomments/libraries/joomlatune/ajax.js
hxxp://free-hideip.com/media/system/js/mootools.js
hxxp://free-hideip.com/media/system/js/caption.js
hxxp://free-hideip.com/plugins/system/rokbox/rokbox.js
hxxp://free-hideip.com/plugins/system/rokbox/themes/light/rokbox-config.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-ie6menu.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-buildspans.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/belated-png.js
hxxp://free-hideip.com/images/stories/app/product2/box/box200.png
hxxp://free-hideip.com/images/stories/app/common/button/download.png
hxxp://pagead46.l.doubleclick.net/pagead/js/r20141209/r20141212/show_ads_impl.js
hxxp://free-hideip.com/images/stories/app/common/button/buynow.png
hxxp://free-hideip.com/images/stories/app/product3/box/box200.png
hxxp://free-hideip.com/images/stories/app/package1/box/box180_fhi.png
hxxp://www.gstatic.com/pub-config/ca-pub-2137902362367109.js	173.194.113.215
hxxp://free-hideip.com/images/stories/app/common/button/buynowpp.gif
hxxp://pagead46.l.doubleclick.net/pagead/html/r20141209/r20141212/zrt_lookup.html
hxxp://free-hideip.com/modules/mod_analytics/gatr.js
hxxp://pagead46.l.doubleclick.net/pagead/osd.js
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://www.free-hideip.com&dtd=270
hxxp://pagead46.l.doubleclick.net/pagead/js/r20141209/r20141212/expansion_embed.js
hxxp://free-hideip.com/templates/rt_dominion_j15/images/backgrounds/style2/main-bg2.png
hxxp://sa.software-pay.com/sa/imgs/banner_holiday_halfprice_fhi.jpg	173.230.138.89
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/style2/header-bg-low.png
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://www.free-hideip.com&dtd=404
hxxp://free-hideip.com/images/stories/app/home/logo.png
hxxp://pagead46.l.doubleclick.net/pagead/images/nessie_icon_tiamat_white.png
hxxp://pagead46.l.doubleclick.net/pagead/js/r20141209/r20110914/abg.js
hxxp://free-hideip.com/templates/rt_dominion_j15/images/menus/style2/topmenu-daddy.png
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://t3.gstatic.com/favicon?q=tbn:ANd9GcSlGZwIY7CG1hRqkjjqDVrr1EIcXRVy4ZHks-_ST_Ki1xol2xUZky_UN4RJumq9P5aerQCoS5ut8se_LPXXYm_BaAUUQ3X2	173.194.113.208
hxxp://googleapis.l.google.com/css?family=Slabo 27px&lang=en
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/light/bodydiv-low.png
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=288397215&utmhn=www.free-hideip.com&utmcs=utf-8&utmsr=1716x901&utmvp=1700x804&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=10.0 r45&utmdt=Free Hide IP Installed | Free Hide IP&utmhid=2086676748&utmr=-&utmp=/free-hide-ip-installed.html&utmht=1420601563639&utmac=UA-16601039-8&utmcc=__utma=56730365.308850550.1420601563.1420601563.1420601563.1;+__utmz=56730365.1420601564.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1655947318&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAQAAAAE~
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/style2/module-title-icon.png
hxxp://t3.gstatic.com/favicon?q=tbn:ANd9GcReSaXCC2MAHzTS01g7TjEwIe8oX3B4FmQweFpVjdKFz1OlANtg9MkAb1JsXMSuWpg	173.194.113.208
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/style2/footer-div.png
hxxp://pagead46.l.doubleclick.net/pagead/images/ad_choices_i.png
hxxp://pagead46.l.doubleclick.net/pagead/images/ad_choices_en.png
hxxp://pagead46.l.doubleclick.net/pagead/drt/s?v=r20120211
hxxp://www.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff	173.194.113.215
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e94853d51d9631
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0059695b36fcc39d
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDFpSHzfyfGc
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHj3S83xBK9k
hxxp://pagead46.l.doubleclick.net/bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js
hxxp://free-hideip.com/favicon.ico
hxxp://pagead46.l.doubleclick.net/activeview?id=osdim&avi=BFggm8KisVKv1JvGjiga8oIDgBgD1ubXv7QEAABABOAHIAQHIA8MEqBOAAQ&ti=1&adk=180657799&p=546,395,606,863&tos=1230,0,0,0,0&mtos=1230,1230,1230,1230,1230&rs=1&ht=0&tfs=1527&tls=2757&fp=client=ca-pub-2137902362367109&url=http%3A%2F%2Fwww.free-hideip.com%2Ffree-hide-ip-installed.html&correlator=4583063697160&eid=317150304%2C42631034&oid=3&afp=&output=html&slotname=8429118295&flash=10.0.45.2&dt=1420601562998&adx=395&ady=546&ifi=1&tdl=1747&abd=3-0-4&r=u&bs=1700,804&bos=1724,865&ps=1716,1440&ss=1716,901&tt=1016&pt=1742&deb=1-2-2-3-7-3&tvt=1231&iframe_loc=http://www.free-hideip.com/free-hide-ip-installed.html&is=468,60&uc=4
hxxp://a1284.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1284.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1284.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4a860dfad991908a
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEG4KXix8eJvaF19Xf/1VSWE=
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEA+oSQYV1wCgviF2/cXsbb0=
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEAUR6vhXniZivmIt5a4M1Ag=
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/style2-ie6.css	66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://pagead2.googlesyndication.com/pagead/show_ads.js	173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/joomla-ie6.css	66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://www.free-hideip.com/images/stories/app/common/button/buynowpp.gif	66.228.40.66
hxxp://www.free-hideip.com/plugins/system/rokbox/themes/light/rokbox-config.js	66.228.40.66
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0059695b36fcc39d	88.221.132.177
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	88.221.132.166
hxxp://www.free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style.css	66.228.40.66
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4a860dfad991908a	88.221.132.177
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/belated-png.js	66.228.40.66
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	88.221.132.190
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla.css	66.228.40.66
hxxp://www.free-hideip.com/images/stories/app/home/logo.png	66.228.40.66
hxxp://www.google-analytics.com/ga.js	173.194.113.192
hxxp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff	173.194.113.207
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://www.free-hideip.com&dtd=404	173.194.113.218
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://www.free-hideip.com&dtd=270	173.194.113.218
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEA+oSQYV1wCgviF2/cXsbb0=	93.184.220.29
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==	23.43.139.27
hxxp://t1.gstatic.com/favicon?q=tbn:ANd9GcReSaXCC2MAHzTS01g7TjEwIe8oX3B4FmQweFpVjdKFz1OlANtg9MkAb1JsXMSuWpg	173.194.113.212
hxxp://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211	173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/style2/module-title-icon.png	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry-ie6.css	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/backgrounds/style2/main-bg2.png	66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/osd.js	173.194.113.218
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEAUR6vhXniZivmIt5a4M1Ag=	93.184.220.29
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=	93.184.220.20
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHj3S83xBK9k	173.194.113.206
hxxp://www.free-hideip.com/favicon.ico	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/suckerfish.css	66.228.40.66
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=288397215&utmhn=www.free-hideip.com&utmcs=utf-8&utmsr=1716x901&utmvp=1700x804&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=10.0 r45&utmdt=Free Hide IP Installed | Free Hide IP&utmhid=2086676748&utmr=-&utmp=/free-hide-ip-installed.html&utmht=1420601563639&utmac=UA-16601039-8&utmcc=__utma=56730365.308850550.1420601563.1420601563.1420601563.1;+__utmz=56730365.1420601564.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1655947318&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAQAAAAE~	173.194.113.192
hxxp://pagead2.googlesyndication.com/bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js	173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/menus/style2/topmenu-daddy.png	66.228.40.66
hxxp://clients1.google.com/ocsp	173.194.113.206
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/template.css	66.228.40.66
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-ie6menu.js	66.228.40.66
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDFpSHzfyfGc	173.194.113.206
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-buildspans.js	66.228.40.66
hxxp://www.free-hideip.com/components/com_jcomments/libraries/joomlatune/ajax.js	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/template-ie6.css	66.228.40.66
hxxp://www.free-hideip.com/images/stories/app/common/button/download.png	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/grid-12.css	66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/images/ad_choices_en.png	173.194.113.218
hxxp://ocsp.verisign.com/	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	88.221.132.166
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry.css	66.228.40.66
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	88.221.132.166
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/style2/header-bg-low.png	66.228.40.66
hxxp://www.free-hideip.com/media/system/js/caption.js	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/style2/footer-div.png	66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/images/nessie_icon_tiamat_white.png	173.194.113.218
hxxp://www.free-hideip.com/images/stories/app/product3/box/box200.png	66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://www.free-hideip.com/images/stories/app/package1/box/box180_fhi.png	66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/js/r20141209/r20141212/show_ads_impl.js	173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/joomla.css	66.228.40.66
hxxp://www.free-hideip.com/media/system/js/mootools.js	66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/js/r20141209/r20141212/expansion_embed.js	173.194.113.218
hxxp://www.free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style-ie6.css	66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEG4KXix8eJvaF19Xf/1VSWE=	23.43.139.27
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/typography.css	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla-ie6.css	66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/light/bodydiv-low.png	66.228.40.66
hxxp://www.free-hideip.com/images/stories/app/product2/box/box200.png	66.228.40.66
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e94853d51d9631	88.221.132.177
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
hxxp://client.free-hideip.com/client/?PID=FHI&ACTION=installed&IVER=4.0.1.6&ILAN=	69.164.212.52
hxxp://www.free-hideip.com/images/stories/app/common/button/buynow.png	66.228.40.66
hxxp://www.free-hideip.com/plugins/system/rokbox/rokbox.js	66.228.40.66
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	88.221.132.166
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=	108.162.232.197
hxxp://pagead2.googlesyndication.com/pagead/images/ad_choices_i.png	173.194.113.218
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.215.110
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/demo-styles.css	66.228.40.66
hxxp://www.free-hideip.com/components/com_jcomments/js/jcomments-v2.1.js?v=2	66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/js/r20141209/r20110914/abg.js	173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/style2.css	66.228.40.66
hxxp://fonts.googleapis.com/css?family=Slabo 27px&lang=en	64.233.161.95
hxxp://www.free-hideip.com/free-hide-ip-installed.html	66.228.40.66
hxxp://googleads.g.doubleclick.net/pagead/html/r20141209/r20141212/zrt_lookup.html	173.194.113.218
hxxp://www.free-hideip.com/modules/mod_analytics/gatr.js	66.228.40.66
safebrowsing-cache.google.com	173.194.113.196
safebrowsing.google.com	173.194.113.197
www.google.com	173.194.113.209
services.addons.mozilla.org	63.245.216.134
ieonline.microsoft.com	204.79.197.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum

Traffic

GET /css?family=Slabo 27px&lang=en HTTP/1.1

Accept: text/css

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: fonts.googleapis.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Wed, 07 Jan 2015 03:33:04 GMT

Date: Wed, 07 Jan 2015 03:33:04 GMT

Cache-Control: private, max-age=86400

Content-Length: 252

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02
@font-face {.  font-family: 'Slabo 27px';.  font-style: normal;.  font
-weight: 400;.  src: local('Slabo 27px'), local('Slabo27px-Regular'), 
url(hXXp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEY
wM7FgeyaSgU71cLG0.woff) format('woff');.}.....


GET /css?family=Slabo 27px&lang=en HTTP/1.1

Accept: text/css

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: fonts.googleapis.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Wed, 07 Jan 2015 03:33:04 GMT

Date: Wed, 07 Jan 2015 03:33:04 GMT

Cache-Control: private, max-age=86400

Content-Length: 252

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02
@font-face {.  font-family: 'Slabo 27px';.  font-style: normal;.  font
-weight: 400;.  src: local('Slabo 27px'), local('Slabo27px-Regular'), 
url(hXXp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEY
wM7FgeyaSgU71cLG0.woff) format('woff');.}.HTTP/1.1 200 OK..Content-Typ
e: text/css..Timing-Allow-Origin: *..Expires: Wed, 07 Jan 2015 03:33:0
4 GMT..Date: Wed, 07 Jan 2015 03:33:04 GMT..Cache-Control: private, ma
x-age=86400..Content-Length: 252..X-Content-Type-Options: nosniff..X-F
rame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE
..Alternate-Protocol: 80:quic,p=0.02..@font-face {.  font-family: 'Sla
bo 27px';.  font-style: normal;.  font-weight: 400;.  src: local('Slab
o 27px'), local('Slabo27px-Regular'), url(hXXp://fonts.gstatic.com/s/s
labo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff) format('
woff');.}...

GET /plugins/system/rokbox/themes/light/rokbox-style.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164d7-b19-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2841

Connection: close

Content-Type: text/css
/* CSS Guideline to style rokbox */./* When adding your own theme,make
 sure to replace "custom" with your theme name */./* use lowercase cha
racters and no space. For example,we name our theme "mytheme" */./* we
 replace every "rokbox-light" with "rokbox-mytheme" */./* Wrapper,the 
very outside container of rokbox */.#rokbox-wrapper.rokbox-light{}.#ro
kbox-wrapper .clr {clear:both;}.#rokbox-close{height:30px;width:20px;d
isplay:block;background:url(close.png) 0 0 no-repeat;clear:both;}.#rok
box-close span{display:none;}./* Table for border look and feel */.#ro
kbox-top.rokbox-left{background:url(tl.png) 0 0 no-repeat;clear:both;}
.#rokbox-top .rokbox-right{background:url(tr.png) 100% 0 no-repeat;}.#
rokbox-top .rokbox-center{background:url(top.png) 0 0 repeat-x;height:
20px;margin-left:20px;margin-right:20px;}.#rokbox-middle {overflow: hi
dden;}.#rokbox-middle.rokbox-left{background:url(left.png) 0 0 repeat-
y;clear:both;}.#rokbox-middle .rokbox-right{background:url(right.png) 
100% 0 repeat-y;}.#rokbox-middle .rokbox-center{background:#fff;margin
-left:20px;margin-right:20px;}.#rokbox-bottom.rokbox-left{background:u
rl(bl.png) 0 0 no-repeat;}.#rokbox-bottom .rokbox-right{background:url
(br.png) 100% 0 no-repeat;}.#rokbox-bottom .rokbox-center{background:u
rl(bottom.png) 0 0 repeat-x;height:20px;margin-left:20px;margin-right:
20px;}./* Object/Image container */.#rokbox-container{}./* Spinner cla
ss that gets added when loading content and removed when loaded */.#ro
kbox-container.spinner{background:url(ajax-loader.gif) 50% 50% no-
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=409185, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 21:14:33 GMT

Expires: Sun, 11 Jan 2015 21:14:33 GMT

Date: Wed, 07 Jan 2015 03:37:01 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015010
4211433Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150104211433Z....20150111211433Z0...*.H........
.....P.<...'A.!..?... .T T..0... .K... #.Z..X.@[email protected]...)`...z.fq
........L:T.........7.I....3.}.5&.b.c..DP....O...~....K....N....ny....
.`..Z....{...........f..n....j.h..A*...7T._.. .....q....6.5$|..=.....t
.)....,..B...8...*.O....SM6....VqP.....e...i7Y....Q-.....#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>

GET /images/stories/app/product2/box/box200.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:32:23 GMT

ETag: "1689d-97c7-50b147f16b7c0"

Accept-Ranges: bytes

Content-Length: 38855

Connection: close

Content-Type: image/png

X-Pad: avoid browser bug
.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e&
lt;...iIDATx.....$e.6...:.......sf..!. ...0...u..u.....au..\e..kX.DD\P
..a.af..&.|[email protected]..<....Jk..V.....z%.9.4.N...
B..?b..,.........y....a.6......C..axx.._~...7,<.Eo...7n....~..>l
.,....,..;a.El...1.-."...ail....q.EHL...;WA;.&.........k...O!...l.....
..W^.D_....^.<.\..q.=......E...a.[..*Z.)..`....m..yg.....m..G....Fm
8#....iL?...c.Gwn..Z4O..l.!..l.......c.......1..qx..4.\..(.... .F]s.r}
[email protected]..|xm)..v/..{...8..<.3. =i"[email protected]=Ch&l
t;.d.5...oA...0...g..kv..e.L....N...R.....`h [email protected].<9....P
3u....Lo.....;.S..U.#....2....W.t.._c$.Pi..t..N..;..lT...........w..F.
z.^Y[. ...."K......--Wn.t..CI...Q..L{Lv...*U...)....<..m..y .....=.
....lW.....2.*@..A.7.X.#............x.|$>.......].I..q..=.D*2.u....
........Z.......S.js...hK.6....8..]G...i..T.S.._.^...F..n..H&.s.C....;
...{.jJ#..D....i.e.pI..i..[...r...,O.L.u..\.8...5..:.....\.@..:.r.....
o'p<...Ve....a.V!S...#BAb..ysCC...->F^..\..`7,.....z....#.e!^...
...z$..0.Q.F..#Qh.....C..)....\.<n.ECGrJ..g.1.4.OnC6byE#92..K...,)p
.....}....y......i. /......D...d...(..,..(.-.\.. ..7r..........j...1.m
H#.H!.L.J'...A....d..a..M(K.....]tr6E.A......Z.5....G......g..B.7....y
.....<.:.....W....NF..T-....v#.....{#...h...Q.).k.!_.M.H... 6..D...
.z..7./X.#0.....=.......8..:n. .....9.H}.....d....H"N...v.XyE.....s.cY
...L.4t...Iu..'1.s.E:=.8u.I......_eFb.R.MG......M'V..U....p..1.R."..Iz
...E.Q.^.D6.#..t......J...N.....,.-..F`v.`..a.>U@.:..k.....0...
<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/css/grid-12.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e4-b72-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2930

Connection: close

Content-Type: text/css
/**. * @package..Gantry Template Framework - RocketTheme. * @version..
2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.
com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @lice
nse..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Propriet
ary Use License. */../* 12 Grid */..rt-grid-1, .rt-grid-2, .rt-grid-3,
 .rt-grid-4, .rt-grid-5, .rt-grid-6, .rt-grid-7, .rt-grid-8, .rt-grid-
9, .rt-grid-10, .rt-grid-11, .rt-grid-12 {display: inline;float: left;
position: relative;margin-left: 10px;margin-right: 10px;}..rt-containe
r .rt-grid-1 {width: 60px;}..rt-container .rt-grid-2 {width: 140px;}..
rt-container .rt-grid-3 {width: 220px;}..rt-container .rt-grid-4 {widt
h: 300px;}..rt-container .rt-grid-5 {width: 380px;}..rt-container .rt-
grid-6 {width: 460px;}..rt-container .rt-grid-7 {width: 540px;}..rt-co
ntainer .rt-grid-8 {width: 620px;}..rt-container .rt-grid-9 {width: 70
0px;}..rt-container .rt-grid-10 {width: 780px;}..rt-container .rt-grid
-11 {width: 860px;}..rt-container .rt-grid-12 {width: 940px;}../* Grid
 Push */..rt-container .rt-push-1 {left: 80px;}..rt-container .rt-push
-2 {left: 160px;}..rt-container .rt-push-3 {left: 240px;}..rt-containe
r .rt-push-4 {left: 320px;}..rt-container .rt-push-5 {left: 400px;}..r
t-container .rt-push-6 {left: 480px;}..rt-container .rt-push-7 {left: 
560px;}..rt-container .rt-push-8 {left: 640px;}..rt-container .rt-push
-9 {left: 720px;}..rt-container .rt-push-10 {left: 800px;}..rt-contain
er .rt-push-11 {left: 880px;}../* Grid Pull */..rt-container .rt-p
<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=589437, public, no-transform, must-revalidate

Last-Modified: Tue, 6 Jan 2015 23:14:45 GMT

Expires: Tue, 13 Jan 2015 23:14:45 GMT

Date: Wed, 07 Jan 2015 03:33:05 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015010
6231445Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150106231445Z....20150113231445Z0...*.H............
.|..5.B..A.Zz}.8...S....Eo.>...S.J..........hJb.....z.....I.ob q.j.
.!..%z../F.....I..r..es..d ..<eF.5\l.h....1<....].ir....ue..~(0.
.Emv{K/M)*[email protected]].a..r................U.t.W>...l.R.23..-
4KX85......6...q.?.."..X..dL,....(...7..n..<{u. .A./?...>q<..
..0...0..}0..e........:}0...*.H........0B1.0...U....US1.0...U....GeoTr
ust Inc.1.0...U....GeoTrust Global CA0...141201130534Z..151216130534Z0
2100...U...'GeoTrust Global CA TGV OCSP Responder 30.."0...*.H........
.....0............\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".C
Z.w..T..Y. syd.....x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...
`f.X...B>x..............6..m.&...'..W.plK....[.m.V..h..lI.........?
~.....>.|'....o...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....
._S.............0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0
...U.%..0... .......0...U...........0...U.......0.0!..U....0...0.1.0..
.U....TGV-B-2830...*.H.............~....2!...V..0...Y....L..k....z}~a.
3Y.x..dS.L...Dk$a...nR9_......B......m....Y....U.5....'.....<{....v
&=.2].....j*.r(7...=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d
...z.i.H..f...v.....\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T.
..?. ......i..%....
<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/js/belated-png.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:57:22 GMT

ETag: "16975-1b6c-50b14d86fa480"

Accept-Ranges: bytes

Content-Length: 7020

Connection: close

Content-Type: application/x-javascript
/**.* DD_belatedPNG: Adds IE6 support: PNG images for CSS background-i
mage and HTML <IMG/>..* Author: Drew Diller.* Email: drew.diller
@gmail.com.* URL: hXXp://VVV.dillerdesign.com/experiment/DD_belatedPNG
/.* Version: 0.0.8a.* Licensed under the MIT License: hXXp://dillerdes
ign.com/experiment/DD_belatedPNG/#license.*.* Example usage:.* DD_bela
tedPNG.fix('.png_bg'); // argument is a CSS selector.* DD_belatedPNG.f
ixPng( someNode ); // argument is an HTMLDomElement.**/..var DD_belate
dPNG={ns:"DD_belatedPNG",imgSize:{},delay:10,nodesFixed:0,createVmlNam
eSpace:function(){if(document.namespaces&&!document.namespaces[this.ns
]){document.namespaces.add(this.ns,"urn:schemas-microsoft-com:vml")}},
createVmlStyleSheet:function(){var b,a;b=document.createElement("style
");b.setAttribute("media","screen");document.documentElement.firstChil
d.insertBefore(b,document.documentElement.firstChild.firstChild);if(b.
styleSheet){b=b.styleSheet;b.addRule(this.ns "\\:*","{behavior:url(#de
fault#VML)}");b.addRule(this.ns "\\:shape","position:absolute;");b.add
Rule("img." this.ns "_sizeFinder","behavior:none; border:none; positio
n:absolute; z-index:-1; top:-10000px; visibility:hidden;");this.screen
StyleSheet=b;a=document.createElement("style");a.setAttribute("media",
"print");document.documentElement.firstChild.insertBefore(a,document.d
ocumentElement.firstChild.firstChild);a=a.styleSheet;a.addRule(this.ns
 "\\:*","{display: none !important;}");a.addRule("img." this.ns "_size
Finder","{display: none !important;}")}},readPropertyChange:functi
<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/style2/module-title-icon.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:05 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:37 GMT

ETag: "1687a-774-50b147c58d040"

Accept-Ranges: bytes

Content-Length: 1908

Connection: close

Content-Type: image/png
.PNG........IHDR.............V..W....sBIT....|.d.....pHYs... ... .....
....tEXtXML:com.adobe.xmp.<?xpacket begin="   " id="W5M0MpCehiHzreS
zNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe 
XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41        ">.   
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
;.      <rdf:Description rdf:about="".            xmlns:xap="http:/
/ns.adobe.com/xap/1.0/">.         <xap:CreatorTool>Adobe Fire
works CS3</xap:CreatorTool>.         <xap:CreateDate>2009-
11-02T15:30:41Z</xap:CreateDate>.         <xap:ModifyDate>
2009-12-30T07:58:27Z</xap:ModifyDate>.      </rdf:Description
>.      <rdf:Description rdf:about="".            xmlns:dc="http
://purl.org/dc/elements/1.1/">.         <dc:format>image/png&
lt;/dc:format>.      </rdf:Description>.   </rdf:RDF>.&
lt;/x:xmpmeta>.                                                    
                                                .                     
                                                                      
         .                                                            
                               ;.S.....tEXtSoftware.Adobe Fireworks CS
3..F.....tEXtCreation Time.12/11/09........IDAT8....O.A.......@[(.D..H
...D.G..A.{.........'=pS.O&&&J... (~ .6.Z...v....g..4.........<..3C
.GzH.![A&.O/f..wQhoJ....uA2K.Z....k...... .R.(...V.t.p....u........j..
.%k|.{.d......[.G.)PW."..>S.2_.....Gte..7.s.z.K....w......F...r
<<< skipped >>>

GET /templates/rt_dominion_j15/css/joomla-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:12 GMT

ETag: "1696f-399-50b14d4438700"

Accept-Ranges: bytes

Content-Length: 921

Connection: close

Content-Type: text/css
/**. * @package   Dominion Template - RocketTheme. * @version   1.5.2 
December 9, 2009. * @author    RocketTheme hXXp://VVV.rockettheme.com.
 * @copyright Copyright (C) 2007 - 2009 RocketTheme, LLC. * @license  
 hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary 
Use License. */..rt-joomla .rt-headline {margin-bottom: 15px;}..rt-joo
mla .rt-articleinfo {width: 100px;}.#roksearch_results .roksearch_even
 {zoom:1;}.#roksearch_results .container-wrapper {position:relative;zo
om:1;width:400px;}.#roksearch_results .container-scroller {position:re
lative;zoom:1;}.#roksearch_results .container-scroller .page .roksearc
h_odd, #roksearch_results .container-scroller .page .roksearch_even {z
oom:1;z-index:1000;}.#roksearch_results .container-scroller span.small
 {bottom:6px;right:10px}.body .roknewspager-comments div.roknewspager-
div {zoom: 1;}.body .roknewspager-comments ul.roknewspager li {display
: inline;}...

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272609

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:33:03 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1200000-1499999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272549

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:34:03 GMT

Content-Range: bytes 1200000-1499999/47994403

Content-Length: 300000

Connection: keep-alive
,................L'...UM*..b...."..A.(.P`*.v..f...1.%.`.Xu...X# .d .".
 .B2!.J..U....Z1....ff.Q..)........v.S.B.D.. .U@X..`.AN....A.F.Q.E..U.
4..#=.Vy.b$..H.x...J..V&.Z.q...d....<.v.Q..*..p...,.1`%.Q.........H
.E..k*..Uj ..c ...S..I.Y....gz.aR.. .j...<\.xxE)..t.B..M.R.|..(...,
.Q..QD[_>.c..YcaA"X!T:...[j\...;2J...3.4.{.Mm.,..Q2....t<.Jw7..@
.al .......U .3....<....e%....R.....K.S=.3(.........K.>.|.%Q<
..,..H...X(. ....zg... tAh..Q...,...X1.H.E]kR.V.Q..q,ol.....Z..Hc....X
!.R....1mT...J.E..U.A#....mU...U.....s5.1 ...V2%h.c..........S.....b.&
.*YAj)G...F..#2....U.....C...d..ihR. .D`..J[m..Y.e....7Vv...D#1...X.A,
Z...|.t..KK..X.Z..|.c2..x........X2...Q....%......a.......-.L...S.....
.`...c#....V.... .`..[eB...1Q.b.....w..b....,.dr.Fg..w.b[.....4(.e,6n.
]..y...VWA....e.(T....e.P."cm..[......~G...l....h.f|..[[.m..8....%\K{a
H...6...Ls,....h.2h..p..aHR.K.b..DHu^.u.....W.b/k..l....'2.4M)M.Nhq..L
.-...e..^d...e.2..j`..B...%X1..6.-X.....[...b.. ....a....Q.w..P.....6.
..eaG.Llb0Q.;.f....h!Z...AE........._..j.4.Y...hQ......)..H..B..K=....
..........$}O.[.......P^.p.6....G.T&.9...mw.j...F!..'O........K...M.?.
....J..y....c"......@j4_x.#.......&.....8.n......r=..$_..)?e.u.OB.'...
.V.r.....Z,[email protected].'.."I...S[.........
...%e.........xo/[email protected]\..1.-..vAz...UQ.V.[L....
. qEQ.,.._ET/1..#.wX.-.1..(./.#.c....G..chR....%..X.]........q....]N.F
.Q...\Y..Q.I...[..o_..0..,x*.-y].t2...FB0....c..f.i.....w29..;:-.....u
.......zXKM.].?.........3Fsll|.l.q...7.'..m.......B[....a......:..
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1500000-1799999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272489

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:35:03 GMT

Content-Range: bytes 1500000-1799999/47994403

Content-Length: 300000

Connection: keep-alive
..d'...oj.H.u{[email protected]~..g}.O......._./..... .....H.kk.
..u..g.<.`.M\.$C.......[.....Q|..Vzy...s4r..0&....9..9I.}@.m Y....9
..1......{..Y...).................&.KWo._;d..o.;.9.....C..W.L...A..l.e
5uz...m.R......y..dA..?..o.B:....CH............p.....>..=s...\.\.Ff
w3.....B....].Y\../[email protected]!..... b..a%*A...|.)#...T..;..[
.T.b.O.....".`....^Uew5...t....N..[ ..).c%.J4R.}E...C..H./.0Y.R.._;K.$
$>...gV.......!8.MS.fhv......fW...9.1....0z......_a.O.2.....@W^da. 
[email protected].$u..Y..../..I....e
lx..#~.Wub.=v...1.B..U.`vk......;..dE....%I.K...4........Cs.i..;.i..$j
)..b0...W`....o2p._w5.......J&0..X...6)M....t."..P>bN.(3W...h.U.fBY
:...]h...rF....yv.5....4Ih.*....C.........>B.$..K._.W.1C[..>d..\
...l.mE.f..... fw.Uv..,......YsL\r.l,h..=..d.....{D........ .c.h.,....
`u7.$/...X.~.[|.V....K..2d}*..Fj.E<.V....9...A.......k)..$..S.Wo.'.
.Y..]*..U.q,..&..W....qZ...c`...t.-d.w.29..6D.z.M....i.N.o.....e._..%i
..M.....Y. .b.."(.4.X..z..T".....:.i...3.T..1..B.E..)...0.g..Z<9!".
..) .>...t/......grw}..y...;.q..).........=....X....flIZ...[..B^.ex
..,......].....\.u}[email protected]<@.A.e!...Zn!.".>-....9......
..H@".C.h-=Vf.x......'.|...HD$..V.J.V.....s.e..........@@......kF.....
..b. !`..6...V....B.....:A..u..........|.f.....g...F..$..mI..{V......Y
... ...i;.Dn.B*i.....?8..!.../~^g..5r.0.C...n=P..K...k>....x.6...A.
7<j.|..&.c.).a...=....m8e.RD...H@-.~.F...0....`.p...|..<\W6q....
.M ..T.5.4..Q;..#.m.d.SU...KI..:..}...r......01...Q.......<..m.
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1800000-2099999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272429

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:36:03 GMT

Content-Range: bytes 1800000-2099999/47994403

Content-Length: 300000

Connection: keep-alive
.......<".......w..b[TC.... ....[u-.eS.9.......}..o'.O..Z....,..~.5
.s.........z<.XP?.Z(..=#.....8t..:q....bR..:..I..<f.!O.U..^/....
.w.Z.q#%.k....J......*.o.&.Yb?..n..._.E^...h..j.$-........k.......4{.^
..1.>..i0....fJ..m}.\...Vt...Bz..........d.W.../..Z.l.6....v*.....H
.=.h.........vH.....Zs....6O.Lc}o$..%......H..G..myQ...D...T...9..f.$.
...l...8.>..|...C.^ ..B01..........!.|..F.I}.U..6..@L....]..W.Qr1..
.....cI.4'(.b..O.'D1...l4....y.............y..c....m5.{.7~...;a.nQ..cB
k{X...............o;.`....K..SR...........S.xR.}Xb.....~q..Y.R.[8....9
...o.c.I.a..4.zc.i.S.~.^......uI.. ...(u..[.............6.K..}.$T..x..
....a{..}...{i#.......P...........?......!..Z.D4..Jr....."l7Nl..x.O.^.
.!v.........u.B:.i..#\gcR.....fB.$?..5.....$.......ll\...Z....V>.a.
 S...o.Gw..B..........ny!{{.tAo.(v.S...bR......5...M.b.(Z.T.:.%V.=Z.e1
1).B76.....r....g..z_d..C 6.;..]..........:T....\-!....j.......\.Q6..d
[email protected]`.....0..$....B..C0`8).0dtB^. rV..
6h ..u..2......... .b...Q .1...r..h......z:..........^...|}.....6...R.
.8..../......&..!A.....c.=..C.....m..I..........W...G....tN.k.5o6.*.s.
..3..............U<...c....1....j.~.....$.<.. .}[email protected]...
X........V.'.hBA....s.~..O..w...q..A!...qf.......h...r.y.h..=..j..57..
....U.D;.'...r|.9[...].?..._.......p/@....nR....0..U.*..i.E.KX......(R
/....5...3.@/T`z..4./.v..-..Q|........=.....n/..e.v.......e."...AIAS..
......c`.....#-..4...7..O.%.m.....u.S*...........,. 2L....v.z..?.j....
pc......W...........Y..*...Ev........w[[email protected]=..y.^)(`.7(
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=2100000-2399999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272369

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:37:03 GMT

Content-Range: bytes 2100000-2399999/47994403

Content-Length: 300000

Connection: keep-alive
................y.h"-P. ..=x..#.f?j\B........w......U}..J<X....8...
.$(...o6X$.....f....S...8........yF...|..(.s&.{SC.1Y6T..............z.
.@..`j.l.....c..N..F.4-.=z..e.J..S...&8..b.....O4...Z........ ..k.F..a
*.. ....p.......p..R>....[....9..$ ..`_....;b.....F.6..h.. .....n..
..i.....f.q5..i...X.w.z....,.. {.4.......l.Q.?....-"...6..a.=.Z.H9..'K
.p..Ww..w;.../}.u...c...4.BBP...t.....1..Yv1S...c...S<umz...Q..i.f.
...&..o.o...8@.....~..m...m6....A..R.T.>.`J2o.e.....|Q....a,-.f..Z.
[email protected]]....k.....A.....(.I.1..,3b.N........!Z....>r...KrP.
.O..8.....I..$.S.2".2...-..)...~.!.X.u.%.....g..d.QlweV.].....f.Cf.F.;
..........`zA.jl.@y.=o..Hb.%..h..3S5.1....eI...[Z.)Du..O.S.u....H.,..{
..Ymu.........o.#........\$..........$......y.[.J..K..S.F.t....../.{..
...I.)...Q.e........e.... .eB.8.-..!/S.....o.....Z..........<;7..Ld
.O.hc8.j,....`'.....2..\..-.q..&J.oKh....*.(....X..V.......2hp. R3.$&l
t;.T.z.tdfPd2.......CX. ...../../.^k..Zx.HP.}..ty....O..7.Z.....}.T].4
>.h...MA...0'..4..Y..y!.....r6.o.E......C.@..!..H.N.ZHX...!.6..D?..
]....p)..f.P....:BP~.)[email protected].......:.%"71!.0..g.k[Ow.>..
U.......Q.f.0HM.5g!Y...F.....KR..j.S...I8f.......N......a,.5.......!..
.p.1..y.-....a.............F..Y..MX3X...BD7..j. d.B"d...`.../t......,.
r...8..Ol$EwK....Fz.>H..R.-......I.....9>k.....C..'g.$I...x.!C..
-V..U.Y..H....8-n)..W.k.@"0.....K.Akc....5..v.l.aO..9.x`[..K..^......)
W.W^>q.T..4Q......@[email protected]....'`.......L............u..T
^>......N.....8 #.?.[....rKH..^V..,6..*..Ua.j.`.D.<2W..b$..-
<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/js/gantry-buildspans.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "164f4-320-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 800

Connection: close

Content-Type: application/x-javascript
/**. * @package..Gantry Template Framework - RocketTheme. * @version..
2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.
com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @lice
nse..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Propriet
ary Use License. */ ..var GantryBuildSpans=function(g,j,k){(g.length).
times(function(i){var e="." g[i];var f=function(a){a.setStyle('visibil
ity','visible');var b=a.getText();var c=b.split(" ");first=c[0];rest=c
.slice(1).join(" ");html=a.innerHTML;if(rest.length>0){var d=a.clon
e().setText(' ' rest),span=new Element('span').setText(first);span.inj
ect(d,'top');a.replaceWith(d)}};$$(e).each(function(c){j.each(function
(h){c.getElements(h).each(function(b){var a=b.getFirst();if(a&&a.getTa
g()=='a')f(a);else f(b)})})})})};..

GET /plugins/system/rokbox/themes/light/rokbox-config.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "164f5-a26-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 2598

Connection: close

Content-Type: application/x-javascript
/* All the presets options are the custom ones */..var rokbox;.window.
addEvent('domready', function() {..rokbox = new RokBox({...'theme': 'l
ight', // this string must match the theme folder name (string, no spa
ce, lowercase)...'transition': Fx.Transitions.Quad.easeOut, // Transit
ion to use when opening RokBox...'duration': 400, // Duration of openi
ng RokBox Effect (integer, milliseconds)...'chase': 50, // Chase to us
e for the animation. works only for growl, see next line. (integer)...
'frame-border': 20, // Width of each border if any (integer, pixels)..
.'content-padding': 0, // Padding of internal content wrapper (integer
, pixels)...'arrows-height': 35, // Height of arrows div (integer, pix
els)...'effect': 'growl', // Type of effect to use. Presets are: 'quic
ksilver', 'growl', 'explode'...'captions': 1, // Whether to enable or 
disable captions (boolean, 1 or 0)...'captionsDelay': 800, // How long
 captions effect should last, when captions are enabled (integer, mill
iseconds)...'scrolling': 0, // Makes RokBox follow when scrolling the 
page (boolean, 1 or 0)...'keyEvents': 1, // Enable keyevents. Esc, Lef
t, Right to close and change previous or next (boolean, 1 or 0)...'ove
rlay': {....'background': '#000', // Overlay background color (string,
 hex color format with starting hash #)....'opacity': 0.2, // Opacity 
of the overlay (float, from 0 to 1, 0.1 makes it invisible but clickab
le)....'duration': 200, // Duration of overlay effect (integer, millis
econds)....'transition': Fx.Transitions.Quad.easeInOut // Transiti
<<< skipped >>>

GET /map/getinfo.php?MagicWord=FHI HTTP/1.1

Host: clientn.free-hideip.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:36:02 GMT

Server: Apache/2.2.21 (CentOS)

X-Powered-By: PHP/5.2.6

Content-Length: 112

Connection: close

Content-Type: text/html; charset=UTF-8
IP=193.138.244.231.COUNTRY_SHORT=UA.COUNTRY_LONG=UKRAINE.CITY=KIEV.REG
ION=KYYIV.LATITUDE=50.433.LONGITUDE=30.517..

GET /modules/mod_analytics/gatr.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "166f7-7e3-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 2019

Connection: close

Content-Type: application/x-javascript
if (document.getElementsByTagName) {..        var hrefs = document.get
ElementsByTagName("a");..        for (var l = 0; l < hrefs.length; 
l  ) {.....try{...                if (hrefs[l].protocol == "mailto:") 
{.........if (pv[1] == 1) {.....                ..startListening(hrefs
[l],"click",trackMailto);.........}...                } else if (hrefs
[l].hostname == location.host) {.........if (pv[0] == 1) {.....       
         ..var path = hrefs[l].pathname   hrefs[l].search;...........v
ar isDoc = path.match(regex);...            ..    ..if (isDoc) {...   
                 ....    startListening(hrefs[l],"click",trackExternal
Links);...                        ..}.........}...                } el
se {.........if (pv[2] == 1) {.....               ...startListening(hr
efs[l],"click",trackExternalLinks);.........}...                }.....
}.....catch(e){.......continue;.....}..        }..}..function startLis
tening (obj,evnt,func) {..        if (obj.addEventListener) {..       
         obj.addEventListener(evnt,func,false);..        } else if (ob
j.attachEvent) {..                obj.attachEvent("on"   evnt,func);..
        }..}..function trackMailto (evnt) {..        var href = (evnt.
srcElement) ? evnt.srcElement.href : this.href;..        var mailto = 
trmlname   href.substring(7);..        if (typeof(pageTracker) == "obj
ect") pageTracker._trackPageview(mailto);..}..function trackExternalLi
nks (evnt) {..        var e = (evnt.srcElement) ? evnt.srcElement : th
is;..        while (e.tagName != "A") {..                e = e.par
<<< skipped >>>

GET /images/stories/app/product3/box/box200.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:32:23 GMT

ETag: "168a0-a00f-50b147f16b7c0"

Accept-Ranges: bytes

Content-Length: 40975

Connection: close

Content-Type: image/png

X-Pad: avoid browser bug
.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.....dWu&..P..:M.LO.....QBB".c.........u...:....kl.w..'...
...0.....HBa.F3........r.....9..W.Z3b...6.%...~...........5Vn ....o..%
[email protected]."._...\N.... ...... ..rW...v.*]?2
..N....(=.`.Y;Q...z.w.....].r..v.B.....w.k.....c....g.P*..c.b..[...a..
^.n..V..Fm......-.BD..<.)\..y...p...P..`...@...&.H.......^=.......7
"..q....t...y.8y...zE..........Xw...Bz...X<...v.0.][email protected].).B..=.
)....AP?...WP...PVmL..S.../..&..:.<.......d.....P..p..n.jL.........
......G.u.n.^......_..S....yT.E|...`u../..F<1q........^.N..}_...t..
0.?....5......[.....>.{._.^........._.z..x.k.....{>.{g...aI....{
./..yW]s.5.\.._..(r.5..8.......">..T...S...|6.?.*..A?..3..{.....w..
.\..0.Rlav...."k.....LVv...8|' ......o ..@~.M..w....Jq.qs....S..>..
.Q...z....^... `0."...X,.......5...v.....4.?.....s.0 |.....O..........
......vo.]w=................e.N..u..8..FOTt_Y. ..7.. .A.cd..u?L...H...
..... Z.n...s;.N......:rpx.Je2,..y.J*.X..8.{-#....%.E~.^%.Y.....^...|/
..R.=..bk3..m.......r.\...{.....$....c.E.N....Z.hb..-.%..5.D.}..j5.$y.
.5.:{..Bq..r...G....:?...k........\z......kn...}....0r.....z?..s..\g..
 .f. .:.;Z.d1.###.!...t....!. [email protected]= ...."_).A.~..x....h......:.K...
.bC....|..........Bv......B!...T....D'.4....Y.GVI...5.....:_#......v..
).....Vt..@.=.A."O.x^.R.OD.n.{.......R..mkGQ.....'...s.Ec.......8.w@.=
.}r.P..J.6..v..B.=[.'....Q.G.>K.'".dQ..F.=..E_a..e.8...bi<.8-'..
3.,..-..-..7.....VU..8........m{....t....NOW K|. O....D..X.z....k.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=486675, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 18:44:32 GMT

Expires: Mon, 12 Jan 2015 18:44:32 GMT

Date: Wed, 07 Jan 2015 03:37:03 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015010
5184432Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150105184432Z....20150112184432Z0...*.H........
.....P*........D..)..Ex/.......P?)...K...BJ..G..x. \2....6y....\..t..0
.1,y..S...{.....:..<... vn....&.$[.3...I...\ ...._.L..1@=cZ;..J....
w.o.]s.n.......F.3.....V...P..NA/......\... ..%.`[email protected]
pi..E....%w.Z:~.C............`..:...:....UE..x...x.......#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>

GET /favicon?q=tbn:ANd9GcSlGZwIY7CG1hRqkjjqDVrr1EIcXRVy4ZHks-_ST_Ki1xol2xUZky_UN4RJumq9P5aerQCoS5ut8se_LPXXYm_BaAUUQ3X2 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t3.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/jpeg

Last-Modified: Fri, 24 Oct 2014 08:00:44 GMT

Date: Sun, 04 Jan 2015 22:07:53 GMT

Expires: Mon, 04 Jan 2016 22:07:53 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 452

X-XSS-Protection: 1; mode=block

Age: 192311

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002
......JFIF......................................... ."" ...$(4,$&1'..-
=-157:::# ?D?8C49:7...........7%.w7 77777777777777 777 77 77  777 7 
77 777 777 7 7..........."..................................%.........
...................!A3Q.12............................................
.......!a............?.5}[email protected].!........$..I.Xy. po^.Eku...9.o.:....
..w........H...~.TV..<[email protected]% .',..l......}k.R............
.`.ZM;.C........?,`..zO .U....r:...HTTP/1.1 200 OK..Content-Type: imag
e/jpeg..Last-Modified: Fri, 24 Oct 2014 08:00:44 GMT..Date: Sun, 04 Ja
n 2015 22:07:53 GMT..Expires: Mon, 04 Jan 2016 22:07:53 GMT..X-Content
-Type-Options: nosniff..Server: sffe..Content-Length: 452..X-XSS-Prote
ction: 1; mode=block..Age: 192311..Cache-Control: public, max-age=3153
6000..Alternate-Protocol: 80:quic,p=0.002........JFIF.................
........................ ."" ...$(4,$&1'..-=-157:::# ?D?8C49:7........
...7%.w7 77777777777777 777 77 77  777 7 77 777 777 7 7...........".
.................................%............................!A3Q.12.
..................................................!a............?.5}..
[email protected].!........$..I.Xy. po^.Eku...9.o.:......w........H...~.TV..<..
[email protected]% .',..l......}k.R.............`.ZM;.C........?,`..zO .U.
...r:.....
<<< skipped >>>

GET /mi/?rc=v&ri=1379108&p=Hu5zu11&t=9ahOMV9&type=img HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.trialpay.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache

Vary: Accept-Encoding

Set-Cookie: tpsess=o65f9pvfl2m59apkv9kmteod6043c48aea35a7fe; expires=Mon, 06-Jan-2020 03:33:03 GMT; path=/; domain=.trialpay.com

P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"

Set-Cookie: ss=tG8UF8iXGLL8GRUz.5149678f50f5b053; expires=Mon, 06-Jan-2020 03:33:03 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_ui=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_ui=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Set-Cookie: u_uk=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_uk=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Set-Cookie: u_ul=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_ul=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Set-Cookie: u_sr=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_sr=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 07 Jan 2015 03:33:03 GMT

Cache-Control: no-store, no-cache, private, max-age=1, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Location: hXXp://d261sv3xac0f7i.cloudfront.net/store/1731321/18800433.gif

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html
0..
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEA+oSQYV1wCgviF2/cXsbb0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510805

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:37:05 GMT

Etag: "54ac683d-1d7"

Expires: Tue, 13 Jan 2015 15:37:05 GMT

Last-Modified: Tue, 06 Jan 2015 22:57:01 GMT

Server: ECS (frf/8795)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......E.......1-Q...!..m....2015010
6200000Z0s0q0I0... [email protected]=?..Mn8...Q..E.......1-Q...!..m...
...I......!v...m.....20150106200000Z....20150113200000Z0...*.H........
.................T#cS..U...~.......kb......A...G..f.=!cV..g...5..Fo...
....1....I5.{.YU...`.....l...".......0/%.p...g].3B:...U.....z.T.{dn bK
.j.-.^...s.P..g.j.|.xWC..9.r...*.........j.c.c..}O>6..w872t........
.:...@.....^4....W.Xj.... .....q.....u.<......0...........


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEAUR6vhXniZivmIt5a4M1Ag= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=514362

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:37:05 GMT

Etag: "54ac88db-1d7"

Expires: Tue, 13 Jan 2015 15:37:05 GMT

Last-Modified: Wed, 07 Jan 2015 01:16:11 GMT

Server: ECS (frf/879A)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......{h.)....Iz..?...E.52..2015010
7010100Z0s0q0I0... .........j......3h...H.Y.!&...{h.)....Iz..?...E.52.
.....W.&b.b-.........20150107010100Z....20150114011600Z0...*.H........
......N....\...P...T;c.#..$|[email protected]:..........# ..B.
tH.z2g\..8.h".b.G..$..v.z.l..>>.....S2<.!....)..xp..Va.=.S...
_.b^;]x..5...(..wb.......h..._C.n....o..B..q.:...J.w.. .......4....3.G
w{A..xE*[email protected].. E..*w..U.....t.X_'F.......z..jV.....]..

GET /templates/rt_dominion_j15/css/typography.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e9-ef4-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 3828

Connection: close

Content-Type: text/css
/**. * @package   Dominion Template - RocketTheme. * @version   1.5.3 
January 10, 2010. * @author    RocketTheme hXXp://VVV.rockettheme.com.
 * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license  
 hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary 
Use License. */./* Core Styles */..rt-image {padding: 10px;margin-bott
om: 15px;}../* Bullet Styles */.ul.bullet-1, ul.bullet-2, ul.bullet-3,
 ul.bullet-4, ul.bullet-5, ul.bullet-6 {padding: 0 0 0 15px;margin-lef
t: 0;}.ul.bullet-1 li, ul.bullet-2 li, ul.bullet-3 li, ul.bullet-4 li,
 ul.bullet-5 li, ul.bullet-6 li {list-style: none;padding: 0 0 3px 15p
x;margin: 0 0 5px;background-repeat: no-repeat;background-position: 0 
4px;}.ul.bullet-1 li a, ul.bullet-2 li a, ul.bullet-3 li a, ul.bullet-
4 li a, ul.bullet-5 li a, ul.bullet-6 li a {font-size: 100%;line-heigh
t: 1.7;}../* Emphasis Styles*/.em.color {font-style: italic;font-weigh
t: bold;}.em.bold {font-size: 120%;font-weight: bold;line-height: 135%
;font-style: normal;}../* Drop Cap */.p.dropcap {overflow: hidden;}.sp
an.dropcap {font-size: 400%;margin: 0 5px 0 0;line-height: 100%;float:
 left;display: block;}../* Notice Styles */.pre {font-style:italic;ove
rflow: auto;padding: 10px;margin-bottom: 15px;}..alert, .approved, .at
tention, .camera, .cart, .doc, .download, .media, .note, .notice {disp
lay: block;margin: 15px 0;background-repeat: repeat-x;background-posit
ion: 0 100%;}..typo-icon {display: block;padding: 8px 10px 0px 36px;ma
rgin: 15px 0;background: no-repeat 10px 12px;}..approved .typo-ico
<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "0e20e453051989d614010fc5777516e5:1420601426"

Last-Modified: Wed, 07 Jan 2015 03:30:26 GMT

Date: Wed, 07 Jan 2015 03:33:05 GMT

Content-Length: 878

Connection: keep-alive

Content-Type: application/pkix-crl
0..j0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..150107030300Z..150117030300Z0..R0..
..X...140427081922Z0....v...140618150003Z0........140429180917Z0......
..140709194633Z0........140416233935Z0........140521155053Z0.....)..14
0617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140606
204021Z0........100729164439Z0....x...140507204001Z0........1406062221
39Z0....%...020514181157Z0....S...140423105438Z0........140725020038Z0
........100729164732Z0....M\..140430000442Z0.....-..140617185011Z0....
V...140624123102Z0........120627171025Z0........100301134531Z0........
140618143256Z0........120627171017Z0.....>..140711125531Z0....[...1
00730213120Z0....j...140226123519Z0...*.H............KS......%.-*....3
...>.GF4....|V.|(t.D..V.z......j..0x.D..,X[....N.<....zD'..{.9.=
6w....)...>L.?x.v|......>5L.R..S..x..1q[....f..HTTP/1.1 200 OK..
Server: Apache..ETag: "0e20e453051989d614010fc5777516e5:1420601426"..L
ast-Modified: Wed, 07 Jan 2015 03:30:26 GMT..Date: Wed, 07 Jan 2015 03
:33:05 GMT..Content-Length: 878..Connection: keep-alive..Content-Type:
 application/pkix-crl..0..j0...0...*.H........0N1.0...U....US1.0...U..
..Equifax1-0 ..U...$Equifax Secure Certificate Authority..150107030300
Z..150117030300Z0..R0....X...140427081922Z0....v...140618150003Z0.....
...140429180917Z0........140709194633Z0........140416233935Z0........1
40521155053Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..02051
5130611Z0.....#..140606204021Z0........100729164439Z0....x...14050
<<< skipped >>>

GET /pub-config/ca-pub-2137902362367109.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/javascript

Last-Modified: Tue, 06 Jan 2015 15:35:06 GMT

Date: Tue, 06 Jan 2015 23:00:48 GMT

Expires: Wed, 07 Jan 2015 11:00:48 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 106

X-XSS-Protection: 1; mode=block

Age: 16336

Cache-Control: public, max-age=43200

Alternate-Protocol: 80:quic,p=0.002
...........H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kdhlni`dl.D..
[email protected].)JV%E......U..k...HTTP/1.1 200 OK..Vary: Accept-Enco
ding..Content-Type: text/javascript..Last-Modified: Tue, 06 Jan 2015 1
5:35:06 GMT..Date: Tue, 06 Jan 2015 23:00:48 GMT..Expires: Wed, 07 Jan
 2015 11:00:48 GMT..X-Content-Type-Options: nosniff..Content-Encoding:
 gzip..Server: sffe..Content-Length: 106..X-XSS-Protection: 1; mode=bl
ock..Age: 16336..Cache-Control: public, max-age=43200..Alternate-Proto
col: 80:quic,p=0.002.............H..O.I.O,..K.O..K.LW.U(..K./..&YS.P].
.....[P..kdhlni`[email protected].)JV%E......U..k.....

GET /images/stories/app/common/button/download.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:35 GMT

ETag: "16855-a34-50b147c3a4bc0"

Accept-Ranges: bytes

Content-Length: 2612

Connection: close

Content-Type: image/png
.PNG........IHDR...l..........DZ.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...WhU]..wb,...%.......^...>.A.......`y1.X......bC.....
'...{.{.=s~....;..A.a........k....&*  .....>.....>}..7....."....
.m."E.... .c..E.....x..%&&..u<|.p........u.....S.NDz.H...........-Z
.o.t.>`a[.nMHJJz.XS.O.?~..-r....}.-..o.v........?E&O.|....!..|.bW..
.$...6.&M..V.z...G`h.[.je...P.B...bbb"........"**..{......E_.~=.......
..^.7#.  ....L...233.Dgdd$..]:.........!.#......X......S.c....../..4..
......\8".|&d.......U4Y...o.,.u.......W.,...X..j .....X.....2?..._...~
M.8.5m..5k...\.p{...uL^s..k..U.Q.F...\...3.N....../.}C.A..-/ 5.7n.[.`.
.4h.....[6.$'a.cdv...;p.iP8a....sd...4 .qG..q3f.pe..q.;v.Q.~4.."2]x...
.......2.p.I............n...n..M.T.R.?u...1.V..?...M.....w..MsK..u].v5
?.e..l.6n....m........\..v..Y....[.....]......#..;Z..@hg.&M...C].v....
...o.....W.....j.l.c..5.1..O.>=......H.S.|y[....{ONNvO.<1.a.....
%#.|.....W^. .Wso..../_..j..{.KII1f...bLo.....; rn.S...dC.d...(9..W...
;...SH.ccc..C...B.......555G.~...*W...;pv...\....u..#.....?A......A.c.
{D..a. W...........CI.....XE........6...._ a..J.*...$m.7o...s..q...7..
c..P.2 ....W.....m..{..U.X\..../Z..u.....&...~I..9.A,....u...5j.K.....
..yc..=z...R..[.x....$.2..w.L..(......saa(..J. ..D..?.q...>FT.. .,.
.0..I......<z.(.f.5\<..X.pxg=......iii.$. ..y..D...o.I...b#<.
.........w..BEP...<y..><.0.............w.ZP.. .....J..O..V...
...;2dn% ..6^.e...xL,3...`....s.... ...0...0... .qo........w.`..`..W..
.9rj... .........k.0b..7x.`7`......]....c...XG.C...sr.H.I..2e.}...
<<< skipped >>>

GET /install/flash_player_ax.exe HTTP/1.1

Accept: */*

Host: clientn.super-mp3-download.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:32:46 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 11 Jun 2010 03:40:03 GMT

ETag: "7081d-1ddb30-488b8e4edeac0"

Accept-Ranges: bytes

Content-Length: 1956656

Connection: close

Content-Type: application/octet-stream
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........uJ...$...$.
..$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE
..L....$.E.................b...........6............@.................
[email protected].............
..........`...........................................................
.....................................text...:a.......b................
.. ..`.rdata..B............f..............@[email protected]..
[email protected].........
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]([email protected].@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...H.@[email protected]
....E..9}[email protected].}[email protected]..
[email protected][email protected] ...Pj.h cB.W..\[email protected]...`.@._^3.
[.....L$..HkB...Si.....VW.T.....tO.q.3.;5LkB.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5LkB.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /client/?PID=FHI&ACTION=installed&IVER=4.0.1.6&ILAN= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: client.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Wed, 07 Jan 2015 03:36:03 GMT

Server: Apache/2.2.21 (CentOS)

X-Powered-By: PHP/5.2.6

Location: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /templates/rt_dominion_j15/css/suckerfish.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:13 GMT

ETag: "16971-74b-50b14d452c940"

Accept-Ranges: bytes

Content-Length: 1867

Connection: close

Content-Type: text/css
/**. * @package   Dominion Template - RocketTheme. * @version   1.5.2 
December 9, 2009. * @author    RocketTheme hXXp://VVV.rockettheme.com.
 * @copyright Copyright (C) 2007 - 2009 RocketTheme, LLC. * @license  
 hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary 
Use License. */. ./* Root Items */.#rt-menu ul {margin:0;z-index: 200;
position: relative;}.#rt-menu li {list-style:none;float:left;height:31
px;position:relative;}.#rt-menu li .item {white-space: nowrap;display:
 block;float: left;font-weight: bold;padding: 0 18px;font-size: 12px;z
-index: 100;cursor: pointer;position:relative;margin: 0;outline: none;
text-transform: uppercase;line-height: 31px;}.#rt-menu li .item span {
display: block;margin: 0;outline: none;padding: 7px 0;}.#rt-menu li a:
hover, #rt-menu li:hover a, #rt-menu li.sfHover a {text-decoration:non
e;}../* Dropdowns */.#rt-menu li ul {position:absolute;width:180px;lef
t:-999em;}.#rt-menu li ul ul {margin:-50px 0 0 180px;}.#rt-menu li:hov
er ul ul, #rt-menu li:hover ul ul ul, #rt-menu li:hover ul ul ul ul, #
rt-menu li.sfHover ul ul, #rt-menu li.sfHover ul ul ul, #rt-menu li.sf
Hover ul ul ul ul {left:-999em;}.#rt-menu li li {margin: 0;padding:0;h
eight:auto;width:180px;}.#rt-menu li li .item, #rt-menu li li.active .
item, #rt-menu li li .item:hover {margin:0;padding: 0 0 0 15px;height:
 auto;float: none;width: auto;line-height:20px;display: block;}.#rt-me
nu li li .item span, #rt-menu li li.active .item span, #rt-menu li li 
.item:hover span {width: auto;display: block;line-height: 20px;tex
<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Thu, 23 Oct 2014 05:05:32 GMT

ETag: "a2f3ff97eeecf1:0"

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive
....


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.0

VTag: 279876544500000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 43863145100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 43863145100000000..P3P: C
P="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SA
Mo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conten
t-Length: 550..Cache-Control: max-age=900..Date: Wed, 07 Jan 2015 03:3
3:36 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U.
...US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpo
ration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600
Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10.
.. .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....
F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D...
......-.>...(...g.0.S.[?...T4q>[email protected].('..e..
.Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d
<<< skipped >>>

GET /images/stories/app/common/button/buynowpp.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:39 GMT

ETag: "1688e-894-50b147c7754c0"

Accept-Ranges: bytes

Content-Length: 2196

Connection: close

Content-Type: image/gif
GIF89az./.......... Fn..,mlkXs............N.43....<r.....u'...Z[X..
...........V)r......>CDE.....O...........n.h8..........pO.........J
d......m&''..VD..i....@h{.......`cY..............?..&.................
.....................3.W.0i...4..4-l.3u....h9^!..u.....=XnfVX l.x..8..
`.."|.....a........8R..!........2..........................Y..a.......
.................?v.........i.....X..T..8.8l..3......!.......,....z./.
..........}................./[email protected]@Q.}...}.i?............i
...}M..................}><.............>...}.:...............
...........*\.........(... .3j..1...|B....dI.!S..a..K.k....b...8s..Y@e
H..v..(....%.*].TE..}.T.B....X...#..U. .Z......5.v..V...o..(......Q...
..o..\;..2./..z.....m.. ........"c....H../.^.. A...S.^.z ..DR.TY..l..W
..............o....).....wO'..e8j.*C.......2P;F^.(......].z....O...y..
.U4).....E8..m|.Q..!.PD.!....>IqC.....V..W!...w...A'.6{.h...8...,..
b.l...d....O2..b......|..b.0....?6....'.8b%}....TVY..X^I.W,..Bu3..V.Y.
...Y^[email protected].........*[email protected]
.).}z*..a,...$.@.....'.lI.*.a@:..3..'.7........,9.k...&....6....>;.
,MVk...f....v[....P....k..........n..Qt....k..................8....'..
..7....G,q...\H..*.....w... .,..$.......E......0.,..4.l..8..J.^X|....-
..DO...H'...L7...PG-..TWm..Xg...\wM0.`.-..c....h.....D...nG`..O<...
.X.. ............!........3n.........=w.w... sD....s.y...........`O...
.c0.........M..x.]..k.>....o.......]..|.$..=.$0P;.i........ .`.6...
/`.....>......IL?...4...:....W..G.G8........mV.... ... ...B..`.
<<< skipped >>>

GET /sa/imgs/banner_holiday_halfprice_fhi.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: sa.software-pay.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Wed, 14 Dec 2011 07:06:49 GMT

ETag: "2c029-1470b-4b40802f21440"

Accept-Ranges: bytes

Content-Length: 83723

Connection: close

Content-Type: image/jpeg

X-Pad: avoid browser bug
......JFIF.....d.d......Ducky.......W......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!..1"..A2#.a3.Q.q...BRCS$.c.4....b..........r.s.Dd%5......
tU.6.7W.T.eu.F.......................!..1AQ.aq.".....2...BR....br...#.
T..S$4.3.5....s..%U&6Cc.t.............?.....;[.S....'q.{|.S.w=..u.2j.!
J. .....j.x[...S.RBZ..Û...J".`1...3.6..9...J.iY...k.R..i.~.......;.r
.%.mE...e......n.......k.6..,.......a....--*Ce.L....l...1:.i....`Y.X..
r......y....V.c.....pd\..D.yJD..s0v.....2......u.srZ;....n..N...V.<
.J..j..a...P.$.u6...cw.....c).bCpx..8... ..!.R.Wb..D.=-...7..;..M..m.x
wB..ww..]].m..u[z. .......e.g..)...J.\p..."S....v............Ly<n..
SR...^.#i.......u_Yt.\...[.k.....eOT=P..I&%JR..8..)b..Y).......#......
...v.gm....X...j....Bi.M;..w.........R}E%[email protected].._..V....A.I.A.
....\..N..'` f...`..n.....i......v-.s....p..-.........:..Z.q....T k6..
N*..<(.......n....W....7..U1..50..Q`..,3.!'.....!F..&....1D..IS....
\.,...\ou-......J..J...JR3.R..D..'.A.. F..[i.....XG.w.7../....;....]..
Wh{.`j...U..e..M6..]...WJ..S .}..(...AO.......x....a....}..7.?.<..k
....F'..p.2m.;..........n...t.>...n..c.....-.=..n4.......Qotk6.KJZ]
...c....2...R1.H=#n...8b.......<. f.\.7a..a.T..q.......6...{.xUP.UF
.3*....q.i..KI\.Qr.EFU(6.R..i.N..N. ........n...X8g^mo.x.$.[p...E.....
.~..L..#..Mb.f..HJ.q...m.).....e.`. ...L.....'x.im..c..M..s..z.J..
<<< skipped >>>

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive

HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer3.webapp.scl3.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Wed, 07 Jan 2015 03:33:02 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=492

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer3.webapp.
scl3.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Wed, 07 Jan 2015 03:33:02 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=492..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

GET /pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: cafe

Cache-Control: private

Content-Length: 30424

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
.............W.J.0.W..."].c.@....=$....0.............U.....3..[....R..
.....7......y....7../g....7.W.....n..[....0.k.h....{a.....0lw.....g.sF
.....".....}........F.....GZ.[....EX\{.A....w..&.?..5o....y.f....^....
f.{.........y^o......an....CoI..M.0....F..|I...Q7 .M...{..V>....h..
...I.c.6.E.6Bw..Go..t.F..P7.n....Q....;Ng..c..F...z.].9?..i.....y.o.7.
#6t1..d..........E..y......X..k...x2.F.f-..E..........\..T.......z...d
.2..;...Q.N......R-.C?...j0....rO[H......y_..c>....]..Opa....?...L3
.s.wvO...oi.8....aUI...k3..."S.S.cQ.v5........a~M.Z.h.}......W........
.. ..owkS..M.......o.-g.Y..g3..4QW`/5.l.........0R.........a....'=..))
ptv..%.......4cqq.aCz4:....6..n$.n...E.mA..M...l.....6f0-....0..p...g.
....>....^M..m..-f....<..../.........x.......p.v.;.8.1.Z..B...E.
2~...^.cY.qV5....Fg6.....wu.../..-.F";9....W.T..:....?..<.....J.t..
6..^0b.t.h.l.;0........af.....a..Q5..=.`.m.S....nX...Vk>.v...[....6
]*..- ..o.?...p...){)~.x.9..N.."j..,Y.........p..YU$U]Q^..... SL39v..a
.....N(....U..N....rX.Cvswe..H..Z.lf.L.......?F-...Zx..........gj.Q...
.,...IE.,..*.........O..3.Zt..".g.....j..C-:.....IE-...7..........j..C
-..)[email protected].(..L'G'..u"....DD.z.\Z.....B.....h....)......P...X...
FD.....H2....ay...*.>h.g1.s. 7......F*.........-..n........1}"....y
C.U.UM..G*.K.nz)J..V.....n.i.^.V..._."z.. Ets..3.N.".y..9...1.OG.g...v
...Qd..JZN<Q.. 3.H.~..............F].7...k./....k..k..k...|Q7.f...0
...#M.y.7.p..#>....y.tm0.h.|3...9...D.,...)`i.Ee...>>.L;R..t.
....s......B.,..85g.E.!..S...N........k.r1..IZcM&..$.SW..;].D...&l
<<< skipped >>>

GET /templates/rt_dominion_j15/css/template-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:17 GMT

ETag: "16973-12e0-50b14d48fd240"

Accept-Ranges: bytes

Content-Length: 4832

Connection: close

Content-Type: text/css
/**. * @package   Dominion Template - RocketTheme. * @version   1.5.3 
January 10, 2010. * @author    RocketTheme hXXp://VVV.rockettheme.com.
 * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license  
 hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary 
Use License. */. . #rt-copyright, .rt-block, #rt-main-surround, #rt-he
ader, #rt-header-overlay, #rt-mainbody, #rt-bottom, #rt-menu-overlay, 
.rt-main-overlay, .module-surround, .module-br, .module-title, #rt-bac
kground, #rt-background2, #rt-background3 {zoom: 1;}. . /* cludge for 
fixed width empty div */.#rt-drawer .rt-grid-12 {float: none;}../* clu
dge for mainbody jumping */.#rt-main  {.zoom:1;position: relative;}. .
/* Content Titles */..rt-headline {zoom: 1;}../* Header */..topbar ul 
li a {display: inline !important;}../* Showcase */..showcase-item {dis
play: inline;}..showcase, .showcase-item {zoom: 1;}.#rt-showcase {padd
ing-bottom: 0;zoom: 1;}../* Content */..pollstableborder {zoom: 1;}..r
t-joomla .rt-headline {margin-top:0;}..article-rating {position: relat
ive !important;}..rt-joomla .rt-articleinfo {width: auto;zoom: 1;}../*
 Top Menus */..menu-type-splitmenu .menutop li, .menu-type-suckerfishm
enu .menutop li {margin: 0;}..menu-type-splitmenu .menutop li a, .menu
-type-suckerfishmenu .menutop li a {margin: 0;}..menu-type-suckerfishm
enu .menutop li {border: 0;}..menu-type-suckerfishmenu #rt-menu li li 
a span, .menu-type-suckerfishmenu #rt-menu li.sfHover li a span, .menu
-type-suckerfishmenu #rt-menu li#current li a span {background: no
<<< skipped >>>

GET /plugins/system/rokbox/themes/light/rokbox-style-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:55:51 GMT

ETag: "1692a-22d-50b14d30317c0"

Accept-Ranges: bytes

Content-Length: 557

Connection: close

Content-Type: text/css
#rokbox-top.rokbox-left{background:url(tl.gif) 0 0 no-repeat;clear:bot
h;}.#rokbox-top .rokbox-right{background:url(tr.gif) 100% 0 no-repeat;
}.#rokbox-top .rokbox-center{background:url(top.gif) 0 0 repeat-x;}.#r
okbox-middle.rokbox-left{background:url(left.gif) 0 0 repeat-y;}.#rokb
ox-middle .rokbox-right{background:url(right.gif) 100% 0 repeat-y;}.#r
okbox-bottom.rokbox-left{background:url(bl.gif) 0 0 no-repeat;}.#rokbo
x-bottom .rokbox-right{background:url(br.gif) 100% 0 no-repeat;}.#rokb
ox-bottom .rokbox-center{background:url(bottom.gif) 0 0 repeat-x;}...

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:34:06 GMT

Last-Modified: Thu, 01 Jan 2015 15:18:48 GMT

Server: ECS (frf/8799)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015010
1064605Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20141203203331Z....20150331203831Z0...*.H.............H...y5p
...Z...%...y.......w.>1......XZ.5(.X....D......~.....G...."1...8J.g
.y..5.. }[email protected][email protected]..(..!..c.....r....&,|....G3...[.F..
(...;A<.{;Bs.%Q....M:8........G.nKu}.97.......p..?.n_.#..d.. [email protected].
.IF[...X.lP.;.5'...v...-.....*l.8. ...e.?.q\.....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...140122184236Z..150122184140
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............. .p.)...09W..Z.......]....}.:.
.Vr.....c..U..:V^.O.....<...b*5.c.\.fF./....5'.>./ iS..R0..)..*.
!..q.h.T..ul.}&.......`.1".~.U....rB.BR.s..x..o..Y.......).4:.[.9.=...
.x...'.f..\ [email protected]:J!.hRH..!z2DtL.s2.r.....Yi~..E..AzO..i.."N
.$j...b...o..i."{(3....
<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/light/bodydiv-low.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:05 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:57:26 GMT

ETag: "16977-4e5-50b14d8acad80"

Accept-Ranges: bytes

Content-Length: 1253

Connection: close

Content-Type: image/png
.PNG........IHDR...2......... .._....sBIT.....O.....PLTE......... ....
pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin="   " id
="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41
        ">.   <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-r
df-syntax-ns#">.      <rdf:Description rdf:about="".            
xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">.         <xap:CreatorT
ool>Adobe Fireworks CS3</xap:CreatorTool>.         <xap:Cr
eateDate>2009-11-02T15:30:41Z</xap:CreateDate>.         <x
ap:ModifyDate>2009-12-30T07:58:27Z</xap:ModifyDate>.      <
;/rdf:Description>.      <rdf:Description rdf:about="".         
   xmlns:dc="hXXp://purl.org/dc/elements/1.1/">.         <dc:for
mat>image/png</dc:format>.      </rdf:Description>.   &
lt;/rdf:RDF>.</x:xmpmeta>.                                   
                                                                 .    
                                                                      
                          .                                           
                                                ;.S.....tEXtSoftware.A
dobe Fireworks CS3..F.....tEXtCreation Time.12/11/09........IDAT..c...
.....Q...........IEND.B`...
<<< skipped >>>

GET /templates/rt_dominion_j15/css/demo-styles.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e7-8cd-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2253

Connection: close

Content-Type: text/css
/**. * @package   Dominion Template - RocketTheme. * @version   1.5.3 
January 10, 2010. * @author    RocketTheme hXXp://VVV.rockettheme.com.
 * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license  
 hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary 
Use License. */./* Frontpage Content */..demo-img h4 {margin-bottom: 1
0px;}.h3.demo-title {margin-top: 0px;}..demo-img .rt-image {padding: 2
px;margin-right: 10px;float: left;}..demo-img-tab {width: 33%;}..demo-
img-tab .rt-image {float: none;}..demo-img-tab h4 {margin-top: 0;}..de
mo-img-padding {float: none;padding-left: 10px;padding-right: 9px;}..d
emo-tab .roktabs-wrapper .roktabs-container-wrapper div.wrapper {paddi
ng-top: 2px;}../* Gantry */..demo-img .rt-image.rt-image-right {float:
 right;margin-right: 0;}..gantry-logo {float: right;}../* Extensions *
/..rt-ext-col1 {float: left;width: 47%;}..rt-ext-col2 {float: right;wi
dth: 47%;}..rt-ext-block {margin-bottom: 30px;overflow: hidden;}..rt-e
xt-img {float: left;margin-right: 20px;margin-bottom: 25px;}..rt-ext-d
ivider {height: 10px;display: block;}..rt-ext-links {text-align: right
;display: block;}../* Style Variations */..demo-sv-title {width: 181px
;float: left;margin-right: 10px;padding-left: 3px;}..demo-img .demo-sv
-img {float: none;}../* Tutorials */..demo-tut-list {float: left;width
: 30%;}..demo-tut-list2 {float: left;width: 40%;}..demo-tut-video-img 
{margin-right: 15px;width: 123px;float: left;}..demo-tut-divider {widt
h: 15px;}../* RTL Stuff */..rtl .demo-img .rt-image {margin-left: 
<<< skipped >>>

GET /store/1731321/18800433.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d261sv3xac0f7i.cloudfront.net

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 3599

Connection: keep-alive

Date: Tue, 09 Dec 2014 05:07:07 GMT

Cache-Control: max-age=31536000

Last-Modified: Wed, 18 Mar 2009 19:16:20 GMT

ETag: "9fd70a39539ab338b0760528ccca31e1"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2499957

X-Cache: Hit from cloudfront

Via: 1.1 87b36ff610510370f50c63729c65320e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lPkX15i7W9GYTBueboEr5lbEhyx4KgoLqxGQuOcMaepOWxs-Vh2laA==
GIF89ax.2................5r.....vL:}....;...y$Sk.d..?Y....5s.)]....,\.
......4h.%M.1e....9z..9f...&Q...l.. .......b.......Gh.1e........|6.v2.
..aw.v..)T.Lw.tmgu.....1b.0e.....{.&Y....,`.......3i..7[2f...F........
.Ym.p...c..........g..R{.-^.Jf.Gt....^y.=..g.....-a..\.2i..=j...7Ry0^.
=.....X..#I.2g.T_q)U.1d.?..3m.(Y.4f./S.....a..`...%..)...1f.!Ey2h.2k..
.....-a..../].......W.....,Z. `.<..0a...a/`[email protected].
.5o.*_.!Es:......1L...Vg|......7u./d.2d.6l.l..2c. X....&P..?p1`.:_.$Bf
7Kb&O.2f.1a..oP.....2......1a..........5o....7w.-Z...6;a....S..s..3...
../b.(Ep...2k.....\.G_.1d.#..*W./_............. Y.... \.6o....>..n.
.8x....3d.-[....>l..=b..I...&Js...,Z.............'[.......0c.AXrGo.
.q\......M..0P}1e....&;S........,>[email protected]../`....(P.......'MyX...
7bt.....o..Yq.4m.Zq....!.......,....x.2............k..*\......#J.H.".f
.3...B...Z...I....(S.\[email protected]..&Mn..7L....L.p1..
.nX.r....V..  B.....f..];.-.)p....W...f...KD.\.8..01l$.:.~h....HB..r.K
..e._/.%.....t....W.^I.g.^.....|QKZM.......At....M....s$.)U.n...2.....
==.6..t.O'2.M..]*.....K.63R.N......gxW}...3.pX.c8......T-.p`....5Z]R..
\X.t..jlT.^.....\..v.w..(.y..H..".X^.B...7(...7..q......N.."....8..J.%
..R....kU..w`.s...`.J..f..(R.g.\|E.b.)ji.9U.G.x=.a...X.......7~(....4.
......0.p.... ......C.#....cU&.^`....fvA..*t.....c.......k.w.....C.w..
..;.............g..........6..y..~.b..#.A.6.X.."J.....|...#.C...~..4H.
@.<.~.....bo,..KF........1.... .9d.........j .M..z..8..q..7.a...hQ.
,.....~.".*........r.J(....D#C4...H..:....PP...D.G.J.H.#.D-..H$q3.
<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:34:07 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d769df113145dd17e267a97a9a8ac956f1420601647; expires=Thu, 07-Jan-16 03:34:07 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Mon, 05 Jan 2015 22:10:47 GMT

Expires: Sun, 11 Jan 2015 03:34:06 GMT

ETag: "6cb83c5a0979f7a013d3af9d841ab7d42bcceae2"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1a4d19065f39157d-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0105221047Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150105221047Z....20150109221047Z."0 0..
. .....0......20140105221047Z0...*.H.............<[email protected].
?]. ..._:..2.&7.o #!..].VkT3..8~....c....9F..{!Q....-...`.....!..~RJ..
.iVu.Uo..Q.whi ,[email protected]..?.K2`Qu...&w.<..gA.pNV.L.....sk.[.N.z
[email protected].[...v..\..,..%..A@d"r.ZQ )...-.w..Qv..z;.tu..R..7.....B.
..V..{....pJ..n........H;1#...b....0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0059695b36fcc39d HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Wed, 07 Jan 2015 03:33:05 GMT

Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Wed, 07 Jan 2015 03:33:05 GMT..Conn
ection: keep-alive..

GET /s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff HTTP/1.1

Accept: */*

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://googleads.g.doubleclick.net

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: font/woff

Last-Modified: Mon, 11 Aug 2014 21:03:10 GMT

Date: Tue, 09 Dec 2014 02:38:32 GMT

Expires: Wed, 09 Dec 2015 02:38:32 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 20060

X-XSS-Protection: 1; mode=block

Age: 2508873

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002
wOFF......N\.......H........................GDEF.......'...(.I..GPOS..
.....\...L....GSUB.......A....S%QgOS/2...H...W...`k.c.cmap.......W....
...tcvt .......9...:....fpgm...4.......a.A..gasp...,............glyf..
.<..=.....a.\.head..F....6...6...2hhea..F........$....hmtx..G......
...m...loca..H............2maxp..J.... ... ....name..J........J..1.pos
t..K........F.F..prep..M.........i..Bx.c`d``.a..&.. ....`..$.1<..O.
~30..'..f.x.....fg....j...c..X..m.6......=."lT.....>k{......~......
[email protected].$%.....D...qY...........8...E.......j....Q.
.....>.8._...4......Y..h>.......!.-.) C....".Z.i...%...U_.Q.0S..
S.6S..S.!S.3...3......x..y.<H-'y.o...<L..#.*S.*T.*Uk..k..j..k.fk
..j..k..j..k..j.VR.j..z.7h.6i..h.....c<...}[..S......-U..U.JU.Z....
..w..<..*T.e.o.m..N.jP...sW......<.4.w.7.v!Oz|F....o.c:..:..%_.)
 O.j.....*..j...j.I..E].M..C.......-....x..mN..B...{<.1...1.#..UE*V
.r....]2E.K........u.._..~.....-...jU.z5...7.]..s.<W9F..JH.......s.
.s.%.?x...u.Z..<b......,7....W.^...%........... z... ...iV/..Zr.z.g
.v...#........mhK{....B.)..r*...G.Dg...nt.. z....c.....&1...d=...&6...
.a/.8.!..mj........b..C.C..K[...I.g....ND.b...*W=jr.DwR...c_...I1...3.
NG.$...D.4...B.3.....0..L...PK.G.%&.....5i.&M[...qV.........=<:...&
`0C..n".2...&b...h...N61S....f...,$`...XaB....`".49<crp.......E&.*x
.m.3..Q....9....b.^.mc..[.......>G.\Kzn..<._BC....,..N}m.....V9i
..j.fL._.._.Hr...C...!.U..x.....Y.|.^.......t.5.d.24A....`...~...W_R)k
...4X.4.]..Q..1....*...?*...KkdO.?..?5..L..z.c.1..c.%V.`.....0.P..
<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/css/gantry.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164df-1575-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 5493

Connection: close

Content-Type: text/css
/**. * @package..Gantry Template Framework - RocketTheme. * @version..
2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.
com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @lice
nse..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Propriet
ary Use License. */../* Reset */.html, body, div, span, applet, object
, iframe, h1, h2, h3, h4, h5, h6, p, blockquote, pre, a, abbr, acronym
, address, big, cite, code, del, dfn, em, font, img, ins, kbd, q, s, s
amp, small, strike, strong, sub, sup, tt, var, b, u, i, center, dl, dt
, dd, ol, ul, li, fieldset, form, label, legend, table, caption, tbody
, tfoot, thead, tr {margin: 0;padding: 0;border: 0;outline: 0;font-siz
e: 100%;vertical-align: baseline;background: transparent;}. th, td {ma
rgin: 0;padding: 0;border: 0;outline: 0;font-size: 100%;}../* Grid Con
tainer */..rt-container {margin: 0 auto;width: 960px;}.body {min-width
: 960px;}../* Grid Block */..rt-block {padding: 15px;margin-bottom: 10
px;position: relative;}.#rt-content-top .rt-alpha, #rt-content-bottom 
.rt-alpha {margin-left: 0;}.#rt-content-top .rt-omega, #rt-content-bot
tom .rt-omega {margin-right: 0;}../* Layout */.#rt-logo {width: 185px;
height: 115px;display: block;}.#rt-content-top, #rt-content-bottom {ov
erflow: hidden;}.#rocket {display: block;width: 110px;height: 15px;mar
gin: 0 auto;}.#rt-copyright {text-align: center;}../* Menu */.#rt-menu
 .rt-container {background: #666;height: 3em;}.#rt-menu ul.menu {list-
style: none;margin: 0 10px;padding: 0;}.#rt-menu ul.menu li {float
<<< skipped >>>

GET /templates/rt_dominion_j15/css/style2-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:14 GMT

ETag: "16972-694-50b14d4620b80"

Accept-Ranges: bytes

Content-Length: 1684

Connection: close

Content-Type: text/css
/**. * @package   Dominion Template - RocketTheme. * @version   1.5.3 
January 10, 2010. * @author    RocketTheme hXXp://VVV.rockettheme.com.
 * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license  
 hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary 
Use License. */..menu-type-splitmenu #rt-menu .menutop {padding: 0 10p
x;}..menu-type-splitmenu #rt-menu li a {color: #fff;}..menu-type-split
menu #rt-menu li a:hover {color: #fff;}..menu-type-splitmenu #rt-menu 
li a:hover, .menu-type-splitmenu #rt-menu li.active a {background: #00
2640;border: none;}..menu-type-splitmenu #rt-menu li a:hover span, .me
nu-type-splitmenu #rt-menu li.active a span {border: none;}..menu-type
-splitmenu #rt-menu li.active a {color: #fff;}...menu-type-suckerfishm
enu #rt-menu .menutop {padding: 0 10px;}..menu-type-suckerfishmenu #rt
-menu li a {color: #fff;}..menu-type-suckerfishmenu #rt-menu li.sfHove
r a {color: #fff;}..menu-type-suckerfishmenu #rt-menu li.sfHover a, .m
enu-type-suckerfishmenu #rt-menu li#current a {background: #002640;bor
der: none;}..menu-type-suckerfishmenu #rt-menu li.sfHover a span, .men
u-type-suckerfishmenu #rt-menu li#current a span {border: none;}..menu
-type-suckerfishmenu #rt-menu li#current a {color: #fff;}..menu-type-s
uckerfishmenu #rt-menu li ul {background: #002640;}..menu-type-suckerf
ishmenu #rt-menu ul ul li .item:hover {background: #26BBE0;}..menu-typ
e-suckerfishmenu #rt-menu ul ul li .daddy:hover {background: #26BBE0;}
..menu-type-suckerfishmenu #rt-menu li.sfHover li .item {color: #f
<<< skipped >>>

GET /templates/rt_dominion_j15/css/style2.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164db-752c-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 29996

Connection: close

Content-Type: text/css
/**.. * @package   Dominion Template - RocketTheme.. * @version   1.5.
3 January 10, 2010.. * @author    RocketTheme hXXp://VVV.rockettheme.c
om.. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC.. * @lice
nse   hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprie
tary Use License.. */.. ../* Core */..body {background: #fff;color: #6
66;}..a:hover {color: #000;}..h1, h2, h3, h4, h5, h6, legend {color: #
333;}../* Backgrounds - High */...backgroundlevel-high #rt-background 
{background: url(../images/backgrounds/style2/main-bg2.png) 50% 0 repe
at-x;}...backgroundlevel-high #rt-background2 {background: url(../imag
es/backgrounds/style2/main-bg.jpg) 50% 0 no-repeat;}...backgroundlevel
-high #rt-background3 {background: url(../images/backgrounds/style2/ma
in-bg-bottom.jpg) 50% 100% no-repeat;}../* Backgrounds - Med */...back
groundlevel-med #rt-background {background: url(../images/backgrounds/
style2/main-bg-med.jpg) 50% 0 repeat-x;}...backgroundlevel-med #rt-bac
kground2 {background: url(../images/backgrounds/style2/main-bg-bottom-
med.jpg) 50% 100% repeat-x;}../* Backgrounds - Low */...backgroundleve
l-low #rt-background {background: url(../images/backgrounds/style2/mai
n-bg2.png) 50% 0 repeat-x;}../* Header */..#rt-logo {background: url(/
images/stories/app/home/logo.png) 0 0 no-repeat;}..#rt-top, #rt-drawer
 {background: #00060D;}..#rt-top .title {color: #ccc;}..#rt-top .title
 span {color: #fff;}..#rt-top .module-title {border-bottom: 1px dotted
 #aaa;}...bodylevel-high #rt-header, .bodylevel-med #rt-header {ba
<<< skipped >>>

GET /components/com_jcomments/js/jcomments-v2.1.js?v=2 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:25 GMT

ETag: "16416-6a2b-50b147ba1b540"

Accept-Ranges: bytes

Content-Length: 27179

Connection: close

Content-Type: application/x-javascript
function JCommentsEvents(){}..function JCommentsInput(){}..function JC
ommentsIndicator(){this.init();}..function JCommentsForm(id,editor){th
is.init(id,editor);}..function JCommentsEditor(textarea,resizable){thi
s.init(textarea,resizable);}..function JComments(oi,og,r){this.init(oi
,og,r);}..JCommentsEvents.prototype = {...add: function(o,e,f){if(o.ad
dEventListener){o.addEventListener(e,f,false);return true;}else if(o.a
ttachEvent){var r=o.attachEvent("on" e,f);return r;}else{return false;
}},...remove: function(o,e,f){if(o.removeEventListener){o.removeEventL
istener(e,f,false);}else if(o.detachEvent){o.detachEvent( "on" e,o[e f
] );o[e f]=null;o["e" e f]=null;}},...cancel: function(e){if(e.stopPro
pagation){e.cancelBubble=true;e.preventDefault();e.stopPropagation();}
e.returnValue=false;return false;},...target: function(e){var t;if(!e)
e=window.event;if(e.target)t=e.target;else if(e.srcElement)t=e.srcElem
ent;if(t.nodeType==3)t=t.parentNode;return t;}..};..JCommentsInput.pro
totype = {...register: function(el){if(el){var th=this,events=new JCom
mentsEvents();events.add(el,'focus',function(e){return th.onFocus(e);}
);events.add(el,'blur',function(e){return th.onBlur(e);});}},...unregi
ster: function(el){if(el){var th=this,events=new JCommentsEvents();eve
nts.remove(el,'focus',function(e){return th.onFocus(e);});events.remov
e(el,'blur',function(e){return th.onBlur(e);});}},...onFocus: function
(e){var t=JCommentsEvents.prototype.target(e);if(t!=null){t.className=
t.className.replace('error','') ' selected';}},...onBlur: function
<<< skipped >>>

GET /images/stories/app/package1/box/box180_fhi.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:39 GMT

ETag: "16893-d855-50b147c7754c0"

Accept-Ranges: bytes

Content-Length: 55381

Connection: close

Content-Type: image/png

X-Pad: avoid browser bug
.PNG........IHDR.............=..2....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.....y..r....:.#....y=......}.........([email protected].>.|.
./....%..3... cHRM..z%..............u0...`..:....o._.F....IDATx...w.e.
U........S..&j.F3#.IHHHB ....@[email protected].%4..A..==.s.t.
..u......w.S.#.......j>.=.]]u..k.w.g=............|.................
.........Q....r../.I.cO..!...{..../......#.{t...k..Jk.8F.I.G.*..8&
<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 13 Nov 2014 06:02:42 GMT

Accept-Ranges: bytes

ETag: "88cab6f7ffcf1:0"

Server: Microsoft-IIS/8.0

VTag: 438246244800000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:37:03 GMT

Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..141112173206Z..150211055206Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......W0... .....7......150210174206Z0.
..*.H................].`...D..9.>LO.ey...Qx%.^.P.& ...D.......b}.K.
.[.....5.m....).....H..6R....G/ju.........:..A.#.9!......D5...|".w.x..
=.u..X6.7{..).XN....g......B.8.!&...........<7fS$..........t<X)%
.b([email protected]... ,...K\....U1cp).........y.T..?rm.t..Y.}.E..
-@...

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?4a860dfad991908a HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 56928

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive
MSCF....`.......,...................I.................,E.Y .authroot.s
tl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......
_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q
.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2
.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\
YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x
%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,
....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.......
[email protected]/"...f.......k..Jm7j....R.5q....Rz.
.!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%
T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m...
_.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..
*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<
;.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|[email protected].._.....7._6...C.0...
A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?.
..........WE.Or..O>..{.'[email protected]}.o:?~....]&l
t;!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..
{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......
q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!........
.`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=..
.f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..
].|......3..y..-./....K..6{...s.<R`.}[email protected]....
<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/style2/footer-div.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:05 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:58:25 GMT

ETag: "16a01-4e5-50b14dc30f240"

Accept-Ranges: bytes

Content-Length: 1253

Connection: close

Content-Type: image/png
.PNG........IHDR..............6.x....sBIT.....O.....PLTE.Ab..1.w.a....
pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin="   " id
="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41
        ">.   <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-r
df-syntax-ns#">.      <rdf:Description rdf:about="".            
xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">.         <xap:CreatorT
ool>Adobe Fireworks CS3</xap:CreatorTool>.         <xap:Cr
eateDate>2009-11-02T15:30:41Z</xap:CreateDate>.         <x
ap:ModifyDate>2009-12-30T07:58:27Z</xap:ModifyDate>.      <
;/rdf:Description>.      <rdf:Description rdf:about="".         
   xmlns:dc="hXXp://purl.org/dc/elements/1.1/">.         <dc:for
mat>image/png</dc:format>.      </rdf:Description>.   &
lt;/rdf:RDF>.</x:xmpmeta>.                                   
                                                                 .    
                                                                      
                          .                                           
                                                ;.S.....tEXtSoftware.A
dobe Fireworks CS3..F.....tEXtCreation Time.12/11/09........IDAT..c...
.........%lo.....IEND.B`...
<<< skipped >>>

GET /pagead/show_ads.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 17505132066848985518

Date: Wed, 07 Jan 2015 02:39:08 GMT

Expires: Wed, 07 Jan 2015 03:39:08 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 7529

X-XSS-Protection: 1; mode=block

Age: 3235

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002
...........\ys.F.._...KQ.....5...v..I|.g.......".@...".....N..f_.....\
===}.......B....I `..OM.Y..U....XD^.[..k.}!.Lc.6..>....i.C..=O.~k$"
[%...E........Z.E.8LA.q.e......Y.......kI.&...W?t..)0q..r...$:..z....-
...[..".e.v[[....P..a.......Z.h,...uz..E...}..7...L3viS".*.}...e...O(.
T.B..k.....C...X..D......4X...C).{c.u&3m.1..F5...8..y....<...0K....
..J....It.:M.(.%....q.. n.L2D..R:....!..(...'.?.oX..Va:..,..c.r...h7..
..;.j......,Y.E.........}..]...^..;.u.3.J.......l>rx..2..........Cq
...g...D.._...5]5..g1OR.*.xF.<..O...x_...|....q..7.Mc..mz.g.J...f".
Y...Q.o..c......r..[..]?.v.....x747.~6...>.v...=S.....m.,.]....n..3
v&.)..]<..t...<..s....x../..o.].oC</8..5..f.......;.p`..-....
A.o...MkD..K.X......#..Vi..X6;<..6..!..D...4O.gD#......E...}.N._...
#)....<[email protected]../.._..>||..g.n.!...a....%4.c.B\0...~.......B.R
.t..6."b..r....D.t,...d...'...H....Z.6.D.. ..r......W.(....S..v.-...R.
...-......nw.6ji....K..|.gH...U..b.B-;....c...E...x9.C.p.t........J.[.
......4Q"..;B...<..t<:.u...z.....h.`t.v....>......gj?..-.>
.,l=..LZ....f..b...O...)..WL.....q&../.':..@H!.............3,.K..Ki...
...x.8....,.r........{....'.M...7...~W.=.......i.............GO>z..
$=.......3....M..|._.H;....iGh8.`.l._...|=..m~..K..9..Z.....<}w....
.\..t..zQ"..LM.....7.9..$$..Ba...9Tj~c^.....dGu.%.l`....-.XX..c..Y..J.
.G.w...t...^...~..P$.]..A)...*.......\vi...0.../[email protected]"...
.z{.!..1..I.{:.7....l.H...U1b... q..Vi.m..c>.o.o..RN`.L.L......@...
<.<....8..%.mKt:..7..>[email protected]...).<.tm?.>{....
<<< skipped >>>

GET /pagead/js/r20141209/r20141212/show_ads_impl.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 14148960368062276995

Date: Wed, 07 Jan 2015 03:33:04 GMT

Expires: Wed, 07 Jan 2015 03:33:04 GMT

Cache-Control: private, max-age=1209600

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 49924

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
............g{...0...B..u...%.....l..W..d'Nl-=l*.ZD.%......$X..}.s..w.
...m0.......Y.<.._...0.g.~.Fv......l>....}.P^.mg..G..\.....)..A.
.k%..<.[,..s[n.G..^.J.S.5.i.2[,...a.Z.3.Vg<.1.[Ni........c..~g..
.e..)#.5.....]........k.d..U...yNbpN...NF...y..S..)..*.1..=......'k...
..y..;...wtm.~...f...A....}..d.M........hV:..U"2.\...l.[.L..1.Y....i..
-y.`.mQ.ny.._.#.....x.5..D6...Z...F...L!$..M.6..A.?.|m=N....U...I0.=..
u.8.:.....'...L3.....XL>.....,...P....Cr..e0......!.E1..([email protected]
...d..m(&..}.".,..DJ.R.\...(.G..x..~.....).....e.T.d......P.p2.m......
...'..8.%g2.<.N...g...k8..0S.lIX.u......B}:..C[g{?*'.....i.(./[email protected]
.a.r..)...Qy.J.......y...pD..f......L..M....si.....S...YY_..! .(A0x...
.9..CP..>l.j.1.r..S..\...}O...2m..j.]..%`u..d..r.#=.t..8K..}....h..
Xd...'../.,{&:.k..9'.....%...-C..O,/.....p:..TD..{..1%o...t...S.......
.5.u.iq.v.......m...m.2[....F..r..(.....Y..[.%.).....6.]..3...........
..s.3...> ..{..........8.A..R.T....Ey...`...[.Y.b...es....8^.....~8
..?....f.xW2^.._.li.w.my.].hT_l.i.-..R..S.:3.......iSnA[.%t....K.m...6
.A.=$..e.\......g......&..Q. N9.?....|..{.``.b..8..T.......S..S>E.A
.4..w.,..s...\(ub.....'.6.{..T.0m..`.D.h...,].M.....v...d.....|..31_21
7.....o..!}..d/......C.Ni...x.......%.<....|x_..3.p.....NU.8](.]...
........x......28.z..}....B.N..j^.(E7.fn.4...@.[....wON.U\D_/..L.....f
s.dVd..e..3.X...u0n0S....MD.0..|...c....S..S\...<....J.!w.c....'..f
.....F:.~&w<.L........_j/....g.~....dMNJ&...l.t.x..I.........l.~...
............%.~._..>.....7..k/[[l......j...CL..uX......_..0.V.i
<<< skipped >>>

GET /pagead/osd.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 9604784682434440633

Date: Wed, 07 Jan 2015 02:38:31 GMT

Expires: Wed, 07 Jan 2015 03:38:31 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 18569

X-XSS-Protection: 1; mode=block

Age: 3273

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002
............yW...8.?...tq.F..:..5.R...h..!.K..$%S3.i..g....,'........Y
[{...M...3....k1Z...vg...6B.X.%\T..ng.{U/`)....Z.._O....*oer..:..|..|.
s{.L.D.`.._FI. ..I{s..<....l..A.....z.I.k......B6.......P.x.b....1.
..r....... .!.......4.....'..`...H....LG}O......R!:.z..AQ...h0.`....l2
..[.Dt.P.5.B.`.s...n.......VHF..T.....b9.....8o.Oe......cq..yW,4t(G...
....#.w!..Fy.....`uplk_..7....G..k..M.........;..:.?.4..`Sm"X..V.b..'.
L..%e.,.8.....`......5..6,......q./...t ....,..wl...e}Y.;.8........gni
.&...%.V=.U1.vg........`...1.![....!.I{4.Y?...R.........&........T..3Y
.....%`....A..j.'X.....V t..f.X.u%.3 .6]..)7[...Grss..qW..@~P...=.....
..\O.)....af.y}...s...9j....j..w.{...s.....t.......c).Q".{SX....h,_t.b
.o....D...>.....=..Z(T.m.o|.^..A....j.!x...o.tM..xz...y.n..)......h
$...&....]..1......S.Q.7..f,.3.\...Y2....[...c.`..F... `...sq9....fen]
..[..`v_......P.....4..&.....pb...r-..)z..`.r.......;)K.t%.3L.*K....r.
.L.s:(-.....c.....,..m.....2.(.........!....|...)|.....9|...!|.XpN.y..
...._.m..jy..4).5..&..;.&.E......2~,&.jO.....L...Z...b.ln....U.....,..
.(........d..v.{..ez?......y-.....Q:.b'.O.....x.%..&;..*.[.G......hQ..
... .I..'.)T....=N...?.1..k....I.u.....c..l...`<..`q...6....X.,....
4Ke/nl.C.4n........r4x....a.{^../.........)-:...q......T]..~]v..}.P...
..../.......{Qi...........qyIU{....^.....D....Bp..h......]"..*~..`. q.
[email protected]...*[email protected]:g..}...1W...3OF35\..c..!,.S...A.n{$.
..R.7.SU...N3.Q.he.w..2i.p./ ......OM. j......b.~...)mbX....}`N.B(64..
......c.?.?.......(.j2..'.jKN>P.O.;.ch.l..6.....w..V../.e.!.(8.
<<< skipped >>>

GET /pagead/js/r20141209/r20141212/expansion_embed.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 15330149891054740749

Date: Thu, 01 Jan 2015 11:27:17 GMT

Expires: Thu, 15 Jan 2015 11:27:17 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 51194

X-XSS-Protection: 1; mode=block

Age: 489947

Cache-Control: public, max-age=1209600

Alternate-Protocol: 80:quic,p=0.002
...........}iW....w~.hr.)n...,R.?.%...%.....l...m......zQ.$2......V.Ku
Uum.f..x...]......Y/.t.cv.........Q..n.Mf.sa...s...y}<.u'.Sw. ..\l/
.{,.b..t....^7s....\....^D...7Nge/......EFG..)...E/..a:.fy..;..2.'N.F.
....g.....c,.2..GOt.p.p.b.=j.S....8....h0.`....p2......z....T.`.K.....
a$..M..*F..ROON..:JG...T.....3?....4......sq....\..0.M.....p:.Q...Ug..
h...k3c.vC...pe.......M.#R[.L..q.d..D8T][email protected]...)9.. ._....C..%U.HyA.
B....%...M..aU.c.1..........IU9c}.\.....Se...A.a.33W{.:..s....?=..7...
.i.C'.........\85......>..G......}....6...k.."....n..p.{ty=.c....0.
.....rM..9.M:.....h.......]On.X.$.Cj..1..y.U....~..W._....R.}..rj1Kt.\
..l..r..b..L.miAnCu...q%..g..s..j..zu.L.......{.....pI...K.B..r<.&g
t;....=.o..5.[v8....nT...;..Q\Q.....]..'i.?..z*-m....b...W..$.,.{A|.8.
.g......>..a<..'OO...`m...s:.....n.......\.s.F^ 9M...OB.A_>%.
..=....fc$.q..a...fx..J.FA\..L.......x2...r...^c.A.rZ...n..-,y.*\..J.1
.........y..N..5....|.B....I$..FO....u.s..83..a..J......:^..>O.s..5
.1......<.sM.......5......[x...y..  .K.o..^.$\..n...C,#..{b9...q8..
.........t...........~....r..(...ItJ.Yo......N<.......c..b.....aP..
=}...[8.Ch!=....h...{&]...."$.r.$....X...J.O...\.\..1o...R.....{.....7
&...u.:..........H....VL.o..nU.<.... 3G...S[...l|.....'...b.9......
.M..t<.y...D.<......G.\.r..3.....Q..oJ...toRU.m..=.nW.....X.....
.*.....#..m....g..F..w.....8.[........7...............w....b..s.?O....
.....lf.......3I.1ws.3.~jdEvV&..5.p.y.X.N.........|.M.t...._....'.8.&L
....A.^....{v..........6..... .P...~'".^yOO..$...].pMd.X...`x...D.
<<< skipped >>>

GET /pagead/images/nessie_icon_tiamat_white.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 14085932017949564970

Date: Wed, 07 Jan 2015 02:37:48 GMT

Expires: Thu, 08 Jan 2015 02:37:48 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 225

X-XSS-Protection: 1; mode=block

Age: 3316

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002
.PNG........IHDR.......*......0Kc....IDATX...A.. ..a#...F....`.".....=
..=.;....<`.i.#..l...d.T7.H.S......,..\.. *.z ~...KCcI.5....f......
..`.t..`uhl}.3v...l].HQ 6.V..I......O2.%..^[email protected]..._.e..;;}2
..........IEND.B`.....


GET /pagead/js/r20141209/r20110914/abg.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 4058474734652203665

Date: Thu, 01 Jan 2015 11:27:17 GMT

Expires: Thu, 15 Jan 2015 11:27:17 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 13641

X-XSS-Protection: 1; mode=block

Age: 489947

Cache-Control: public, max-age=1209600

Alternate-Protocol: 80:quic,p=0.002
...........}i[.:..w~Ep...'$...\..P(..r......i........d.K(.9.}...b-...h
4..........n<..A....a.=4...,f.<..Yy...C] k.....9.4...7..ze..wO.A
....jL...VD`.j.......;~.*l........v3...2d.x|...B..m.............&..NLG
%.x`eOI0..~8....|...O...=...&..K.F.\;...A...vS.......Pa@.`.o......"..`
...^..0.Yi.#B"....%.S..A..Xg9.N.A.wUvY..u.......v..n.@.#k..%..........
...H.".k...7.=..f..(....S.Q.P.......>`......l~..qd...ND. !|Ipn.(...
$D..$.^...._.....X...F@...*.$..F..=1....`Cji....Y..R.. }b6...t.-GJ....
.......lp....!...(9CE..Yf..Ap[.......-nF........a........"..!..23....V
.j.#.!xsL/...4.f2....S$21.fd...Z.T..../Ug.eF.W7.....@wz,l...7........I
...rP..m..{,....v<.pQD.....:m.e.........8l...k.$SbHD..)e7.36..a0...
..j......Uo.....SZ4.k{.....u],.....b......Q...9w.R...4.......T.....g..
.?......9.......?....;Vi..Q.....i.8...}....a.Qi...z.b5.........c.6..}.
.Q.z3.. t'........*....".......\./2....li#....R...R...K.L.....A..|7...
..|..W...../Q-J8^,.....t.01........ ..h=....A...M...wf.............Vw.
n....7t.0.].....F...!z.5.....x....ol...x.i;.V-o.a.d.SlC.....6.Uq.... ?
.....s...4P].m..zNJ..ou...}X....Q..5m/(..P...m....=.G.s.TN.}eda.AH..9.
.1..I.... '............wtWw...cr...8{....K]....gmw<....c..R...E.93.
..|..........|XQ.'...!.<.o...~.......t.P.v..4H.,.9.m.n..0...NN.&...
.%.P....P.JM...#1..s.......L......CY..^.3..U.b. .g.\"uVK..#._;z*....9.
.i..........4...G5.....&.v4p4...0j.4..hlK....wb^'..-1..SU.f.e..V\..:0.
.?...r..TlE.2.7../....d..5..........rU_.$..o.48...uB|.v.YTa....N..E.x.
....f\*[email protected];T.Ee.m..7...&I...C.".9.N*:.4..SiN.t|..j<*..j...
<<< skipped >>>

GET /pagead/images/ad_choices_i.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 14036706360268997840

Date: Wed, 07 Jan 2015 02:46:20 GMT

Expires: Thu, 08 Jan 2015 02:46:20 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 365

X-XSS-Protection: 1; mode=block

Age: 2805

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002
.PNG........IHDR..............D.,...4IDAT8.c....fja.l.l...eXw.....W(6.
d.2.|..Y..k......w..#..[..8B.a3..>.,....{.8..../}...l...^........}.
..4.$.....G.~.$....^.A.....2..Ig..&..{_....f...'.......f A..o<..b..
....{.wA....`..^|[email protected].~9......q..i.!&.........0[.....~... .zHB..
~.3z.#......s.o...}...........#..t.x#.a...}[email protected]...."R.@.
.......I.....IEND.B`.....


GET /bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Tue, 02 Dec 2014 17:50:02 GMT

Date: Mon, 15 Dec 2014 15:21:04 GMT

Expires: Tue, 15 Dec 2015 15:21:04 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 5719

X-XSS-Protection: 1; mode=block

Age: 1944722

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002
.............{.......<.....6.....c{.).....4..c.....ft.....{.k.u...\
.....U.&......S......*.~S.D.....Y.. ..>_.N.T..../{..`.&;k.,......G.
.:H............o..I.Mf.M~. .....ieL/..e.R.9K.qL/....A.X.M...].&a.I}...
).q..,.e7sA..|NN}.3..2M*....n...}..\....h@C*...qg1.'.m9..!....9.$.p...
....wA:.g.U.f[..UG`..f...N,.q..j.`...&..&.#.c...c.....1......s.....laI
~NF..p..Q.Sk...Af1......W&.".I.0.>DQ..X..m.Wr..T..?`.qCY'....I2v...
....j...I.....E`V.x.T9.DEB.VV..."[email protected]..<]..."
.~.......&..m....j..|w....?..Sm.2\......[Q.,O. .9.p... c.......u.....]
9....y6K..!H....B.,."}8.I.]........~Q....fYk....:*j..?.W.g..7.H.....Pt
..t....s..w_.{z.J...[.............G.K../.....?..w..E#X...N8......q..xf
. }%.v.I....A..E...p.).#...&4.)]J....}..>$.'j...4`z..'N*.1..}....|q
~..7..U....cjY.la....x.^.,r...m...u...kzM)....F.:...`0..@[4.....{ .'..
...>?....>.G,j.a..o..p.4JY.8...j....!].L...v@.....>...:."....
-.]..ov%..&....m.*...Yj.X[..2`jT^...M......('...5.Y...9.!.sv..(}..m..{
....s.6...O.Q..9:...t.I..>b.C.:..'..R8..tN....c......9..u....AY|.R}
..c|p.{g..{.X.....>::>9}....?..x................`8....E<Mf..t
.-.....h....~.......r....3..G..t.8=.?L...)N.i...S.h.....%k.x...$.p...x
~...'.n....l0.]...a..U^...0..8...:!.n.......^.2..[.v.....r.Z]{...V.V..
 j....C.6..1.4...e.....P..e...&...`.,..4.....c.1........e..N.....]..}.
.'..`.:..( ...).k.M{....&.[..\......F*b.C.x...\.M3C.]..M._f.,Q.E..... 
......8 Vt.l4Z...*..........F...^^....di..K5....`........%_.x..4.2}h..
\.V p...$.....FMgp.......q.Q:.j...^.......f...dLh6..K....-....-...
<<< skipped >>>

GET /activeview?id=osdim&avi=BFggm8KisVKv1JvGjiga8oIDgBgD1ubXv7QEAABABOAHIAQHIA8MEqBOAAQ&ti=1&adk=180657799&p=546,395,606,863&tos=1230,0,0,0,0&mtos=1230,1230,1230,1230,1230&rs=1&ht=0&tfs=1527&tls=2757&fp=client=ca-pub-2137902362367109&url=http%3A%2F%2FVVV.free-hideip.com%2Ffree-hide-ip-installed.html&correlator=4583063697160&eid=317150304%2C42631034&oid=3&afp=&output=html&slotname=8429118295&flash=10.0.45.2&dt=1420601562998&adx=395&ady=546&ifi=1&tdl=1747&abd=3-0-4&r=u&bs=1700,804&bos=1724,865&ps=1716,1440&ss=1716,901&tt=1016&pt=1742&deb=1-2-2-3-7-3&tvt=1231&iframe_loc=http://VVV.free-hideip.com/free-hide-ip-installed.html&is=468,60&uc=4 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.fr
HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Access-Control-Allow-Origin: *

Content-Type: image/gif

Date: Wed, 07 Jan 2015 03:33:07 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA 
PSD IVA IVD OTP OUR OTR IND OTC"..Access-Control-Allow-Origin: *..Cont
ent-Type: image/gif..Date: Wed, 07 Jan 2015 03:33:07 GMT..Pragma: no-c
ache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache,
 must-revalidate..X-Content-Type-Options: nosniff..Server: cafe..Conte
nt-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80
:quic,p=0.002..GIF89a.............!.......,...........D.;..

GET /templates/rt_dominion_j15/css/template.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e5-3cc9-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 15561

Connection: close

Content-Type: text/css
/**.. * @package   Dominion Template - RocketTheme.. * @version   1.5.
3 January 10, 2010.. * @author    RocketTheme hXXp://VVV.rockettheme.c
om.. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC.. * @lice
nse   hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprie
tary Use License.. */../* Core */..body {font-family: Helvetica,Arial,
sans-serif;}...font-family-optima {font-family: Optima, Lucida, 'MgOpe
n Cosmetica', 'Lucida Sans Unicode', sans-serif;}...font-family-geneva
 {font-family: Geneva, Tahoma, "Nimbus Sans L", sans-serif;}...font-fa
mily-helvetica {font-family: Helvetica, Arial, FreeSans, sans-serif;}.
..font-family-lucida {font-family: "Lucida Grande",Helvetica,Verdana,s
ans-serif;}...font-family-georgia {font-family: Georgia, sans-serif;}.
..font-family-trebuchet {font-family: "Trebuchet MS", sans-serif;}...f
ont-family-palatino {font-family: "Palatino Linotype", "Book Antiqua",
 Palatino, "Times New Roman", Times, serif;}...rt-container {backgroun
d: transparent;}..ul {list-style-image: none;}..ul.menu {padding-left:
 0;}../* Header */...bodylevel-high #rt-header, .bodylevel-med #rt-hea
der {margin: 0 -20px;padding: 0 20px;}..#rt-header2 {height: 30px;}..#
rt-header .rt-block {margin-bottom: 0;}..#rt-logo {width: 320px;height
: 48px;display: block;}...rt-desc1 {font-size: 170%;display: block;fon
t-weight: bold;line-height: 1.1em;margin-bottom: 10px;margin-top: -10p
x;}...rt-desc2 {font-size: 120%;line-height: 1.4em;display: block;}...
rt-head-spacer {height: 12px;}...header-demo {width: 510px;height:
<<< skipped >>>

GET /components/com_jcomments/libraries/joomlatune/ajax.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164ec-f8a-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 3978

Connection: close

Content-Type: application/x-javascript
/* based on xajax Javascript library (hXXp://VVV.xajaxproject.org) */.
if (!window.jtajax) {..function jtAJAX().{..this.options = {url: '',ty
pe: 'post',nocache: true,data: ''};...this.$ = function(id) {if(!id){r
eturn null;}var o=document.getElementById(id);if(!o&&document.all){o=d
ocument.all[id];}return o;};..this.extend = function(o, e){for(var k i
n (e||{}))o[k]=e[k];return o;};..this.encode = function(t){return enco
deURIComponent(t);};..this.setup = function(options) {this.options = t
his.extend(this.options, options);};...this.xhr = function()..{...var 
xhr = null;...if ('undefined' != typeof XMLHttpRequest) xhr = new XMLH
ttpRequest();...if (!xhr && 'undefined' != typeof ActiveXObject) {....
var msxmlhttp = new Array('Msxml2.XMLHTTP.4.0','Msxml2.XMLHTTP.3.0','M
sxml2.XMLHTTP','Microsoft.XMLHTTP');....for (var i=0;i<msxmlhttp.le
ngth;i  ){try{xhr=new ActiveXObject(msxmlhttp[i]);}catch(e){xhr=null;}
}...}       ....return xhr;..};....this.form2query = function(sId)..{.
..var frm = this.$(sId);...if (frm && frm.tagName.toUpperCase() == 'FO
RM') {....var e = frm.elements, query = [];....for (var i=0; i < e.
length; i  ) {.....var name = e[i].name, value;.....if (!name) continu
e;.....if (e[i].type && ('radio' == e[i].type || 'checkbox' == e[i].ty
pe) && false === e[i].checked) continue;.....if ('select-multiple' == 
e[i].type) {......for (var j = 0; j < e[i].length; j  ) {.......if 
(true === e[i].options[j].selected)........query.push(name "=" this.en
code(e[i].options[j].value));......}.....} else { query.push(name 
<<< skipped >>>

GET /pagead/html/r20141209/r20141212/zrt_lookup.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

ETag: 8281997907193036559

Date: Thu, 01 Jan 2015 11:27:17 GMT

Expires: Thu, 15 Jan 2015 11:27:17 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 5099

X-XSS-Protection: 1; mode=block

Age: 489947

Cache-Control: public, max-age=1209600

Alternate-Protocol: 80:quic,p=0.002
...........;.w...... z}.UT..~..(.n.~l.6.t..^`sd[....mB....f$..@.{?.9..
....f<..q{...?....Yc....#..S.z.)..^[.yIp....Hr......2..<.q....s.
H.(..'....^LS..<]J....2?....#k...|......ic...4c.^......v!.qC...E...
.s..Ga.0.oc.g..}.{.....2_.1.8 ...{u..jx.......i.'.....<.....(.\....
...4....(..l...."GA..$^.=...x$;.q.O.M....i,.r.]...............38X.....
...E.a....$...}A.A.....Ix......FF.l..x.0...BZK(.....N......a. 2.<-e
>W.U....en>...8.X.......}....g/.....Etky..]..fMI.G7.%.iM...i...]
.i..9^A.w...yz.I......h6.....-.....T.i.(....8I.p~.q.T.Y#...?.|....M.&g
t;=...j..4.... J....;.s..G].9..G....T......'N......e......P.UL*m.A....
...4:....x.(.........p.u.Ij!x..c..4...A.\D...mY.<_d}g.....6..1l;...
0hY}.^.c...O..<..dle.0n<[email protected][& j.y..Jt.....Q.7.....J..~M
|.I...n...%M.....FtF.u.....$...})......#N.~..h.........6......._...8.m
cx!....21.G.g.hyZ...x..V j......x.IWro..Z#...lP.\^.}...S..H...).[F..&.
.2......=0........v[..z.8.c... ......k....6..."[email protected].&..*g.J=.K
[email protected]`..)..P1.NP7......1p.....2@..*"...N....GTQ...
...g.Y<[email protected] ...=...$..M....3..Y..X1#ZI...V..B.-......4...
.1w7..@..=...)(y.....l...ka.M...pohU.:CZa..!:..s..6...*[z...........#.
....n...1.........i..._>....N.Ac.....4..>.'.:......s.w6...^..?..
...-H.F.,o..;]ZxD.^.=.A;[email protected]@.4....D};..W['...O.>!...
...6g..a....n.`j..d...........=..........T~^.,..k.....Z.$.TXR......H..
".y....}.s.>.....k...0O..x.5...K.vTa9.8..._..h.....I..*|^..E.p.....
a...h._..V3...\P./.... ....Q.E..$..E8^r%.2....$..|x.,./..h..O.BGf.
<<< skipped >>>

GET /pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: cafe

Cache-Control: private

Content-Length: 30433

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
.............W.J.0.W..."].c.@.....[..IH..i-..e..2K...UUwkw...;o9w..K..
.....^.s.v.8r .h..X..].|X.{A......t.h.Z\...h\..C.w..7.....=..;l....3.Y
.j...a..F....t........G..w]7R*...D.C....k...{...0l....8.....y.#f......
........^...#.8..k.).......'...k.B..G,t..../.^...f.....yo.. ..}.t8`...
...1.k..Okc;....jg..Qo...... ..u{c.c.....L...SaF..*C...#.4-.^!.....q..
....!{.B7.....E1.y.....b...m...(.FCl........f3.........o...._AOl...[&.
u.r=? .d`.!..!.|7........vz..(s.............F.{.-...qa....?...L..s.wv[
...oi.8....aUI... S......L .A)..8.@@..f...5.k=.....E..5.Z..z...!.E.C].
..&.....;...'...V..~..N=SQx]....3.....p.]<..2E{~....*......=..))pp.
..%F..;...*...B...h.?.w.M6vU-.u.Z.^..........6_...oc...[8a.#N....}.L.P
.s.1........T...Q.2....-...?5....?.gC[l......[....N.lU...n..U....>.
...........0*3.?..>...i..e....HD'.*[email protected].....`....a...u..`.....
Y.....[...a...AGh>M.{....8....9../.U..T.-.1...|....F[.....{...m*..-
*....?..J0Pt[...?Z..,..'......,Y..``*....\.6Y.'Um^..p.o.A........9h...
Xc>.uH...t..f.....2.[[email protected].......*j....Z8.....I-<
;..R.O.T..R.."...P.NL-..X;3.E'O-.|............Zj.7.......C-...v.Z.....
k...?....j.Kja........n.....J$..J..._/. ..........s..9..#%...5.......6
.....8.A.I......'A..D..V0.......E.....Ry..N.....ny.um....wa`..#2.i..7.
]U...!.H.}..u'E.l...p.X..Z-....\...RDG.-..v.":Z..PD;O.1.6. ..i...A....
x:..{PI..'..~e..i.o.@c|..R.....0.. ....y..e...y..y..y..@./.zSo\..FP6b.
..g....{......k.'U.........!g&..H....X.,-....b.......~...)....n....^..
....fM.h...Y.q...>..0G...^3lLe~..X..v..q.R.p........ ..7.f<.
<<< skipped >>>

GET /pagead/drt/s?v=r20120211 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

X-Frame-Options: ALLOWALL

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 02:39:50 GMT

Server: safe

Content-Length: 145

X-XSS-Protection: 1; mode=block

Age: 3195

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002
..........%....0.Ew...]....h..F....x.$-....o..=..9..t..g{.Kwk.}..k]e.f
k....$...-...<o....RxzyZ...ML..bwX.).g.#..r..2....,U.....Q......M./
6PzR........


GET /pagead/drt/s?v=r20120211 HTTP/1.1