Trojan.Generic.11454451_6e1af1017e

by malwarelabrobot on August 2nd, 2014 in Malware Descriptions.

Trojan.Generic.11454451 (AdAware), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 6e1af1017ec3546c111e3e628485d2f1
SHA1: 73f003656144f60c04f30c3df90be37e7275d20d
SHA256: 7c4ff29863027e3a6cadd72cfa5d607ca01957763d00a8fd1ea22957ea21837e
SSDeep: 24576:aRevMp /Qlb VoDLhb/ZPPtKWMAEeazRjDRWbXxIZ:a8MpYYSVo/l/ZPPt/rEeaQI
Size: 1074000 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Exent Technologies Ltd.
Created at: 2008-08-20 16:51:24
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

FreeRideGames.e:608
GPlayer.exe:252
GPlayer.exe:1132
GPlayer.exe:1956
%original file name%.exe:860
Regsvr32.exe:1752
RegEdit.exe:936
RegEdit.exe:1584
setup.exe:908
Free Ride Games.exe:1756

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process FreeRideGames.e:608 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (11297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (4508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (6224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (14367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (42648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (157015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (0 bytes)

The process GPlayer.exe:252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\FreeRide Games\Info\4.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\3.clg (15349 bytes)

The process GPlayer.exe:1132 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\FreeRide Games\Info\6.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\5.clg (15349 bytes)

The process GPlayer.exe:1956 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\FreeRide Games\Info\1.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\2.clg (1093 bytes)

The process %original file name%.exe:860 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\Free Ride Games.exe (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (6389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\cmhelper.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\resourceDll.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\ExentCtlInstaller.dll (98 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (0 bytes)

The process setup.exe:908 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\FreeRide Games\setu20fe.rra (14400 bytes)
%Documents and Settings%\All Users\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgToa3a.rra (1 bytes)
%Program Files%\FreeRide Games\repo2b8.rra (364 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8b3.rra (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defafc30.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\cliec5d.rra (509 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13b0.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\mask\updae80.rra (96 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd519.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_865.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI410.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12a6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5c5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4fa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd43f.rra (4 bytes)
%Program Files%\FreeRide Games\cmhe2a8.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game140d.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1093.rra (2 bytes)
%Program Files%\FreeRide Games\Game25a.rra (65287 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd28.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1333.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data567.rra (31 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14aa.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb53.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e117d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\defa41f.rra (2 bytes)
%Program Files%\FreeRide Games\Data\vers316.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbe2.rra (3404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fb55.rra (7560 bytes)
%Program Files%\FreeRide Games\GPlr23b.rra (32516 bytes)
%Program Files%\FreeRide Games\npGa14e8.rra (13264 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\EXEt6ee.rra (843 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaac6.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd529.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (323 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\auto96f.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\myGac2e.rra (22 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main144c.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLad6.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm827.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos77b.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrtfc20.rra (8434 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc1e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_17f8.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu661.rra (2 bytes)
%System%\d3dx335.rra (32512 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14b9.rra (1 bytes)
%Program Files%\FreeRide Games\Repo299.rra (31560 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f29.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\logi9ad.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f58.rra (156954 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\debu3e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_76b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb690.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF} (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7b9.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logoa78.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13bf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1362.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb25.rra (17 bytes)
%Program Files%\FreeRide Games\glut1ce.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6de.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1313.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files%\FreeRide Games\Skin\icon\Exitaf5.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlafbe2.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaaa7.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dial97e.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1006.rra (2 bytes)
%Program Files%\FreeRide Games\Win815f2.rra (2334 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (21 bytes)
%Program Files%\FreeRide Games\wh_P2d7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos78a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topRa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8c3.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\mask\errod76.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\icon\faviaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd18.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs147b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascba.rra (16 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d112f.rra (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbb3.rra (6040 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info1304.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\erorbef.rra (8 bytes)
%Program Files%\FreeRide Games\Data\Loca335.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ea.rra (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbf2.rra (2104 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help7aa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bannf3b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos120a.rra (376 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec5a6.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\mg42f.rra (7 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\signd37.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\ISSe20ee.rra (10504 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe17f.rra (10504 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos613.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascca.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\mask\playdd4.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7e8.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\preRd37.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load1258.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dropc6c.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbc3.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\og_id09.rra (625 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1164 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada59.rra (2334 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo151.rra (515 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data160.rra (15968 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6cf.rra (2 bytes)
%Program Files%\FreeRide Games\frg-2e7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto558.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_2807.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a111f.rra (5 bytes)
%Program Files%\FreeRide Games\exs.ini (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\licefbc3.rra (9 bytes)
%Program Files%\FreeRide Games\AX322b8.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1239.rra (247 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd47d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\skin9dc.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlr9ec.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd50a.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan13cf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord1287.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\playd18.rra (729 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load142d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l11bc.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd49c.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_a98.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13a0.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\icon\Servb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_940.rra (13 bytes)
%Program Files%\FreeRide Games\ExentComponents.ini (1073 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12b6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca325.rra (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Strifc20.rra (2 bytes)
%Program Files%\FreeRide Games\FRGN383.rra (17 bytes)
%WinDir%\Downloaded Program Files\Exen354.rra (32172 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu213c.rra (4412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Fontfc01.rra (39 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1277.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\inde3a2.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\framcda.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm817.rra (1 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu215c.rra (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (4 bytes)
%Program Files%\FreeRide Games\Skin\Skin3a2.rra (352 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\0x041e7d.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLea2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim539.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC1381.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6bf.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6cf.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR14aa.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBoa1b.rra (1 bytes)
%Program Files%\FreeRide Games\Data\Loca325.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6fe.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\logicf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR149a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\md3f0.rra (383 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLae6.rra (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exsfbd2.rra (12834 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ1352.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_930.rra (12 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1612 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13bf.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4db.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlrb63.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m11cb.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid76.rra (96 bytes)
%Program Files%\FreeRide Games\lice2e7.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\switd57.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho587.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb43.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_a3b2.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Stri6fe.rra (11940 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_m3c2.rra (24 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm836.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10c2.rra (1 bytes)
%Program Files%\FreeRide Games\exs316.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI400.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlab63.rra (17 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu212d.rra (256 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\dl41f.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd48d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyGab82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun1248.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb16.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_884.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\errocab.rra (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGafbf2.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10d1.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_94f.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\layo20fe.rra (515 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec14d9.rra (807 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada69.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\mg_i9bd.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topLa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load141d.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa95f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca335.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\Mostbc0.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\sett9cc.rra (6 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x0418f.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5e4.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear146b.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o11db.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_875.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\fram99e.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g119c.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Sett393.rra (1 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu19f.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\icon\IAFb72.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corefc11.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dl_i98e.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regifbc3.rra (29 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\jquece9.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb15.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i11ac.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_d3c2.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott13df.rra (35 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\back5b6.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos623.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6b0.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto548.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\icon\Settb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb671.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\yesnd66.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Connad6.rra (296 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro98e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi10f1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd46d.rra (3 bytes)
%Program Files%\FreeRide Games\Clie393.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_1807.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb661.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1eac.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb34.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\mg_id09.rra (20 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\exs20df.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd45e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\pbc2e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi1248.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\icon\Tray383.rra (17 bytes)
%Program Files%\FreeRide Games\GPla1ce.rra (154846 bytes)
%Program Files%\FreeRide Games\X4HS1be.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_70d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc0f.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_75b.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\MyGabd0.rra (4298 bytes)
%Program Files%\FreeRide Games\report.ini (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\play1110.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\splad47.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos633.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1268.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ac.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e114e.rra (4 bytes)
%Program Files%\FreeRide Games\exs2f6.rra (12834 bytes)
%Program Files%\FreeRide Games\X4Ex1ae.rra (16732 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi1100.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g118d.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12c5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear147b.rra (10 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (807 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec596.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid86.rra (48 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu211d.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1371.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyDob82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\attaa0b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8d2.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12d5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Chanaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_855.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc71d.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\spla9dc.rra (2 bytes)
%Documents and Settings%\All Users\Desktop\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialbe0.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7d8.rra (3 bytes)
%Program Files%\FreeRide Games\3rdP2e7.rra (26 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_c3b2.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_846.rra (27 bytes)
%Program Files%\FreeRide Games\AppL2c8.rra (32102 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\tracd57.rra (7 bytes)
%Program Files%\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u11fa.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_p3d1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\GATrbc0.rra (2326 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4cb.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5f4.rra (2 bytes)
%Program Files%\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10b2.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help79a.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6b0.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxfc01.rra (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s11eb.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\og_i9bd.rra (1 bytes)
%Program Files%\FreeRide Games\exs306.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_74c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb05.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa96f.rra (2 bytes)
%Program Files%\FreeRide Games\Game289.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dl_ic5d.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb681.rra (2 bytes)
%Program Files%\FreeRide Games\npEx373.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g11ac.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_95f.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\botta49.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_07e8.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnfc11.rra (11 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu170.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\erroc9b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1219.rra (483 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu642.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\yesn9ec.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\Helpb72.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\AC_Rc4d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1323.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRia2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13fe.rra (181 bytes)
%Program Files%\FreeRide Games\myGa393.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip690.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_911.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Onlib82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Game3f0.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb24.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12e5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd44e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca326.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaab7.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\key_cf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flasa59.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro99e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_901.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Spla3f0.rra (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exsfd97.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\logi3e1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8f2.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6a0.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu652.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8e2.rra (22 bytes)
%Program Files%\FreeRide Games\DoDl306.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc73c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pids42f.rra (58 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8a4.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retra78.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isrfc30.rra (18974 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e113f.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\iconbef.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo143c.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_921.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\spacc3d.rra (49 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5d5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6ee.rra (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlayer.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isres_0x0409.dll (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnetinstaller.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\StringTable_0x0409.ips (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_toolbar.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corecomp.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\license.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\default.pal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_toolbar_w_homepage.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.inx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\RegistryValues.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxData.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGameTreatPlugin.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FontData.ini (0 bytes)

The process Free Ride Games.exe:1756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\header[1].jpg (4881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (18524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].html (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[1].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\beacon[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_PROGRESS[1].htm (2073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Exent\GI20140801150510GMT.Log (28 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (1286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDMLog.log (2605139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[3].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion3[1].gif (24079 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (223946 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (3017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDM_DB_148.xml (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_HEADER2[1].css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion4[1].jpg (23149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\13[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\header[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\conversionTracking[1].htm (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].htm (1155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion2[1].jpg (23210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion1[1].jpg (19117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\boxshot_sm[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsdm.bat (175 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

Registry activity

The process FreeRideGames.e:608 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 1F 2A 34 BE 0B 98 48 E9 BF 2B E9 72 C0 7F 12"

The process GPlayer.exe:252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"RTyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"ErrorID" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"PlayTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"filepath" = "%Program Files%\FreeRide Games\Info\4.clg"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "3"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"STyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"STyp" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 5F B3 71 2C EC 9A B0 35 E8 47 58 74 B3 B0 74"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"PlayTime" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"filepath" = "%Program Files%\FreeRide Games\Info\3.clg"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process GPlayer.exe:1132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"RTyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"filepath" = "%Program Files%\FreeRide Games\Info\5.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"PlayTime" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"STyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"TicketID" = "1204111893"
"PlayTime" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"filepath" = "%Program Files%\FreeRide Games\Info\6.clg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "5"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"RTyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"TargetURL" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 7A 83 48 C7 A8 5E 0E 54 52 6B 25 92 D9 0E 5A"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"STyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process GPlayer.exe:1956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"RTyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"RecoverSendFilesCount" = "3"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"TargetURL" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"PlayTime" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"STyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"filepath" = "%Program Files%\FreeRide Games\Info\2.clg"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"filepath" = "%Program Files%\FreeRide Games\Info\1.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"PlayTime" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"RTyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"ErrorID" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 A7 6B 5E 45 8F 27 80 EF 47 8F F2 90 55 C8 58"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"MaxFilesCount" = "16"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:860 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 BE B3 71 50 9E 69 7B 1C A2 D5 4F F3 A1 37 51"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsep.bat" = "_uninsep"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148]
"Free Ride Games.exe" = "FreeRideGames Application"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Regsvr32.exe:1752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 F5 81 E2 FB 95 40 D4 EC 03 2D 38 15 6C C4 0C"

[HKLM\System\CurrentControlSet\Control\WOW]
"DefaultSeparateVDM" = "yes"

The process RegEdit.exe:936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}]
"(Default)" = "Game Treat Widget"

[HKCR\AppID\{B415CD14-B45D-4BCA-B552-B06175C38606}]
"(Default)" = "FireBreathWin"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\ProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\VersionIndependentProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"Extension" = ""

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\Version]
"(Default)" = "1"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"(Default)" = "Game Treat Widget"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}]
"(Default)" = "IFBComEventSource"

[HKCR\GameTreatWidget.GameTreatWidget\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\GameTreatWidget.GameTreatWidget\CurVer]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}]
"(Default)" = "IFBComJavascriptObject"

[HKCR\GameTreatWidget.GameTreatWidget.1]
"(Default)" = "Game Treat Widget"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"CLSID" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}]
"(Default)" = "IFBControl"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus]
"(Default)" = "0"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\GameTreatWidget.GameTreatWidget.1\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"Version" = "1.0"

[HKCR\AppID\npGameTreatWidget.dll]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 63 2B C2 2A B8 03 3C 7C 11 45 1E BF 68 76 0B"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"

[HKCR\GameTreatWidget.GameTreatWidget]
"(Default)" = "Game Treat Widget"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\iexplore\AllowedDomains\*]
"Count" = "0"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0]
"(Default)" = "GameTreatWidget 1.0 Type Library"

The process RegEdit.exe:1584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"Value" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"Value" = "30000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"IsReadOnly" = "1"
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"Value" = "1800"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"Value" = "old"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"Value" = "http://beta.freeridegames.com/messages/rss/"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"Value" = "Default"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"Value" = "default"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"Value" = "advoyris"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"Value" = "86400000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"Value" = "60000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"Value" = "168,86400"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"Value" = "30000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"Value" = "2"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"Value" = "193"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"Value" = "1000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 63 68 6E 48 F7 A9 D5 50 C8 CD 97 B1 C2 3A CA"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"Value" = "http://beta.freeridegames.com/messages/contentpush/"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastSuccessfulErrURL" = "http://player.freeridegames.com/opTools/errorReport.jsp"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsReadOnly" = "1"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"RunPlayerOnStartUp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"Value" = "ON(143_CAMPAIGN_SERIAL_ID)ON(143_TURNKEY)ON(143_FIRST_BROWSER)NN(143_CAMPAIGN_PERFORMED_CONVERSIONS)NN(143_DAYS_PLAYED)NN(143_REACTIVATION_ID)NN(143_GAG)NN(143_UDOM)"
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"Value" = "player.freeridegames.com"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"Value" = "360"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"IsVisible" = "1"
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"Value" = "117802240"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"Value" = "20000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"Value" = "player.freeridegames.com"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"Value" = "10"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"Value" = "http://player.freeridegames.com/do/PlayerUpdateInfo"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"Value" = "4320"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"Value" = "http://player.freeridegames.com/opTools/clientReport.jsp?theme=Home"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"Value" = "1800"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"Value" = "168,43200"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"Value" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"Value" = "http://player.freeridegames.com/check.jsp"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingLastState" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"Value" = "1440"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"Value" = "http://player.freeridegames.com/do/gameInfo?contentId=%GAME_ID%"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsVisible" = "0"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingEnable" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsVisible" = "1"

The process setup.exe:908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Version" = "16777219"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus\1]
"(Default)" = "132497"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"Installer" = "MSICD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc" = "Completed"

[HKCR\ExentControl.ExentInf1.1]
"(Default)" = "ExentInf1 Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = ""

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\HELPDIR]
"(Default)" = "%WinDir%\Downloaded Program Files"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}]
"(Default)" = "IExentCtlStub"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ProductGUID" = "{6C26A305-4549-4A8A-9F03-25719C03B0FB}"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148]
"BinPath" = "%Program Files%\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\DownloadInformation]
"CodeBase" = ""

[HKCU\Software\AppDataLow\Software\ExentControl]
"runInstallFlag" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\MozillaPlugins\www.exent.com/GameTreatWidget]
"Path" = "%Program Files%\FreeRide Games\NPGameTreatPlugin.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Keep Free Space" = "50"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\0\win32]
"(Default)" = "%Program Files%\FreeRide Games\npGameTreatWidget.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair" = "1"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}]
"(Default)" = "_IExentInfEvents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"VersionMajor" = "1"
"URLInfoAbout" = "www.exent.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentStub"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\HELPDIR]
"(Default)" = "%Program Files%\FreeRide Games"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"LogMode" = "1"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"

[HKCR\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls safely initializable from persistent data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}]
"(Default)" = "IExentInf"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Version]
"(Default)" = "1.1"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus]
"(Default)" = "0"

[HKCR\ExentControl.ExentStub\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ProgID]
"(Default)" = "ExentControl.ExentInf1.1"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallLocation" = "%Program Files%\FreeRide Games"
"Publisher" = "Exent Technologies"
"InstallSource" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\pft3.tmp\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\%WinDir%\Downloaded Program Files]
"ExentControl.ocx" = "1"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1]
"(Default)" = "ExentControl 1.1 Type Library"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"(Default)" = "%Program Files%\FreeRide Games\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Contains\Files\%WinDir%\Downloaded Program Files]
"ExentControl.ocx" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallString" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409 -removeonly"
"NoModify" = "1"
"VersionMinor" = "0"

[HKCR\ExentControl.ExentStub.1]
"(Default)" = "ExentStub Class"

[HKCR\ExentControl.ExentInf1]
"(Default)" = "ExentInf1 Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"Path" = "%Program Files%\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = "ExentStub Class"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"(Default)" = "07,02,00,07"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayName" = "FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"LastModified" = "Wed, 20 Jun 2012 05:42:12 GMT"

[HKCR\exent\shell\open\command]
"(Default)" = "%Program Files%\FreeRide Games\Win8Launcher.exe %1"

[HKCR\ExentControl.ExentStub]
"(Default)" = "ExentStub Class"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"Version" = "1.1"

[HKCR\ExentControl.ExentInf1\CurVer]
"(Default)" = "ExentControl.ExentInf1.1"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"Version" = "1.1"

[HKCR\ExentControl.ExentStub\CurVer]
"(Default)" = "ExentControl.ExentStub.1"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\0\win32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayVersion" = "1.00.0003"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"RegOwner" = "XP1"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\TypeLib]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCR\ExentControl.ExentStub.1\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Size" = "3927"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppPath" = "%Program Files%\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallStringOriginal" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Setup.exe -runfromtemp"
"RegCompany" = "Malware"

[HKCR\ExentControl.ExentInf1.1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ToolboxBitmap32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx, 101"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"Version" = "1.1"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\ProgID]
"(Default)" = "ExentControl.ExentStub.1"

[HKCR\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls that are safely scriptable"

[HKCR\ExentControl.ExentInf1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = "ExentInf1 Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ExentControl.ocx]
"{4FF78044-96B4-4312-A5B7-FDA3CB328095}" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRemove" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 4A 30 F3 B4 C9 FE 87 4A 16 F8 07 D5 A0 10 3A"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"Progress" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Language" = "1033"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallDate" = "20140801"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Games Dir" = "Remote Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayIcon" = "%Program Files%\FreeRide Games\myGames.ico"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"(Default)" = "%Program Files%\FreeRide Games\npGameTreatWidget.dll"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentInf1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ModifyPath" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409"
"LogFile" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ilg"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"SystemComponent" = "0"

[HKCR\exent]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ExentControl.ocx]
".Owner" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\MozillaPlugins\@exent.com/npExentControl,version=7.1.0.1]
"Path" = "%Program Files%\FreeRide Games\npExentControl.dll"

[HKCR\exent]
"(Default)" = "URL:Exent Protocol"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppName" = "GPlayer.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent Technologies]
[HKLM\SOFTWARE\Exent Technologies\FreeRide Games]
[HKLM\SOFTWARE\Exent Technologies\FreeRide Games\1.00.0003]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MinorVersion"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MajorVersion"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ExtResponse"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoModify"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair"
"NoRemove"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"
"Progress"

The process Free Ride Games.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014080120140802\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CacheOptions" = "11"
"CacheRepair" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
"ResumePage" = "index.html#PageId=SDM_PROGRESS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"Free Ride Games.exe" = "10"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148]
"FreeRideGames.exe" = "EXEtender Player"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9216" = "My Computer"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsdm.bat" = "_uninsdm"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 2D 79 01 C9 4E B5 0D 18 D3 F7 41 D9 C8 C5 53"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CachePrefix" = ":2014080120140802:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '595450'"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM"

Dropped PE files

MD5 File path
0f5522184e9ab86f640b6cb1df65ed9f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\ExentCtlInstaller.dll
073aed8b0f5e6be312410ba6f61c452b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\Free Ride Games.exe
35582cf9713985c9b746e8544c792d9c c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\FreeRideGames.exe
72ef2d24d0efd50633e348426acb452f c:\Program Files\FreeRide Games\AX32.dll
b3c69f6569b3ddf8f90e0fe882981a5d c:\Program Files\FreeRide Games\AppLoader2KEx.dll
3645930301faace148be2813e8ce7977 c:\Program Files\FreeRide Games\DoDlg.exe
112811fe88dc3437ba8e731209f66465 c:\Program Files\FreeRide Games\GPlayer.exe
e440493ee5b307736dbcccab3b6d4bd5 c:\Program Files\FreeRide Games\GPlrLanc.exe
9373af11b046df0de7cd437ad2e99638 c:\Program Files\FreeRide Games\GameInst.dll
f1ec77deb12d8637c010ee26e1a28e0d c:\Program Files\FreeRide Games\GameLauncher.exe
d2e90286b623106bf283749f49b496f1 c:\Program Files\FreeRide Games\Report.exe
549d2f6d72267e727ed29baef05aa68b c:\Program Files\FreeRide Games\X4Ex_Pr148.sys
51b3cc1f1a2762f31ac35560a1de9004 c:\Program Files\FreeRide Games\X4HSEx_Pr148.sys
ae81517636a17218e6fed6116452ccbc c:\Program Files\FreeRide Games\cmhelper.exe
d5783da0f964882bc555a83da5e2bad5 c:\Program Files\FreeRide Games\exs.dll
55c38709c3c879b2d0fa24f751d2c824 c:\Program Files\FreeRide Games\glutil.dll
c330e3f40bb38bcb04e4743407c8b6c9 c:\Program Files\FreeRide Games\npExentControl.dll
9bc0902f50e58167b4b778ef6f1b1103 c:\Program Files\FreeRide Games\wh_Pr148.dll
1bf0fc52d41be3f3c1025b3971bc49a0 c:\Program Files\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSetup.dll
9afff8eae9918d5051b52eb432d6dac0 c:\Program Files\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe
7ac9b56c15369c1c950d32e9084b9dde c:\WINDOWS\Downloaded Program Files\ExentControl.ocx
39c858645cbf37b83bc907e188f8bc85 c:\WINDOWS\system32\d3dx9_32.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Exent Technologies Ltd.
Product Name: ExentCtl Module
Product Version: 07.02.00.01
Legal Copyright: Copyright (c) 1996-2007 Exent Technologies Ltd. All rights reserved.
Legal Trademarks:
Original Filename: ExentCtl.ocx
Internal Name: ExentCtl
File Version: 07.02.00.01
File Description: ExentCtl Module
Comments: Release.
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 67586 69632 4.53151 13d4df63a29071e604d09a6768d2e641
.rdata 73728 9413 12288 2.89315 1aae2e1490b0b801344569bed4d29505
.data 86016 19400 16384 0.903431 b02c7e2c998cd8ec273626efa37333f3
.rsrc 106496 963096 966656 5.36094 fd039aa7373d1f9040955ed82095602e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=595450
hxxp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://a1507.b.akamai.net/free/frg/products/595450/boxshot_sm.jpg
hxxp://a1697.b.akamai.net/FRG_site/downloads/geo/en/Exetender_Default.exe
hxxp://e8296.g.akamaiedge.net/check.jsp
hxxp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450
hxxp://a1697.b.akamai.net/freeride_marketing/SDM/SDM_standard/header.html
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/js/defines.js
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
hxxp://e54.g.akamaiedge.net/meter/www.freeridegames.com/13.gif
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/img/header.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/js/defines.js
hxxp://a1294.w20.akamai.net/beacon.js
hxxp://a1294.w20.akamai.net/b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
hxxp://a1294.w20.akamai.net/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/do/gateway?sId=Default
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationstart
hxxp://player.freeridegames.com/do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationfinished
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://a1697.b.akamai.net/my_games?gameId=595450
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp
hxxp://a1697.b.akamai.net/static/marketing/main/css/main.css?version=38
hxxp://player.freeridegames.com/do/gatewayCD?sId=&subId=&actid=&callback=updateClientCookies&_=1406905525155
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38
hxxp://a1697.b.akamai.net/static/marketing/main/css/templates.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/gamebox.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/sprite_sheet.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/hover_elements_sheet.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/tinybox.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/download_assist.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot?
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38
hxxp://a1697.b.akamai.net/static/marketing/header/css/header.css
hxxp://a1697.b.akamai.net/static/marketing/main/img/background_pixel.jpg
hxxp://www-google-analytics.l.google.com/js/plusone.js
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js
hxxp://a1697.b.akamai.net/static/marketing/header/js/header.js
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38
hxxp://a1697.b.akamai.net/static/marketing/header/img/ui_elements.png
hxxp://a1697.b.akamai.net/static/marketing/header/img/logo.png
hxxp://a1697.b.akamai.net/static/marketing/header/img/icons.png
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_left_rib.jpg
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/oDB-fAAStWy.js?version=41
hxxp://a1507.b.akamai.net/free/frg/products/450950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/554350/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_right_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_pagenation_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_left_rib.jpg
hxxp://a1507.b.akamai.net/free/frg/products/616550/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_right_rib.jpg
hxxp://a1507.b.akamai.net/free/frg/products/661050/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_pagenation_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/footer/css/footer.css
hxxp://a1507.b.akamai.net/free/frg/products/608450/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/sprite_sheet.png
hxxp://a1507.b.akamai.net/free/frg/products/680950/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels.jpg
hxxp://a1507.b.akamai.net/free/frg/products/631850/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels_rib.jpg
hxxp://star.c10r.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_top_rib.jpg
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png
hxxp://a1507.b.akamai.net/free/frg/products/558350/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/green_btn_28_mid.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_corners.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_bottom_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_top_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_corners.jpg
hxxp://a1507.b.akamai.net/free/frg/products/645050/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/575350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/616950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/761850/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/589550/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/582150/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/571950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/710650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/619350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/643650/boxshot.jpg
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user
hxxp://a1697.b.akamai.net/static/marketing/main/img/hover_elements_sheet.png
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_bottom_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/preload.gif
hxxp://a1697.b.akamai.net/static/marketing/footer/img/footer_pixel.jpg
hxxp://a1507.b.akamai.net/free/frg/products/563750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/633350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/668950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/667850/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/624150/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/632750/boxshot.jpg
hxxp://a1697.b.akamai.net/action/JSONService
hxxp://a1507.b.akamai.net/free/frg/products/663350/boxshot.jpg
hxxp://stats.l.doubleclick.net/dc.js
hxxp://player.freeridegames.com/do/gateway?sId=&subId=&actid=&udom=partners.freeridegames.com
hxxp://a1507.b.akamai.net/free/frg/products/524350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/674750/boxshot.jpg
hxxp://www-googletagmanager.l.google.com/gtm.js?id=GTM-MJF4W9
hxxp://a749.dsw4.akamai.net/rsrc.php/v2/y7/r/j0a7CRWp-Sa.js
hxxp://a1294.w20.akamai.net/rsrc.php/v2/y1/r/LVx-xkvaJ0b.png
hxxp://a1507.b.akamai.net/free/frg/products/719950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/642550/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/765950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/559350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/699950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/701650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/748750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/766250/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/578250/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/521350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/661650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/764350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/735250/boxshot.jpg
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftRootAuthority.crl
hxxp://a1363.g.akamai.net/pki/crl/products/MicWinHarComPCA_2010-11-01.crl
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/img/header.jpg 184.84.180.16
hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe 63.85.36.72
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html 184.84.180.16
hxxp://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41 23.15.4.18
hxxp://partners.freeridegames.com/static/marketing/main/img/background_pixel.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/554350/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 184.84.180.32
hxxp://b.scorecardresearch.com/beacon.js 23.15.4.18
hxxp://img.exent.com/free/frg/products/699950/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels_rib.jpg 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/css/main.css?version=38 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 184.84.180.32
hxxp://b.scorecardresearch.com/b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= 23.15.4.18
hxxp://img.exent.com/free/frg/products/616550/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/766250/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/sprite_sheet.css 184.84.180.32
hxxp://static.ak.fbcdn.net/rsrc.php/v2/y1/r/LVx-xkvaJ0b.png 23.15.4.18
hxxp://partners.freeridegames.com/my_games?gameId=595450 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_corners.jpg 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_bottom_rib.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/608450/boxshot.jpg 184.84.180.59
hxxp://stats.g.doubleclick.net/dc.js
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_right_rib.jpg 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_top_rib.jpg 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 184.84.180.32
hxxp://img.exent.com/free/frg/products/642550/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/hover_elements_sheet.png 184.84.180.32
hxxp://img.exent.com/free/frg/products/748750/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/571950/boxshot.jpg 184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg 184.84.180.16
hxxp://img.exent.com/free/frg/products/661650/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels.jpg 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/img/logo.png 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/img/ui_elements.png 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 184.84.180.32
hxxp://img.exent.com/free/frg/products/643650/boxshot.jpg 184.84.180.59
hxxp://apis.google.com/js/plusone.js
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 184.84.180.32
hxxp://img.exent.com/free/frg/products/589550/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/761850/boxshot.jpg 184.84.180.59
hxxp://images.scanalert.com/meter/www.freeridegames.com/13.gif 23.194.144.80
hxxp://img.exent.com/free/frg/products/663350/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/631850/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css 184.84.180.16
hxxp://partners.freeridegames.com/static/marketing/main/css/hover_elements_sheet.css 184.84.180.32
hxxp://img.exent.com/free/frg/products/633350/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/download_assist.css 184.84.180.32
hxxp://img.exent.com/free/frg/products/735250/boxshot.jpg 184.84.180.59
hxxp://www.googletagmanager.com/gtm.js?id=GTM-MJF4W9 74.125.226.62
hxxp://partners.freeridegames.com/static/marketing/footer/css/footer.css 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_right_rib.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/624150/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif 184.84.180.16
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 184.84.180.32
hxxp://www.freeridegames.com/check.jsp 23.60.129.154
hxxp://img.exent.com/free/frg/products/668950/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 184.84.180.32
hxxp://img.exent.com/free/frg/products/719950/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/616950/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/524350/boxshot.jpg 184.84.180.59
hxxp://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user 23.15.4.18
hxxp://img.exent.com/free/frg/products/563750/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/575350/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/674750/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_left_rib.jpg 184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg 184.84.180.16
hxxp://b.static.ak.fbcdn.net/rsrc.php/v2/y7/r/j0a7CRWp-Sa.js 23.15.4.16
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 184.84.180.32
hxxp://connect.facebook.net/en_US/all.js
hxxp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html 63.85.36.72
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_corners.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/680950/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/701650/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/header/js/header.js 184.84.180.32
hxxp://img.exent.com/free/frg/products/645050/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/gamebox.css 184.84.180.32
hxxp://img.exent.com/free/frg/products/521350/boxshot.jpg 184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/js/defines.js 184.84.180.16
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_pagenation_rib.jpg 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/sprite_sheet.png 184.84.180.32
hxxp://www.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 31.13.74.49
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_pagenation_rib.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/710650/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/img/icons.png 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/green_btn_28_mid.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/632750/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/tinybox.css 184.84.180.32
hxxp://img.exent.com/free/frg/products/595450/boxshot_sm.jpg 184.84.180.59
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl 23.15.4.8
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/preload.gif 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/css/header.css 184.84.180.32
hxxp://img.exent.com/free/frg/products/578250/boxshot.jpg 184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css 184.84.180.16
hxxp://partners.freeridegames.com/static/marketing/footer/img/footer_pixel.jpg 184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/js/defines.js 184.84.180.16
hxxp://partners.freeridegames.com/action/JSONService 184.84.180.32
hxxp://b.scorecardresearch.com/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= 23.15.4.18
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png 184.84.180.32
hxxp://img.exent.com/free/frg/products/559350/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/558350/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/450950/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_top_rib.jpg 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/css/templates.css 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css 184.84.180.16
hxxp://img.exent.com/free/frg/products/582150/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_bottom_rib.jpg 184.84.180.32
hxxp://img.exent.com/free/frg/products/667850/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/765950/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/619350/boxshot.jpg 184.84.180.59
hxxp://img.exent.com/free/frg/products/661050/boxshot.jpg 184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg 184.84.180.16
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp 184.84.180.32
hxxp://img.exent.com/free/frg/products/764350/boxshot.jpg 184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_left_rib.jpg 184.84.180.32
s-static.ak.facebook.com 23.209.49.33


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY FreeRide Games Some AVs report as TrojWare.Win32.Trojan.Agent.Gen
ET TROJAN Suspicious HTTP Referrer C Drive Path

Traffic

HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:12 GMT
Connection: keep-alive



GET /connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: static.ak.facebook.com


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Encoding: gzip
X-FB-Debug: ZB 50aMstmsTvc/Q8Bzyb3YkyXotkTC nMtFOpOrjd9HqCdP06SGvCzueP0UYwZvOqczfcXu59vy W3jNMO3Uw==
Vary: Accept-Encoding
Content-Length: 9227
Cache-Control: public, max-age=30665883
Expires: Wed, 22 Jul 2015 13:23:26 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
...........}.z.F...<......")/.1........mlg........D,....H.g.U......
..-...Z]U][.........../..........yQ.E./_1...tj...<?.).Y.Xoy..I.L..G
3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad
..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'.
.zz..w8Ys..=X.?.T<vz[...Re..S.8.....g..p....fsvN.....5..4s.-..06...
[email protected]:.`r[.....ta%|a}...Y.....e........dR.nH.....Ho..'
...E.k6'[email protected].$..."(p'..\O..8. ..%..r.|ga.DX.x:6b..<#....D.r
[email protected]`Ep..T.qDnZ.y. ...]7G...x.".K...&h......b..)V..BXe.l.6..
..W).{R.l...n.N.Q..3.....l....OcN...w.....jj.<..0......).Y......x..
...E...t"`../.F.;..vz*.m<.(.4h....#.F,/^K`6...q..f..q.......<..X
.\..z..L.O......R...Wb..,.A.6H.F... .\^^...LH....(.wP...P<.k..$.B..
a..._....A..4.....;9 ...w=...gg....;.Y.8..... ."Z3...}...5l...K\.....V
......=.r.q.i..Z....<B.C2.&^...\....Y...#.,..H>d)X.....I.%..d-9.
....)v......)... .z........G."$.. .!..EX..n HX.,[email protected].
....K.9;..G.-.Q....'V.V........z..X............y4n]_.......|.l:r.Wj,..
#...Hy........j.....x....[(..o...G....X.{.-.=...SF...{N*..;Z..........
.`..0.J|.Zl6.V...,....}0......\....W#...x..A0..;.Z.......Mgd.o6.V"..sE
`..M]...W.U.Xvs.4....7..:....wb........LC.....0.W....sSNqsq...;v..{#,i
EW.r.....7..`..O.I...2<..Q.<(JB.>......W.(.'g`.4.3.....m...T.
.......w*....\.tw...y...}.@}_....&...[9P{k}7.G<./.1M#...BN.'(..Nh..
.........:.3qy.................N.;..1.>..xx$.~.....a...;.c.\......L
6.4.K.by>.,.2..g....}.,9...# ..~]{P...o.q...X...6....6.]......[
<<< skipped >>>


GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.fbcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-MD5: mQCwCAAKHD AV8oddNLhdw==
Content-Type: image/png
Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=
Content-Length: 1329
Cache-Control: public, max-age=16118759
Expires: Wed, 04 Feb 2015 04:31:23 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...
Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e
.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]
........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8....
..Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(....
....(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.T
d....([email protected]....."..'..i...u\.........../.A:b.r.P...J..m....~..
.2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<
;........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....D
x..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}....
...ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP
..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg
..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&..........
...[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......
Z..nnnf...X..E.<[email protected]".Mq...[..j8..8ja.<......e.Q.
.^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..
#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!......
 .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......
N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U
..U..(...;.Mu..I.....IEND.B`...
<<< skipped >>>


GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.fbcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-MD5: mQCwCAAKHD AV8oddNLhdw==
Content-Type: image/png
Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=
Content-Length: 1329
Cache-Control: public, max-age=16118759
Expires: Wed, 04 Feb 2015 04:31:23 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...
Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e
.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]
........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8....
..Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(....
....(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.T
d....([email protected]....."..'..i...u\.........../.A:b.r.P...J..m....~..
.2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<
;........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....D
x..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}....
...ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP
..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg
..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&..........
...[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......
Z..nnnf...X..E.<[email protected]".Mq...[..j8..8ja.<......e.Q.
.^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..
#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!......
 .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......
N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U
..U..(...;.Mu..I.....IEND.B`...
<<< skipped >>>


GET /do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=595450 HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily
Date: Fri, 01 Aug 2014 15:04:00 GMT
Server: Apache
Set-Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; Path=/; HttpOnly
Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_TURNKEY=Default-641406905440442383; Expires=Sat, 01-Aug-2015 15:04:00 GMT; Path=/
Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:04:00 GMT; Path=/
Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:04:00 GMT; Path=/
Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:04:00 GMT; Path=/
Location: hXXp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html
....


GET /do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB HTTP/1.1


User-Agent: AHTTPConnection
Host: player.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:00 GMT
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
7f9..<?xml version="1.0" encoding="utf-8"?><Response><C
ontentConfiguration id="595450"><IS><Url>hXXp://dts1.fr
eeridegames.com/FRG_site/downloads/geo/en/Exetender.exe</Url><
;AddOns><Param><ID>""</ID><Name>noaddons<
;/Name><Priority>0</Priority><Checked>false</C
hecked><Dependencies/></Param></AddOns><Comman
dLine/></IS><SDMVersion>1.0.0.22</SDMVersion><
PromotionUrl>hXXp://player.freeridegames.com/product/SDM/SDM_standa
rd</PromotionUrl><ReportUrl>hXXp://player.freeridegames.co
m/opTools/clientTracking.jsp</ReportUrl><ConversionUrl>htt
p://player.freeridegames.com/do/conversionTracking</ConversionUrl&g
t;<PartnerName>Default</PartnerName><ProviderId>148&
lt;/ProviderId><ProviderName>FreeRideGames</ProviderName&g
t;<ClientVersion>7.2.0.0</ClientVersion><EULAUrl>htt
p://player.freeridegames.com/do/general?Partner=Default&jspName=li
censeAgreement</EULAUrl><ImgServerUrl>hXXp://img.exent.com
/free/frg</ImgServerUrl><HeaderUrl>hXXp://dts1.freeridegam
es.com/freeride_marketing/SDM/SDM_standard/header.html</HeaderUrl&g
t;<MyGamesUrl>hXXp://partners.freeridegames.com/my_games?gameId=
%GAME_ID%</MyGamesUrl><StartPageId>SDM_EULA</StartPageI
d><Type>EN_NO_TB</Type><Game><Id>595450<
/Id><Name><![CDATA[The Secret of Margrave Manor]]>&
<<< skipped >>>

POST /opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1


User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:00 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=798
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:00 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=798..Connection: Keep-Alive..Conten
t-Type: text/html......


POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hXXp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1


User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:01 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=797
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:01 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=797..Connection: Keep-Alive..Conten
t-Type: text/html......


GET /product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:02 GMT
Server: Apache
Last-Modified: Wed, 13 Apr 2011 11:32:31 GMT
ETag: "300000000521b-236c-4a0cb2a10245c"
Accept-Ranges: bytes
Content-Length: 9068
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=796
Connection: Keep-Alive
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.
.<html>..<head>..<title>Progress</title>..<
!-- <link rel="stylesheet" type="text/css" href="css/SDM_PROGRESS.c
ss"> -->..<!-- <script  type="text/javascript" src="js/def
ines.js"></script> -->..<link rel="stylesheet" type="te
xt/css" href="hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard
/css/SDM_PROGRESS.css">..<script  type="text/javascript" src="ht
tp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/js/defines.js"&
gt;</script>..<script language="JavaScript" type="text/javasc
ript">..function checkIframeSize(){..<!--...var viewportwidth;..
.var viewportheight;... // the more standards compliant browsers (mozi
lla/netscape/opera/IE7) use window.innerWidth and window.innerHeight..
. ... if (typeof window.innerWidth != 'undefined')... {.....viewportwi
dth = window.innerWidth,.....viewportheight = window.innerHeight... }.
.. ...// IE6 in standards compliant mode (i.e. with a valid doctype as
 the first line in the document)...... else if (typeof document.docume
ntElement != 'undefined'....  && typeof document.documentElement.clien
tWidth !=....  'undefined' && document.documentElement.clientWidth != 
0)... {..... viewportwidth = document.documentElement.clientWidth,....
. viewportheight = document.documentElement.clientHeight... }... ... /
/ older versions of IE... ... else... {..... viewportwidth = document.
getElementsByTagName('body')[0].clientWidth,..... viewportheight =
<<< skipped >>>


GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.fbcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-MD5: mQCwCAAKHD AV8oddNLhdw==
Content-Type: image/png
Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=
Content-Length: 1329
Cache-Control: public, max-age=16118759
Expires: Wed, 04 Feb 2015 04:31:23 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...
Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e
.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]
........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8....
..Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(....
....(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.T
d....([email protected]....."..'..i...u\.........../.A:b.r.P...J..m....~..
.2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<
;........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....D
x..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}....
...ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP
..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg
..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&..........
...[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......
Z..nnnf...X..E.<[email protected]".Mq...[..j8..8ja.<......e.Q.
.^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..
#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!......
 .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......
N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U
..U..(...;.Mu..I.....IEND.B`...
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:33 GMT
Connection: keep-alive



GET /free/frg/products/589550/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 19 Apr 2009 06:44:48 GMT
Content-Type: image/jpeg
Content-Length: 26276
Accept-Ranges: bytes
X-Varnish: 1111897187
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
..............!1...AQ"a2#.q.BR....b3C....S$T...4%5..r.s.DdtE.&........
...............!1..AQaq".......2..BRb#...r.3......c$..CSs45...........
..?.p.re...`..............l.R......?..._........|.Q..y..l.V..S......9S
.U..."..>.u.....V.*..WJW%.cMa....J..Bh.....H?j.jI......Q. RPn....5*
'..3.P.l..o....LBN."..G..<[email protected].<
.uUU^...UW.\J..fD....7=..(....q....h......W..z .M*.v9T.E.....#......&g
t;.j..H..c...q.I..).H..k........z.............x...7l..'S......:.._c...
U...{...W0.QV...h.q.....i*.r..rG..m%..Y\...&.^T.H..B,....".....*.sm.g.
...B..Q.....e....ch.....3.A.\..........2=\*.k.D.2K.....2O.E...*..zr]..
.D..~W...o........1k........y.).....vA..|.b.lC.|TEL.T.k."...N2.....o..
a.a.wQGN..8\..\..^..T.vV,...a.X.....h!#._1.Q.Tw.wN......:9...W.?t..l!.
..=.1...2.. .S..../i (.....~..\n.2...j..Qf......h..B....d.g...0Z...i.4
..t>K..4^-.01.DZ.Q..e..D.D.:....I..Z.<....."..h....Mu..P.)c..h..
.N.SQ]n ....~.E_........YM..|.sutt...g.s0....]7y. ....""|W..t.V..O....
...r..g.....=$.N.2.5...DW.>]7.....].U*.....2.......c.\*U$.0~>...
...."..g..h.T....v..5.......59I...K..N../......J..U].. ...q..Eh..,s.l.
%..!.=-.M4....*/....[v.|.K.Z...o.G,..cd'...l./,?.... C3)..N...k..."...
'.x....U.34..M|t.......!.6.:.4...d..{....j.1..*..Y.}OE{: W..ya.^/Q
<<< skipped >>>

GET /free/frg/products/582150/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 26 Jun 2013 10:47:21 GMT
Content-Type: image/jpeg
Content-Length: 38149
Accept-Ranges: bytes
X-Varnish: 1111897231 1111052407
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6F9A17903439E2119
55FE55656C7D978" xmpMM:DocumentID="xmp.did:2564C0E0DE4D11E2A95ED3BB715
3D468" xmpMM:InstanceID="xmp.iid:2564C0DFDE4D11E2A95ED3BB7153D468" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5F9B6107DCC611E295048EF1D728ED69" stRef:docum
entID="xmp.did:5F9B6108DCC611E295048EF1D728ED69"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
......................................................................
................................................."!2#..1ABR3..Qaq.br$.
....CST....cs4%...Dtu&6.....d.5.v.8........................"2..BR...br
#!1...3$...AQ.C4.aq..S%....cs..DT..t5......6.....U&'............?.....
|5..M>.......-...._...x.>........_.|......Yi.Uxz<~....}8.b.M.
..e....."^6I*..r8r..~.m...G....O..n......?.W.......!.M..)..Y.U3.q]
<<< skipped >>>

GET /free/frg/products/661650/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 22 Mar 2011 12:18:46 GMT
Content-Type: image/jpeg
Content-Length: 28217
Accept-Ranges: bytes
X-Varnish: 1111897217 1111051928
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......J......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?...J.........V...>.r...G..^G.C.H#.`....J.I...F.....x....
A.L=6.............../..... .W.j..Ou..Ek,.qZJ.9.%R....S\997.....<.&g
t;.<......H ....)...........fa.V.......3...^^..$.......BT..<@...
..|#..\.....f...../.^.^M2.y{R..R...i..Z]}[email protected]./......#..k..
@...e.&...I4^.\.NbD...@.. y"....8a../5I.#K ...-...G..$.......~29>..
...........mR;.<...?.......T.......%..siI...C~..y...E..S.>.e...b
K{.k......a'%....'.G.,...w.}5.C.... .B..z.3ZhZ...g..sq/(.8`J..S.....Y.
.r......s..s..'..]*.X.!....M=...o$.Zi..K......>.J............X..z..
.#qBI=.r..K/...e....,....Uf..............U~Gy..Z.......k...I}E...r....
.J....1?...54Y.b..9..\,%.........I.lC...N^p......yc;. .........J.....S
XC5c{..bY....nb..=2. [email protected].....{m.R..W.k...6.#.....Rd..,..#R...m,..
..y#.............%..Xfy..b...".s..{..9(..XZ._k.........HY@"..J...... .
w}...8...?..........[.<yz..Cc.s..S....w.@y.;:J...W..f.....@.?.5
<<< skipped >>>


GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:31 GMT
Content-Type: image/jpeg
Content-Length: 58728
Accept-Ranges: bytes
X-Varnish: 1111680955 1109957715
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:B22AB4A0B36411DFA9EAD
1B5118C216B" xmpMM:InstanceID="xmp.iid:B22AB49FB36411DFA9EAD1B5118C216
B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................=.|................................................
..............................................!..1Qa"A2..q...R#.....Bb
3..Cs$t.%E&r..DT..Ffv.....S...7.c..4d.58.Ueu...6V'....................
.....!.1..AQq"a...2....R....Br#D..b3$4...C..Sc5................?.....Y
.....b.........?.h..................H....;.P.g.H.0}.....1.".....$:
<<< skipped >>>


GET /gtm.js?id=GTM-MJF4W9 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googletagmanager.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Fri, 01 Aug 2014 15:05:24 GMT
Expires: Fri, 01 Aug 2014 15:05:24 GMT
Cache-Control: private, max-age=903
Server: HTTP server (unknown)
Content-Length: 10698
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
...........}.W.;.......>...7..n:>@ .&..Kr....V....Mw..b...JK/v;.
..3..9.7sqK*I.R.6-).....K...E.Z.Z .....^8..Ra.0(........./....0..!.._x
..FC...bv&C.A.|"]....m..g:}.9.Q.n..Z...&..........Y.So....zW q....=...
..-'..z]y.A....z!.h...^..s..1.u...uLc...,2\.. .0.......2.....bI.......
.,.Q@...~|W....(.a..ht...a...`.}..Z...W1.6`....n.0....N......$..J.>
.Fwkk.d.....o.&..x.c|Y) :.A.r..A.<...`W..LC6fX....=V....v...oB..J..
3o.. ...;....".....X ...Eq~R.d..K3....3..Y......%..............&..J...
.=...`...Mj{q=5.... .".d!...0]..,[email protected][.u.,E.
.....,.G)...kk...e..j3..$..g..!.z...F>0ns.Q...q.QB..LS....,.i...iz(
bj.K.....T-...7...V>[email protected]_C........&<x)<VK..j.d.......^...`.P.
.Hi....K..[F..!/......R.|...y0..8.N..d....j.M.(..h....{.<.n.er...@'
...R-Q.D.`.............P....5.V..p.FO<8.!7-[....e./.....h..ix...\wP
qF...Z. .UW...........W.&|..KR....V.(x.:..F.p...F....T'F*..Tn.0.....\'
>wb).Z.1..;3.,.t@....%WHX.q.....uW.....fd0O3...tj*....6[m.uf..`.L..
C.-1KV..m.......nI.......u[m....../....R_..&..;_...\...&X.>5&.uF&..
../.....<......;#C..b...eq..3z..32... ..tQ.Q...%..'{.........s ....
...Ea?!1..R.d.5.H.y.).&-.|<........)..G.K...&,...j.......2..AZM....
.,.V.u.#........>............{8 .......!.*.8..(...C..........[!.[..
..;.....8$.IA........V.gv..J..0.`.<.F7./....(0.....6...v...j.H..7W.
....;..\]&].0..)JV]a.c/...P(..&..@./-.n..`:.....-%..,.X.........V....C
99H%(...P..gI.`V...8....Lc....N.{Ls.. ..x[._.....q.....4}.C.*0...../..
W!.....N.j........$.vE.Te.k...Qm.........^..<..*.M`.}.....hq...
<<< skipped >>>


GET /freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT
Content-Type: text/css
Accept-Ranges: bytes
X-Varnish: 1277530684 1277300854
Content-Encoding: gzip
Content-Length: 301
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Vary: Accept-Encoding
............=O.0..gG......IShQ.....,..*'.8..m]........hG..^.z......g.y
...{.\p...,-...Dm...=?.%c,.~.L.m..R.>".T.....j.....(...n.......Dg..
.L%W..<z...2... .l!...Yk..S..h.;. ..Q..=8*..)[.@.`5j.......{.UO.)..
4.]v.X|.}...n.%..-B.I' ..'[email protected].>Xy....:>.W.f..*;.bv........
1..1=..i../o^........8U...$.:....HTTP/1.1 200 OK..Last-Modified: Tue, 
12 Apr 2011 11:54:23 GMT..Content-Type: text/css..Accept-Ranges: bytes
..X-Varnish: 1277530684 1277300854..Content-Encoding: gzip..Content-Le
ngth: 301..Cache-Control: private, max-age=259200..Expires: Mon, 04 Au
g 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: 
keep-alive..Vary: Accept-Encoding..............=O.0..gG......IShQ.....
,..*'.8..m]........hG..^.z......g.y...{.\p...,-...Dm...=?.%c,.~.L.m..R
.>".T.....j.....(...n.......Dg...L%W..<z...2... .l!...Yk..S..h.;
. ..Q..=8*..)[.@.`5j.......{.UO.)..4.]v.X|.}...n.%..-B.I' ..'[email protected]
.>Xy....:>.W.f..*;.bv........1..1=..i../o^........8U...$.:....font>....


GET /freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css HTTP/1.1


Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT
Content-Type: text/css
Accept-Ranges: bytes
X-Varnish: 1111680717 1111348487
Content-Encoding: gzip
Content-Length: 347
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...0(
..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...n,
..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...([email protected].....
Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$...
..PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$............
HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT..Content
-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1111680717 111134848
7..Content-Encoding: gzip..Content-Length: 347..Cache-Control: private
, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 0
1 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding
...............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...
0(..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...
n,..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...([email protected]...
..Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$.
....PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$..........
......


GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg HTTP/1.1


Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/jpeg
Content-Length: 90657
Accept-Ranges: bytes
X-Varnish: 1111680933 1109709205
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:AF514043B36311DFB23FC
5759A59FD89" xmpMM:InstanceID="xmp.iid:AF514042B36311DFB23FC5759A59FD8
9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................=.|................................................
................................................!.1a.A".Q2.q...#..V.BR
.3.$Tt..uF.......Sc..^U.&v..brCs...4D7.8....e.f...6d'...............
........!..1AQ.aq".......2...BR...br.#3.D....CS.4T...cs.$..5.t.%..d...
.........?..g.....e=..WN.tu.U...N..V."(..".."(..".......J..<.P.
<<< skipped >>>


POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 2552
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

tAQAAAAAAADBewCAeQAeAAkAeQApA4YelAAAAAUAAAAeAAAAKAoAAAIAAAeTZXxGa8NlIFehYGqCMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAA1OTUHODUGQTMzODUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:04 GMT
Server: Apache
Set-Cookie: JSESSIONID=6E8F644F8AD594DDDD847D9798CB7234; Path=/; HttpOnly
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 1
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
0..



GET /free/frg/products/680950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT
Content-Type: image/jpeg
Content-Length: 17864
Accept-Ranges: bytes
X-Varnish: 1109304790 1107277168
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?..y7..k.5.......P .$...................^.D.......=:....V...
6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I
..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e...
...6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5....
.....Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.
d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... .
...z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5
[email protected].}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q..
..^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.
P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......
:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb .
.6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&
..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2
<<< skipped >>>

GET /free/frg/products/524350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 05 Mar 2009 14:05:07 GMT
Content-Type: image/jpeg
Content-Length: 29022
Accept-Ranges: bytes
X-Varnish: 1679247317 1678275182
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1.AQ"...aq.2#...B......R3$%.rCb..4&.....................
..!..1A..Qa..q....."2.....B.Rbr#......3s.Sc$....4D............?..;....
.=.... *...-.G5..YJSU!(......#F..K..H.........IU3.Ls.....Q.x....a.....
[>Q...'.......1...zBV...o.J....j...gb.Q..u.C..M!T......"7Z.e.3.....
.......a7...s...v.........~p. OMhTv...P.q.]..t&..,.3..\.I ..'..M.7V..v
.yq(fx..3S.b.../.}........S.J\..}.q.!..u....Rk..).bk.O.q.A.m..k.1o..t.
.....U.....P...........t.._.LV .(.%..>.r|......[.G*).V.l...==.J..un
.\..<....A.W?..` ..>....{.9.s.p..P....!..n3...F?tZ.Rmr..........
x...C.c....{...Q....(.`YM...u...:.A.Z....SU).J..H.i..z.{..$Q.....H..f.
.....j.Bv0>W.-.J}...*$......f....teizD..{u.).p..n$V.]y...BEN.'...H.
V.J..Y.0bI......*..)Ris..!$.>c".&...T.1.Ty7&...6^MO.........I..v.`5
.5.Z...9.<.......&...!.......q..}....qc..N..V..@uM.*j...P...B..../.
.].w...<..=..=l.....H....bI.c)...........o...D....7q.R.....]@.>.
"..U.W.sN.M(u/..6d...........A..oG...{....{]....v.......e.......?.....
X.".:..`..#.v3..R.x..ZBTh....{C{.uQF.F..d.$......m.....Rx.....^.T.f...
...X...c...sP.v;.A)<J.... Ji.~...V4.]..1..x.{......Q..E......8.....
.....$(qJB-...xmF..-S.,D.]...........S.S.F1;q.....h.....CmY..fBJ...t..
.H$.P..........y...j...e..6..w....S.W`.Iq...ko.[.."^3m.1.Y.!A.M.%.
<<< skipped >>>

GET /free/frg/products/761850/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 26 Feb 2012 08:56:37 GMT
Content-Type: image/jpeg
Content-Length: 12469
Accept-Ranges: bytes
X-Varnish: 1111897241 1110148689
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".........................................D.......
...................!.1."AQ.2a..q..#3BRb..r......$CS...ED............
.......................9.......................!.1..AQ."aq2...BR.....#
[email protected]=......4.....H>.J....I.g..H...,..H.8W..
.QHM..gRZb.......H.Z.D.&.T.O..<.......j.f.~..P..H...T8R.W....G..G..
....U..7Hk.X.%.7.cC.8%.q........F3...u..).....w..O.NHA?S..............
}.W...M_.yv%..w>..w. i.....!..W$....?..S..v..kEE..2.LbUNx~..c2.....
..?.}....]|..6....v.......A....h.F.=.}.)5..5,8..*.z)'U}..{.....?......
...b.S..._..#.b?1._E.....W.T.{*.~.x..l..'.:..v.5x...f#;,...N....gh$e .
@=.....L...k........J.R.l.^..,...n..F.U....E.I..PSBBF.d..X8..x.Sa....L
.1..........i.eL.9U....2g...[.D.....T...h..........%.8.."..'.9....H...
..w..-;...?.g...%HP...c...\.2;j'U.x..$......1.rq....^.."..X.$.....q.s.
.....Q...tY.;.i..]....Ns.......e( .v...P.8..& .VMH.O...F...:.EQJ....r7
.........N.x....%.. ... ls.k......................6.DNV.F.Y..L...A..im
.-...h..P.k..Q..U...{j...:oNm.....*....P..Q.a>.dd.....Lu.....u.!...
....-....2TT=...>[email protected]\Aq.E...R...{OA..
..KCe.......I.1.'.(...z.U.....J"..n....H._.....N....N..\48E.M...R..d..
[email protected]../1.....R../......(>d...~:...6...].0.ASe.I...'.E.m..%N
..q.{.'z._...RB2L{.s..t..6...v.n.). [email protected] .\'...b.Z.)xr.
<<< skipped >>>

GET /free/frg/products/699950/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 15 Sep 2011 12:15:43 GMT
Content-Type: image/jpeg
Content-Length: 16837
Accept-Ranges: bytes
X-Varnish: 1424314704 1424231860
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:26 GMT
Date: Fri, 01 Aug 2014 15:05:26 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d....................
......................................................................
......................................................................
......................................................................
...........!.1..A.Qa"..q..2#....B.Rb%.....3C..s&......................
..!1.A.Qa..q."2......R#...Bbr.....3C.S$4............?..K.'.r.d.".79.X&
.:F.. ..&..ww .)[........8......E...I..o.C].I.8*.P..P....O....[B....D.
...R..eIR....:..:\H....b.qk...7..z.2.....\Sn.Fw..$w$.).*aHl..g .....S.
...SZ...t...l..|.q.O....8f...E..ul.G_.4.:....s?.4^..sFoi....F...2..v..
.?.S.q.L..Er......OEYP."D.;.....w.....MDO....]*...t..b.N....a$Q....;..
.l..!.gPMg...R_....i...)TW.R.k.J.....G.h.Q.h...&.P.-.K.Is........_..4.
q......-5..O.M.M..n..<......'..8..(..z..0'.=./R..thT.)@.......:.M$s
$.....}C......{.k.u.*.>.}..1p...1..W*......[..B.]j..*..z......8.z..
(U.]....$....tP..>=4l.......M.@G~s...[......:...s... ..Pz..D.I.V..#
....m..b....B.OGW2!:.UP.t.V.Q..u...i...WJ&.V.....u..b....4.T..N..Rz.$.
.....p.V.zzi'G~<.G..;..`...P.(.lG......|...`.........d....7|A0.Q.C.
...u..q...Dk../e..m..:Lh.r.:XA.%^....u...U`.I.5.j.lQ...QXV..we.2....P.
......b5.?l.uNW.O...{..m.[...C...N.?O......*2 ..=.7N.."....Rcv...&..Wm
$.W.....tE..'.....ov..II...5UG..6...X.........)S..cE^...=I.z.}l.."....
.Y.CGY..3"5.(..*m......UH.b...F...%.Kv!.q....E.O@~Z.ArQ9. B.S..w\..8&g
t;.,....F....n... .W.l:.iOb..SC].I.E..U(.K............;.N..i:.....Z...
>.Q$...m...;...UO......Z.Zi.:..F."Z}.%...(.{gs.h. C.......P....
<<< skipped >>>


GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=7287786-9717047
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 1926374367 1926325909
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 7287786-9717047/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41
 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-
Varnish: 1926374367 1926325909..Expires: Fri, 01 Aug 2014 15:04:02 GMT
..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range
: bytes 7287786-9717047/12146312..Content-Length: 2429262..Connection:
 keep-alive..Cache-Control: Private,max-age=0.....bK..h...ss...KA....&
.uId..d..xf.[..PLDa... n.............T..T.7.z._!.-...P54......#ti.Y:k.
;..}.Xja..cFa|3.;....Q.=^C3.....u.`...8..p.......`~zoR..w(..A^...~.$.&
gt;A.q...N..D0gtO.\...\.)....,n)X.|....Z...N..m....$.v..694....9wM...K
....I..De.s....8W.../1l........-mW.kC.\.sK...Z........i.by.......X....
.....K.........`.&...I&....$....3>.'.[zu.s.n......4:...".....z...= 
._..t..s>..&/(.Co.y.f....Gj(..z......OZ.mF.l.Jc..\%vu..'z.5J.P..4._
0......(...^i...^..>!42]~.EQ\9........zMT...o-..D....2.,1..%..$#.n.
..-_hN...Ni..j........mU.......`...k....WV......"..R.j.......uc..qW...
/...J.}j.]..g...F.f.U`._.".9..-..1....l....A..] ...cW..Z.,.........%.g
....k.t....7(B(...&.......oS([email protected]../.......H.5>.O.
..B)..-.]..x>q.~..M...gD..4..Vn<..H.H.p...0yl.<0c0m....V.{...
.L.4..rp......Cz.t...`...8...6 Jj..F]#&.<@.2...l.....ssK...K.m....d
....."7..U././.Jo.....d. .v.....}K~i".9.-J.!.o.....,.@,.G.T.\...#.u...
.n2]Wx..y.}.-.{3..N..i>S/..G.!...=...|.....Y,...... .....F..d....&g
t;$...W..L..K.....BC.....efO0DK....-3....jd..D.......d.v...f4.....d...
.T.a...3..A.E.Y.......^izv.J^.K.J.#..]).{.m....=".D...Y.$..x..(.o3
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:28 GMT
Connection: keep-alive



GET /free/frg/products/668950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 21 Feb 2011 15:39:31 GMT
Content-Type: image/jpeg
Content-Length: 23666
Accept-Ranges: bytes
X-Varnish: 1111411910 1110267205
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!..1AQ.a"..q.....2...B#..Rb..3r..$.....E..................
.......!1..AQa.q"....2...BR#....$..b3r..C%.............?..GA.|#.....F 
..<......\0..\.....p.y.~.....>y..?<.O.......~..0(P..!......=.
.......A.G..~#..e..~8.zx..G:............\'Z..T...>..H`........TA...
<9D....E.....G.0.nC.r8O...ZE.'<.q...<.P.<(.........V...C.Q
.=G...$.t.>.q..(.....o>.....s.u....CF.._T.xU.*Ky...?.....c.}..A.
?u............?....>_..._..............|....,....|0....!B..G..w...$
.....~.........|.........<%I...B.k..?.....p<([email protected]
..H` .x../X....y..!.',c$.u.bP,[email protected]..#.....8.d&..s.Q..
....=M .....k .``#......$.j....Y.D...>P..d2yV..k.......y.......X^..
.......|xq.../..i:...k.e.x.....W.....o........q.....0D..T...K{Q.:.."p.
@~n..i4}.........ck.v.C.yt...\..t4...x.?..g.,.........~#...W.t4j.yP,..
L>.c...0.@.^&.A4]...............k...>...CV..0..(.f....z...DR...4
a.>P...!..p.KH[.. ............i..~..'R I.Y.. ..C....<jJ.{s....iZ
\u. #....H...A...a............K.mY9.V<N....'......u!l..............
<..u.....E.m.x......a...4.=G..~.p.2<.1..yr.)LFC..0...../.L%...m-
D|#..!..........$...$p...0....An5..*... ....>.....I.hv~....0e...K.|
.....!..oqO4.:|(.9......m.E..Z.......a.....&..9q...Q........=...G.
<<< skipped >>>


POST /do/gateway?sId=Default HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:52 GMT
Server: Apache
Set-Cookie: JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4; Path=/; HttpOnly
Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:04:52 GMT; Path=/
Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:04:52 GMT; Path=/
Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:04:52 GMT; Path=/
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Length: 38
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})....


POST /opTools/clientTracking.jsp?trackEvent=playerinstallationstart HTTP/1.1


User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:53 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:53 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Conten
t-Type: text/html..



GET /free/frg/products/563750/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 13:28:54 GMT
Content-Type: image/jpeg
Content-Length: 29430
Accept-Ranges: bytes
X-Varnish: 1110064354 1108874112
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE2119
55FE55656C7D978" xmpMM:DocumentID="xmp.did:0C1B73D5EA2D11E2A18CEE3F989
F8A24" xmpMM:InstanceID="xmp.iid:0C1B73D4EA2D11E2A18CEE3F989F8A24" xmp
:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:90D37B62E79B11E28D69DE4027E5AE9A" stRef:doc
umentID="xmp.did:90D37B63E79B11E28D69DE4027E5AE9A"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
............................................!..1A"..Q.aq2#...b.....BR.
3...C$4%5........................!1...AQaq...."..2B...Rb.....r#..3.4CS
$............?...%.:..\.......(i.J.J.R..Hm...>.S].hq.=.,.....I.TW3.
"}.Cb.F...3'..R...N.E...3..... O......R..%.DwR[.J@."...}[email protected]
..`do....._..&..fX6D....E...N.9.qZ.HT7....j.6.....U4!.q...,N%...%.
<<< skipped >>>

GET /free/frg/products/645050/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 27 Sep 2010 13:16:46 GMT
Content-Type: image/jpeg
Content-Length: 24320
Accept-Ranges: bytes
X-Varnish: 798420471 798402511
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d....................
......................................................................
......................................................................
......................................................................
..............!..1".AQa...q2.R#...B.t....br.3Ss$%7...c4T.u...CD.5..&6'
8........................!1..AQaq....."r...2B.4.R.#3....bs$%5......Cc.
.............?...w._....YE"]S.Q,@IP..R.t.?]><h....t....GL....d..
..x..D.{}....j........].c.e..Z.a............J.....J...L.. [email protected]'R.h...
[..M.[.....1.Sb=!6....N>..%....y.S....z.....{k...a..D.../...5..P.;D
....D..........].lvo.C..8......l.Ej....R....q.S.$1#.......9...)..6.P.-
2.M..`[email protected].|k...... h0.....,Z.1e.b....%.XuL..2..q.R.C.QJ
...<dUt...6H$i.n..b..).7s.Zv.s.nzDV..hN..6V9...G.\......b.?..\....@
O.$2.......B....<...%jO...<#(.#.o.8....e;...SB$.Z..i.p.T......."
>%.....}......q.i...g{.......J.z....Y...Hqk_Z....m$.I..nq.>$%aR-
.]:m.......Q.%`......x...]...vJ.P....w.0j.....}.9*T.n..8...2.](AQ.!>
;e... ....... N...L.0qUV..V....?.n.......QS.l.^V#..D.W....[...;..Y....
i................j...H&S..%.S......kT...e.{.....Z....j.)..ss.gC...x...
..,.I.b...q.l....{T.'...>.S.a.Wx1..|.o...r.<..>...e.......s..
&*f ....F.mhy..}-..t.h....`x'A...`..Q!...2...bg............&.E.!.8m$EE
m..z...%..0.<.O.4.cN..qI.wFk....J.B...yk...XL`..5....&.=zkM.NG....$
I.W.=.k.....;be.>\a..R.:.......GX:..k..xA.8x....'.|y.."..~.'drB....
......~Q....o#..(..W. ..........t...o.v4......dv.-%E=...2;........
<<< skipped >>>

GET /free/frg/products/578250/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 26 Jun 2013 12:33:39 GMT
Content-Type: image/jpeg
Content-Length: 31460
Accept-Ranges: bytes
X-Varnish: 1679249247 1678506895
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8E4D0DB03DCE211B
B4FB0C483C69A6F" xmpMM:DocumentID="xmp.did:E13E1744DE5B11E2ABECAE40EB1
82E57" xmpMM:InstanceID="xmp.iid:E13E1743DE5B11E2ABECAE40EB182E57" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:AA4F045ADCAA11E2B008B337C7D9C0AC" stRef:docum
entID="xmp.did:AA4F045BDCAA11E2B008B337C7D9C0AC"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
......................................................................
...............................................!..1.$.AQ4.a..#DT%5.q..
3d..."tE&.....2BC..U6.re.F'.Ss....Vfv.7.........................!..1A.
$...Qa4DT%.q....dt5..."..E....2....U&6..u.Be'R...F7(..V..............?
....w..k.8.tk../..N;..|.r.O.2E.WC8O....F.De_n.............O...qU)..y.z
.............<..f..r..&..Mi......... >..sT.-.....6.....b...b
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:05:06 GMT
Connection: keep-alive



GET /rsrc.php/v2/y7/r/j0a7CRWp-Sa.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.static.ak.fbcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-MD5: MgEbNIV6xAPVxsNV4TTerw==
X-FB-Debug: YfDCXj1hmqpEFIqSlYah5nkeJh84VFS2zPnv/7EaiwBC/64qhfj7URdeE6OBgvz9PThqLpeQ6QN5L5zUSdocuA==
Vary: Accept-Encoding
Content-Length: 64284
Cache-Control: public, max-age=31273662
Expires: Wed, 29 Jul 2015 14:13:06 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.............c.8.(..~.....I.h.N....7...9.n.L......h..E..dK....Z.. .%3.
...^,..Z(........^.w....~z...gO~>......g.?.....'?.?.....75;....k...
...d0.R......l....Qf.....yzy.qZ.G,o..LS...3.u.7.f..fa....J..<.k....
7kL.d.....1K.gi...=?. ..Y..2.....zl....rVw~Z.....]..>.....u.....^Z.
.Z...U.....!8.<z=m=.Q..D......g'..?....xv..t.>>s~......(IR...
n.u;-1.....)....:.i9....YAI.....qK~...0M.kqp_.../...wZ...;.f.0kDA<.
....\..=tZ7.q...<........ja\."N..t......$Hp......dT..j..{CgCza`.E./
[email protected]!....J.9..t......\......t.T...C.9.K.:.H1
....b..F.....:.2.Q.x..........q.hn|X...f.<.0.,..NU...c.<4..1....
q?X|.q6....]...u.....7.O...7.>.n...w.F....!.M.C.$.&.x|.......qg.k.}
[email protected].(n......#.{..$.Lv;[email protected]...............
.'.....$.g.j/...G.u......9.g. .Co..;=.6.....r../...1.w....Z.0.i.;....`
M...WFjN6.e .....V-.jq2...<k.A.!...e.U......9t...............@5....
}.9M.A:.}.......Y1..xZ@!i...8...).|....`......`TC.L..e.G...........B?.
..1.,.......p0.9[........._........G.H11~o.Y...{G>x..&J`...v..`.5..
..s.t^_...........\.[Q.6.] ...t...'...sk.^A...<...A.I\....X.....p..
.-.{...z...s..99.....v..GG4..q.........m..i....d..55.o......b[.... .Yo
..4.!.f....]..&.....vWO_....~-...1.<..o.&.\QM..waNs................
.?....3...08..z3 ..o.T...g....U.5G.I.y%..Y...\...<9.....[D...".<
l....................ul.}[..!.gC.pV....>|-|.#...}i.....,..v........
.1...-...X?.']..J...$..x/..0A.. ..}5?.......?.....3..........3.......i
..~n..._.....|J/?..Mp..on0.~n:'.Xo........X..\-~....n...x..N.[YW].
<<< skipped >>>


GET /free/frg/products/595450/boxshot_sm.jpg HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 27 Jun 2013 06:36:07 GMT
Content-Type: image/jpeg
Content-Length: 3913
Accept-Ranges: bytes
X-Varnish: 467849060 467652213
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:01 GMT
Date: Fri, 01 Aug 2014 15:04:01 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8E4D0DB03DCE211B
B4FB0C483C69A6F" xmpMM:DocumentID="xmp.did:37B0D717DEF311E2945197C9A34
9E208" xmpMM:InstanceID="xmp.iid:37B0D716DEF311E2945197C9A349E208" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:78F7FD0CDCA811E2B081EE85099AA43D" stRef:docum
entID="xmp.did:78F7FD0DDCA811E2B081EE85099AA43D"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................<.3................................................
...........................................$...4.!.D%5.T&..d7.AQ.#3E6.
....c..Ue...FV'............................!1Qaq$4A..T%.....Dd..5.....
..U6............?..v.A.\>.0...}...........v..yZa...>,?l..fDn..l.
.vX.l.I.J0..8......RIyrI.......B..F..p....X..1. ..f...........m2v.....
.'....._.pvYq.#..[.^.*Z.I..0..............l....(.....x...s.....^..
<<< skipped >>>


GET /plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.facebook.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Pragma: no-cache
X-XSS-Protection: 0
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
X-UA-Compatible: IE=edge
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
X-FB-Debug: NJW5uIlGzuuGb8v0WPLpbhVOtUkQdQ9juZ3DzV8BnncVkXIogjvnc2uy3PPF2BAH8oj21lut95NPM7DNLB6LvQ==
Date: Fri, 01 Aug 2014 15:05:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
1ae3.............<.s.H..._.U.....|@....k...8...I#.. ..qX...=..!.o^}
_..r..g...o............4........#.d..@.\{.;..f......$..A8.MtD..~...)..
).....Y..wu.)....H..C....D..4.<.:d..|.D...`rb.n..|.._R7....A..&.~..
..a..c#.f.7X......,..iL.$"1l8..i.x..`..6....nkb.....].~.R..3..A{h.I...
[email protected]..."R}J..4......ObXy..F...`..R:O..s'...N.[..J....x
8.\ .i.tmw@}..lS...i..n..R.#&...z0.Hm...~...9.........,.&...a....i....
b...$v.....'4v.!...?......i..v.i....i..n..9B7..l....*~..,Y.7..bz..ZkI.
ra....;.fq..Q....\z6...0..!....\...L.....pd4f.......p..(A......Ngi...V
...Sy.....y..M....z..QFN.8.i.b.....>.|.......C........[.A.^ ...Q.;.
|@....].`..PX.@o....^h.)...k.r......k...>fv#w...l.$%[email protected]..:
^/..>f.E.....e.z..%n.X3Q~..P....nJ.`..J..[6.....z...x..TC...G.V.h..
..,`....lX..HhJ.a.2KCqd....!.g..j.N..........t.(.S..*..0.y..(.S.%.E...
.n....p.....sC..Vo5E .}.0....?1..HJ.\...e.g..g..E.`.z. \-.xNcf)l.....8
[.gR^J.....|.:@.>...N...^...n..../..#5rq"....F. /.su.UuC[.U..S...m9
..S1P`U....x.Y1..V.7. ...7.c6.}A'!U.g...9..4..x.."....X.61....7ax3w#..
<.. %......^`W.....<....c1.4.<o..pL..5.y.$...l..y6Td>.*.?.
[....Q.....D..'...I.WEP.(.HA.r. .9P..... .n..Dx.}.8n..5..i.Z9.3`......
....VCE....RP....ByR....;:..Z[...P..f..l|.....,'.) .0...:._..&B<...
N X....:.&.,[email protected]..[..Y6f.......e.-..$...9.#......|.$<.....:.OkW8.S
H..iA6|...:.S3........Ij....z[S.._rX}!..:.#...P.nB...........'...uu...
e..y..9..Y&.K.....q...... .V.....'I.Bi.S5'..k'.yku...9........ T....A.
..C......$;...g..^O.5..#^?dl8......L..x..V..y....@Q6.. #[...2..KG.
<<< skipped >>>


GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 3330
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
.PNG........IHDR...1...).............tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.di
d:4E25B844FBE211E19D22C37B1A58EBB1" xmpMM:InstanceID="xmp.iid:4E25B843
FBE211E19D22C37B1A58EBB1" xmp:CreatorTool="Adobe Photoshop CS5 Windows
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18547691F077E111
8511BC5C7C940756" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754
F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>?.u.....IDATx..Y]l\G.>g.......IJ.4)..J...
KS..P.!Q.......'$........Q.*H..Z.F.ETi..RZJ..B,...sl.....zw..{...s83.n
.(?..I.e...{=w.|s..3c$"._o....m..-.^...< wZ.....ZU..........`...I..
.@E...........".7.._#[email protected]...(.
...mKV...Tx.. .Xz......(.]yaB..*K.%......0G..e...jA#=?..8[rE......}r..
Z||n.T...ul...y....I....T.MA.Mq.....[.*.7.....D...k........\.;..LN~..?
4.Z.....n.M....xL.e.e....-.<..../0...F.... ...K......}....!.M..
<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_bottom_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1237
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DCA0EBD556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8DCA0EBC556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................b.....................................
......................Q....U........................b...S.............
.?...Y........F...H......tH........


GET /static/marketing/main/img/containers/green_bottom_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1229
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F89900DD556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F89900DC556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................^.....................................
.......................R...U........................R..............?..
..L. ..Qu...-..oz\..3..HTTP/1.1 200 OK..Server: Apache..Content-Length
: 1229..Content-Type: image/jpeg;charset=UTF-8..Cache-Control: max-age
=86400..Expires: Sat, 02 Aug 2014 15:05:23 GMT..Date: Fri, 01 Aug 2014
 15:05:23 GMT..Connection: keep-alive........Exif..II*............
<<< skipped >>>


GET /free/frg/products/616950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 13 May 2009 07:04:16 GMT
Content-Type: image/jpeg
Content-Length: 15113
Accept-Ranges: bytes
X-Varnish: 1250507785 1249857010
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
......................................................................
......................................................................
..........!.1.AQ".aq2..B#...R...b3$...r....CS%........................
!1.A.Qa"....q....2B..Rb#...3..r...$............?.u.kg..e..W..e`.@...:.
......~C..1.7]....f...8..r....5......dn..AVF......9@.>...^..g....Or
[email protected].@$...E......-..(&}.~.......WrY....:...yWI%.....=#.0W....i....H
...H.{....Q.zj<~cI...k...V.h....e.........3.m....'kUc9....[.Un?...`
|.n](...3.jZ....O.u.6.....8.p.v........A...2..^C.....#.8.>"s...K{.-
....fajx...B...Q.NDyj...l.u.W.e8_.......... v..v.. ..A Dm..V..W`T.)"..
.u....m..Tua.A{...Y..E....B....gMm$od....nD....Z..A...{... ha..1...9.m
.l~..........`a...I..4.j...U.p|..\.^....|.g2.......9D.).3.GC.;kg......
g.;.7........=4O(.c.N.. .L.Y3 P../ ...}.s..CB.....qy*[email protected].=
h .GMv.p.p.N..]."../..)....[Y$...(.6.|u..k:.t.......vP~..@.:..b.i.>
......<..p.q..}Q.....6Z...e.U..N?.6.G9y%.{v.........[...-....ww....
b.X,x..@..&j..F.#...(...Et. .LkW.........3.l..x.@w?P.{{.r.$...,...p...
.5......J;.M..n#.6...1,=.f....We....wq..V.h..........#....k.....s.....
........V....{i...~(/23.& .*[px.o..W....od...3[.k.?t.....&}.P......Zw.
.d.{v?.J......v4.....c..t.|g..v.r..7......2.v..#..w.\.k.r..?..s..w....
s7._..~.~.O..|...\{s7....J...h.W......Xkr.......||{.dn..0....7v.......
&....G3A..5......:...K.. V.u.cR...^w&b.........k...64..P|..#......
<<< skipped >>>

GET /free/frg/products/719950/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 18 Mar 2012 15:31:39 GMT
Content-Type: image/jpeg
Content-Length: 18774
Accept-Ranges: bytes
X-Varnish: 1111897254 1110700244
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d....................
......................................................................
......................................................................
......................................................................
...............#."23C.BRbS$..rcs.4..!1Qa...D%A..T5.q.......dE.....tU&.
.....6'..........................."2#3.BRb....r..C$!1A...Sc4Q..%.aq.sD
...........d............?...7...Z.m..R..J...J.i...%x!........... G..Sn
Y..]8...o.$av."..E.<...&Z.T!......,..O.'S..Y&....7#g.0 ..!F.?Y....2
`......T.`..C....p...$..S".~0.......3.R].K{..g...H.M.:.a.<.G.B1...9
$|............Q..:...%......C.. .A..E....x.| .{?>;.. ...1.4.k...c..
..9s~M.G0......c....\..|8Eu..y?.....V...........o.. .p.x}......]...7..
..0,.=.o.]M(5....d....Q.....=.`.B.....B.....E....k.>L.s..........6.
..Lj.y~a.N...B...7.....[9m.9%..mwx....J.c!1.....Y,..L.4m..F._....x[..q
.Q........9>8e......u.-..S.........=1.pb.r*.{[email protected].
..q".{..Q.........o....,L..0.opK .RUJK.s...RY.`.1..f....~.j....,.F.[..
...!:....-..DM.....8..K.Q.9Z...3..P...............6g....6.....G....]|.
[email protected]....$..3..MEI*[email protected]!2.........Yw....*.$|.........H
N.p.]j..W^........Ue.OG..#.t..W..|....;.w*.....w.r.......w:..X..L/.]..
..7......<(.{..A%.).......'.......rX....'.t07:.I....\..C.4..Qu%....
.m.I....D*.D........4.."......#~....1#L "Xt.Mw....X......=.m...\.;....
1P`.\!Z.}|[email protected]&.s...J..L.....\[email protected]......
.,.n.N..%.eJ.K......$~......M.5a...X.....01..o........[`.2|r...6=4
<<< skipped >>>

GET /free/frg/products/521350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 14:00:26 GMT
Content-Type: image/jpeg
Content-Length: 20224
Accept-Ranges: bytes
X-Varnish: 1465218307 1465089466
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A2564DD428E9E2119
B6EAAA9B36B19B3" xmpMM:DocumentID="xmp.did:683F9C80EA3111E28E18D6C6357
C70B1" xmpMM:InstanceID="xmp.iid:683F9C7FEA3111E28E18D6C6357C70B1" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:8EFCE9A1E93311E2931C861C14986523" stRef:docum
entID="xmp.did:8EFCE9A2E93311E2931C861C14986523"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
......................................................................
..........................................!1.A.Q"..aq2...B#..R..3$....
b.C%r..S4........................!1AQ..aq...."2..B#.....R.br$.3.C.....
........?.......V.c.JR....."W.#..c.Um.m........q........@H=....|.SgB..
.3.m......f..q.V?......H......>.R.fr..),..(;.Ep..6...r........P3._.
.......W..55.'..*&..j.^k......N.......Y-A...oO.......D..].........
<<< skipped >>>


POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 1848
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

tAQAAAAAAADBewCAeQAeAAkAeQAMAOoAlAAAAAUAAAAeAAAAKAoAAAIAAAeTZXxGa8NlIFehYGqCMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAA1OTUHODUGQTMzODUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:04 GMT
Server: Apache
Set-Cookie: JSESSIONID=096DFCAA73E3C37F86B4EA5350B4FC0F; Path=/; HttpOnly
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 1
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
0..



POST /opTools/clientTracking.jsp?trackEvent=playerinstallationfinished HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:02 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:02 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Conten
t-Type: text/html..



GET /free/frg/products/643650/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 21 Jul 2009 12:45:04 GMT
Content-Type: image/jpeg
Content-Length: 17001
Accept-Ranges: bytes
X-Varnish: 1108941170 1108243209
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!1..AQ".a..q..2#..BR$.br.........3CDcs4d..................
.....!1...AQ.raq......."2.$4..BR..b#3..Ccs...............?..-.......k.
..}....2.M.#x....hdZ..>:I..(..Or.~.I2...I5..U....]5..:I... ..IP.Y=.
v<v.uJ...".L2M7..J..$.p.O!..sx0...*.".#[...W}...R.."6..7......T..R.
......3c3.c..(z.W.`1L..bs..<5..^.W..$..H.M$.45..I{...4._..$..IxU.t.
I.X.:9...h.....8...........m............?...o.....q.....G.....|....i..
2K .....lJ.y.i$.......z-...i..........c..j.#'..c;d.......8.MIn........
.^.e.n........!.?p[~DnW.r5....<hO.....?..B.HW.W.5....F_.M...2/Vc...
pR.m .]....\ C....I.GH96.9p...u*..L.Jy....j-e.....L....K.R.I/6$.i$...z
N.).Q......}....P.i9...1..a.y.'..l..............U...G..j.I...I%.Q\t...
LM..4...$....cR.X.....i..,)S6.A...\....y...bR.Q.t2...|...Kw.7.H.~.....
 .).q.(.O........sM..b;-......M._...d.gw...O9..-.........id..%T.NU.N..
..L..Z......V..bwr.^..WX..J.M..^.h....ST.......'..A.H..&Ca.....m.S..y(
..G.k..g....nX...]rZ..*AN..E.*..VU.iP.MX..,M.6...u`r.j..5$..S...)...-F
......s...j-Jec.H:z.Id$.^...S.h.....8........'.?.F5...G...s...<S...
M.#x..1.t....hj....=.S..=2.y......(..v...US.......>.lt'hH...8....].
.....KP...4...K.......m......K.j.(..a_.P........6l6..QQe..6.^.Yny<.
.......8.....U...>.p...$.u.h.PahO;?nN.LfKp.mIB.*R...Pw'.NZ.....
<<< skipped >>>

GET /free/frg/products/663350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 08 Feb 2010 12:06:01 GMT
Content-Type: image/jpeg
Content-Length: 16226
Accept-Ranges: bytes
X-Varnish: 1111897215 1111051955
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......D......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?..L.,.5*w.XA.b(..k${..R2G..$.&........1.N.....h.z.]6.H.....
..j..ga..N.<.l.......,\ZFC.84*GZ|.s(.c....O....`....G...j..u]..8`.N
..kr..Y.......l...S<Y...S.#.M.N.eI.x..a..6R..)...KV.FBjT....`...N.\
\..jA....<....7F.m..$K{.."..u!.V..j2..............(...../..s[.8;...
.#$..b3k.Gi...7o...5C<d{.|...D......i....J\#..;.*........(.z..*....
0.... .q$..3X4.&...jw./.Wq.S..G.....{...T..4.5... cdzV.Z.....X....C..Z
.T....#...nG.'8.e....yJI....2.bvn..|>`..#[email protected]{E(..7.qe...S2.jLX.
[email protected].:.;.|4|....^-.6.c...>....EF.w.)..N1.'r.Il-.)..
....^.vFY..bc.[..6...xP.^....&.@..$.7K.EEI................g..GrsC)d...
g"...K........@=.sJ.R.p..E9.DK...q.:.3{.'.....$..C5......1...f.tF.. .6
9..(.T.l.@>Z....R....4..~|..z.fj0..f ...?.......@#... [.R.4.<..#
.0.[R1.........f.5.7.w.[Q.[....%.&.?...'0?{.>.A.h.^l=.-7..u.|.=.1..
......I9.b...TUA.6...d81....D. ..`MCT)...5......X.".Y..z..ke....~.
<<< skipped >>>

GET /free/frg/products/571950/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 02 Apr 2009 12:56:42 GMT
Content-Type: image/jpeg
Content-Length: 17011
Accept-Ranges: bytes
X-Varnish: 1111897252 1110760732
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
...........!.1"..AQa.q.2..b.BR.#...cs$.r...4.v....3C..&7..............
.........!1..AQaq..".....2.B....R...#35.r.b.s.............?...Z$...hB4
!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!.
...F.#B.....hB4!....F....hH..F.#B.....hB4!....F.#B.....|.I.P'm...|....
.......H......).5.E..\....3..).I-............q..y.-.J`q...`.....uQ;8..
......1....Q.[)!E.#......Ihq...r.....J.....,=.Z4!......A.4.IU.H.hJ...L
8r.$...u.....(.}...N...:G84T...xj.H.-b@..).G..%..R.p...Oh)..<N..L.@
..0n(N..-...J.....hJ...4....uM.$I.H.ZI\...?.........P.....Q%y{M2.....E
.~`H.....U......<.maGt...P:...a...by}TgKW5..h.N|;....H .u#.>.c..
.....(T._.0;....N ......J..Z.Nb.i6.-.....h.K.$..8....H...CZ..@..&..#Y$
..T...z.........S.I.$.I%K.6..-....t..Q......%.. ..;|...&..i.[..o.X7%t.
.....e#...I.......a.......V*4....A..W.9-..>.......e..r.............
......h.|....5.!.....c7%...1...\.;....Z...R.7.... .. ....5`~..E...$uJ.
(W.@x.|.....)-{\h. wAth.>..2.q.2..BV.!AH'......5,BF.73].n4......aw.
<F~......m..........(.t0.c8......_.=...^f.?&;.%J..B....qM.....ON...
.y......#.tiWh..hJ..|.3....{.Vq~9.b...YC.............'...$........N.ka
......\....V....of)...4nxyh.8..LE.G..........~Y....L...Eo....z.0^l....
e#..'...F........,.(.C...@.]..G....D....yo..7.>.8........L.v[.u
<<< skipped >>>

GET /free/frg/products/748750/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT
Content-Type: image/jpeg
Content-Length: 30665
Accept-Ranges: bytes
X-Varnish: 1110567298 1110386393
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......^......Adobe.d....................
......................................................................
......................................................................
......................................................................
.................."#.2B3..RbC$.!rS.1.cs.4%.AQaq....D&..T5.......d'....
..t...e......................."....2B#..Rbr3......C.!1Aa..Ss$4..Qqc..%
....D......T.5......t..............?..!.MEx..x?.^0.....k....&!#tM-....
.qS..u...I.h.$..~........n..hq.....8...~..}h.L.=.[gdf..1...E.n....].D.
...~W.'...t.dn.E..Z<."(..rN7|..!S..9..~`.6.[}W~..^.....u.}c..W...*.
."........."?\.u*j.....~..G...7..;"..s..C7_).t.<..~1..W......1f....
..S.<A..b....J.F......W'>E.xYC.....)t.......F.....u.............
...f..g.A.0k.f....'..._70.l.......y.p.~B....,1.(.eR........-h....9....
...pE..O$f.e.Rn.....^.F../....}.......IC#....n5..q...IwhJ<..|D/..k.
...|.X......8..'..0.9..k....6../#.$e..P....!...VMAk........d{>t..7`
g........../~8.....b....../~8.....kt,K.......}./....'...{..G.'...k*...
....2?..Q......e....ip...[..w..T{...G>K'...yq.>G..1../...g.....y
r..'.......EzK.L..v....K.\.Cj4.T.i1p.`..7.....t~z...aHTTP/1.1 200 OK..
Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT..Content-Type: image/jpeg
..Content-Length: 30665..Accept-Ranges: bytes..X-Varnish: 1110567298 1
110386393..Cache-Control: private, max-age=259200..Expires: Mon, 04 Au
g 2014 15:05:25 GMT..Date: Fri, 01 Aug 2014 15:05:25 GMT..Connection: 
keep-alive........JFIF.....d.d......Ducky.......^......Adobe.d....
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:18 GMT
Connection: keep-alive



GET /static/marketing/main/img/green_btn_28_mid.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1289
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=67666
Expires: Sat, 02 Aug 2014 09:53:08 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:79D12945B258E1119
DF2A5DBDC21884E" xmpMM:DocumentID="xmp.did:CCF2A9DF58C311E18081921A07E
6FF11" xmpMM:InstanceID="xmp.iid:CCF2A9DE58C311E18081921A07E6FF11" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:7BD12945B258E1119DF2A5DBDC21884E" stRef:docum
entID="xmp.did:79D12945B258E1119DF2A5DBDC21884E"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................u.....................................
..............................R..T.....Vf'...................Q.....!..
"b.c.T.&............?...4....nL(.zMz..X.i1}.;..#n...#.J%ATM...*..R....
]...%............
<<< skipped >>>

GET /static/marketing/main/img/containers/green_corners.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 2157
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:408B6E0A556411E18557BC153AD
0475B" xmpMM:InstanceID="xmp.iid:408B6E09556411E18557BC153AD0475B" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5E231C124755E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
..................I...................................................
...................................!1A.q.Q...".a..2B$.#3...T..V.......
................!1..A.aq..."2.Q.....Rr..S............?..Q2w&V.9q..a..2
$.A.8%QC.*..f ..I>.\iB.NMl.s.C.....2 . ......q........4n?.]...og.`.
7.._.;.;.......1.Ts.^....fS~T<....s..@...";.....%A.np..Pga..).0...#
.......$2!.q..u..e....I......"E"..`Lu.............2.....?..m...2Jn
<<< skipped >>>

GET /static/marketing/main/img/preload.gif HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 6712
Content-Type: image/gif;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
GIF89a0.#.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!..NETSCAPE2.0.....!...
..G.,....0.#.....4...................................<............&
gt;.......<. ........< ...... .....3........<..*........!....
*<.<.....<...<............._.1.0hA^.G T..."..H.(J\w..F..:B
.h..B..T.\.....!B.lI#DI.1....S.O.3f..!t^L.!~.X1....D..[.T)..O.J=W..R..
.v...k/.P........p......!.....G.,...... .....G....!<...<.3..!...
G.G...........: .G........;..........G..!G.....*...... G.........<.
.......<..............*....*...G*........!..s........8.p......0..b.
..z........B.[.2......L..e...h.|.r...3rV..B..G3n.......G~>..shQ.=.n
...(..Q....s..@.!.....G.,...... .....G....<..<.......G..........
..........*........;......G...:*..G....3. !.....<.......<.G.....
.... .G.<.........4.. G*....!*.*.....T..G..>....C.".B........#.3
...qD..#.C~..r....R..yD....U..........\[email protected]..<.
..O.R..x.5 A.......!.....G.,...... .....4...4.!.<...!....!<.....
...... .........!.4*.......<..<........ ....*.3.  !...>;.....
.... <..>..3...3...........3*. *.....*.*.......j..{....d...s.!.p
.-"...;Y.41...44x...$.."E.3yH.K.&i.p.aELA.Q.X..B..@o..:[email protected]
<<< skipped >>>


GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=2429262-4858523
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 1926374369 1926325909
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 2429262-4858523/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41
 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-
Varnish: 1926374369 1926325909..Expires: Fri, 01 Aug 2014 15:04:02 GMT
..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range
: bytes 2429262-4858523/12146312..Content-Length: 2429262..Connection:
 keep-alive..Cache-Control: Private,max-age=0..q..O..E"^...E.B..D.r=^"
....R./.....1-^-../...D|....y}.........].-..Qa.._.'.......[X..<...f
..P....z6.y..U-].)....AJ.U..../..fc3.V.....o.'......^..yVb.]..Lh.3dZDT
.v...KT.....|..CB...*...T.j...pSq........G..q....y....$...._......4...
..`.FT..N.w.4.D...O...|......%. ....._>... V.6.5...-e3.. )......}l.
....i..u.P1.....o..>"..ou........[#...6[#. ..y..|.Y<c.y....(>
.Y.%p......YL...d.S......`E.............?...`@....^3.`... X...........
...A>....vN.^.4..V.*...O.P....6n:........lf.........yN..{.x..%..-l.
Wfc....... _.......z.5z..t...:..4l6^.C{Y.$O. ..4......../....`p.N.....
5..&..X...m.4.v..b]9.s..%...C......j.!?..Sz...>;*....p.v.k.=.:.=...
....H.Y..V.l..E./.Q....$...q5....a...~..Vaz.[(.1.2..[.6p..p.u3e....K..
5.g%........3Kd.|......?b.n`-.A....V.H.b<.D...9.N...e........hViVn.
s.J$...E...`.f._..>z..?./M..........G|a...L|..a.......%....l......C
~>.1w.D.JP.0.IE...a.....\....r.......s......sG..]..O.ll _@.]`.].cx.
.."..>[email protected])....!....N.:g.uXh..........-.Ue0
...\...\.c.b.&D5.......T..B......32.yO.g.....'..s....u.s.....o...../G.
....O.....'.....9....&....qQ.}t....$Xsh`.5g@.]..A.&8B....Jr..;.%=.
<<< skipped >>>


GET /en_US/all.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive


HTTP/1.1 200 OK
ETag: "a89d9f64c8545f8b1b7c72572d2188f4"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Content-Encoding: gzip
Content-MD5: g7tSjC4YILZvPtnpqLpd/Q==
X-FB-Debug: 0gk9ovic4HQA6uchwM49yJT0YNnZJr2BCxoJBI2vISFstDN wKGadQJ2IGehLL EIzxZhdr8n8MGiH3Sko9nUQ==
Content-Length: 54012
Cache-Control: public, max-age=1200
Expires: Fri, 01 Aug 2014 15:25:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Connection: keep-alive
Vary: Accept-Encoding
............k{.H.7...O..3.jd..:B.|.q.v..[U==3..%@.q.F`....../"3...vu..
...9.E.3222"2"....G.'.k....y..~.^z.O..l..G..^.<<~|D%.p..........
?.......t9.z.y.}...q<,}.t...._.N8I.ni1.......^M...Q9^...,..JG..j...
i.......p.j<....tr...7.>}{./...c>[.VW..._U........b...K.[Z..e
0 %.....$. u..b.N.&..S....{4...U"M...a2.g..(S@'z.Q..6..S..f .....j.}..
V.......W.......-..V..j..Z-.....p..j....I)h.....*W..P....E4..V..H.J...
.W.^..t......`.x...~.]N.q.I.~.n..k.w.#.....l.8g.U .S...............,..
.......l...5..N.........h...g.Ui.^...f...|.a..JXqJ.Bi..K.0....y4......
|{~....~........y....eu.Nz..7..~..qN.....5F/...RqW.U4.......]u...T....
^[email protected]?2...)?..k.S..,...rw)^%*.P.|.H....z.N0..Q..y5n...".....B'
.NG.r....V...Z.4.8...........4..i.|G.;..k..TO.....w..x......j.......}.
?v7......._FH..u..~...D....o._.f...k.c,.^..K7...:^.c..t......i:....S..
.SI1.;e.v....V..F...R<.2...6 T...6*..K..J.....5.g~_&.yH..BT.......R
;......S....!Q.G#"P.........=$..mNj%.............!..VMq.c./.........=.
;s..Z...~n..y.S.#....c.<.M....!f....^.:{C.u..-...f........c..,..|..
...Z.F......E..*..G..^....!.....k.......#...!u.j:...a_[......n.6.....z
..^.;....x..T)[email protected]=.j..G...z..$.!.{U.4,..;R..."M.....
2..F.t.,?..oN;&...T....^G...u.'..}X.....h.3P*....f.|.h.T.......p...8])
Y([email protected]..,$.i..R...4.....:[email protected].....:w
~........D..j;.<<.....Y....3..[4..|....]F...1....hR....<.j...
..."M..j.}.(.....*O..c..m?..z.D..q....A........q..F....&.x.hH.yyBT..(.
...I....7!.M.v...A4I6H...J7..@e...#ht'~..L.{.Za`.2.s.....`_.._4..=
<<< skipped >>>

GET /en_US/all.js HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive


HTTP/1.1 200 OK
ETag: "a89d9f64c8545f8b1b7c72572d2188f4"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Content-Encoding: gzip
Content-MD5: g7tSjC4YILZvPtnpqLpd/Q==
X-FB-Debug: 0gk9ovic4HQA6uchwM49yJT0YNnZJr2BCxoJBI2vISFstDN wKGadQJ2IGehLL EIzxZhdr8n8MGiH3Sko9nUQ==
Content-Length: 54012
Cache-Control: public, max-age=1200
Expires: Fri, 01 Aug 2014 15:25:19 GMT
Date: Fri, 01 Aug 2014 15:05:19 GMT
Connection: keep-alive
Vary: Accept-Encoding
............k{.H.7...O..3.jd..:B.|.q.v..[U==3..%@.q.F`....../"3...vu..
...9.E.3222"2"....G.'.k....y..~.^z.O..l..G..^.<<~|D%.p..........
?.......t9.z.y.}...q<,}.t...._.N8I.ni1.......^M...Q9^...,..JG..j...
i.......p.j<....tr...7.>}{./...c>[.VW..._U........b...K.[Z..e
0 %.....$. u..b.N.&..S....{4...U"M...a2.g..(S@'z.Q..6..S..f .....j.}..
V.......W.......-..V..j..Z-.....p..j....I)h.....*W..P....E4..V..H.J...
.W.^..t......`.x...~.]N.q.I.~.n..k.w.#.....l.8g.U .S...............,..
.......l...5..N.........h...g.Ui.^...f...|.a..JXqJ.Bi..K.0....y4......
|{~....~........y....eu.Nz..7..~..qN.....5F/...RqW.U4.......]u...T....
^[email protected]?2...)?..k.S..,...rw)^%*.P.|.H....z.N0..Q..y5n...".....B'
.NG.r....V...Z.4.8...........4..i.|G.;..k..TO.....w..x......j.......}.
?v7......._FH..u..~...D....o._.f...k.c,.^..K7...:^.c..t......i:....S..
.SI1.;e.v....V..F...R<.2...6 T...6*..K..J.....5.g~_&.yH..BT.......R
;......S....!Q.G#"P.........=$..mNj%.............!..VMq.c./.........=.
;s..Z...~n..y.S.#....c.<.M....!f....^.:{C.u..-...f........c..,..|..
...Z.F......E..*..G..^....!.....k.......#...!u.j:...a_[......n.6.....z
..^.;....x..T)[email protected]=.j..G...z..$.!.{U.4,..;R..."M.....
2..F.t.,?..oN;&...T....^G...u.'..}X.....h.3P*....f.|.h.T.......p...8])
Y([email protected]..,$.i..R...4.....:[email protected].....:w
~........D..j;.<<.....Y....3..[4..|....]F...1....hR....<.j...
..."M..j.}.(.....*O..c..m?..z.D..q....A........q..F....&.x.hH.yyBT..(.
...I....7!.M.v...A4I6H...J7..@e...#ht'~..L.{.Za`.2.s.....`_.._4..=
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:39 GMT
Connection: keep-alive



GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=9717048-12146311
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 494852603 494804948
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 9717048-12146311/12146312
Content-Length: 2429264
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41
 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-
Varnish: 494852603 494804948..Expires: Fri, 01 Aug 2014 15:04:02 GMT..
Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: 
bytes 9717048-12146311/12146312..Content-Length: 2429264..Connection: 
keep-alive..Cache-Control: Private,max-age=0..Y......).la.a~{..vP..)4.
f....<TZ..3m.... .#....{..:!.f,I....8.L.(..l....wf.s2..6.... yt....
....W.....2...g.........?...n%....<..(@...w0:.,.h.d.....W8G..1..,..
[email protected]]t...v......d..'.....' .\O#f8...r...>..`.
..xV|..?...7..N.95g16.0Bs>..9...B.Y..3i.4.S.b.!.......P*I.C..Q..z_.
_.....n.?q.<...SVE...#....... ........^......e...........;x..|..,,w
..n.6..w.N<..S?>.l......G.w..,....W....U.{..S.A..$#..$...t.. 7&.
.........Zy-..^~l..f.d/..F.P..#.}.*.?3.([email protected],..h
....*!.&.........g*a.XnPQi.J..7..rG,.(.'.EE._*..c0.`...._r'^.?.....-..
...C.P.hy`~....Y=;8....Y.[/....:...|...j]<...5........>wA...l.&g
t;7<.O5.}......j.......k8e.R!.... .]<OD...\..yI.......#..`.S.E..
.......;..#H.bs=/<.....R....R.Ygn5Bf.1#.JE.....-92....Y.....u.6....
...e.d&a..,.9.y.......^....NY9C.W5.....Y....XC.....E..|W....3..5......
.{.....Hn~....Ny/...Jos....Bv.q.....s.L0 .KL.W....8.=.<.....r......
..h.=!^..#3k.U.B!>........P..L.............w......@n.@}.y..|.8.. ..
o..um..it.5.9%.).J.d.-....p'q.........~.....c.z..Z....N\...n.....C.7rg
:...~....r.u~..f...$....U..".F.w..H....J....{.f..$.. ..U&p4i"..(..
<<< skipped >>>


GET /freeride_marketing/SDM/SDM_standard/header.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dts1.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 21 Feb 2013 10:04:09 GMT
Content-Type: text/html
Accept-Ranges: bytes
X-Varnish: 1140614167 1139395939
Content-Encoding: gzip
Content-Length: 1002
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:02 GMT
Date: Fri, 01 Aug 2014 15:04:02 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........Umo.6......W.Km,.....m5pl7)....n.."....F....#...=./s......I
Q....{....../......j.7..g...Z....s>YN./^...,.(LjSU....5{........Q.n
......og.....4f!3.....-.[..2...Kc..5&![[[.9.q....6.*..F.i....wh.b... .
.5V......7....t...O...qE*.......!..}.#.....1.....PxC. c.....&..Z...GZj
.W.r..j._..1tfE.vO.....)......u.V..q|[email protected].^...m..........
.......c.."....P.a...t..........WR$HH}.CV..P."2*.,.t.Z.~.....V...[...g
....,........h6....d..........l.....0.4..\8..M.$..3.)).P..`..v...^.kth
C.........)9-C.y....4RP#...4G....;.`.&.Df.S#......|.D.....p.XB.*0..$Z.
.,.'.5.5&....8. I.d ...LYo.F...)...)......=...S.U!U.......G.x9VeM...V.
4"01D5...Z..iJN.....CP...). d..9.&... ....A...N.'?.....|..y.i...H.....
.....T....t.Ic7(..:.'.85e&.~....H.....^h.%..;..._...O.gs......_@v.....
.......n...[..7......M.....b.{.d....n.....S.m...)`vlF...1..R..Ic.Y.l..
.....I.....6..U....S..p...........&.gph,.1...V.X........5...r.... ....
...,(I...V1.iaHt.....q.m...l.....0,.QM|{....x"~y&;t..n.......A.D~.;...
.....~.....7....w..)0l...HTTP/1.1 200 OK..Last-Modified: Thu, 21 Feb 2
013 10:04:09 GMT..Content-Type: text/html..Accept-Ranges: bytes..X-Var
nish: 1140614167 1139395939..Content-Encoding: gzip..Content-Length: 1
002..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014
 15:04:02 GMT..Date: Fri, 01 Aug 2014 15:04:02 GMT..Connection: keep-a
live..Vary: Accept-Encoding.............Umo.6......W.Km,.....m5pl7)...
.n.."....F....#...=./s......IQ....{....../......j.7..g...Z....s>YN.
/^...,.(LjSU....5{........Q.n......og.....4f!3.....-.[..2...Kc..5&
<<< skipped >>>


GET /beacon.js HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.scorecardresearch.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Expires: Fri, 15 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Content-Length: 1140
Connection: keep-alive
Cache-Control: private, no-transform, max-age=1209600
..........mU...6.}......CF.l/.4..k4.<.h. i.\..(.bK.....".{.e..M..".
3...sF..(_[3;...J..._..)A.m?).. <..U.V....ce.......R........J......
.$........{q.|...x#...;.[,.7....r'.p....p.6......7....K.A.Jv:....eJ..V
...vb...q.5..$!.........M.(b...=.q...sZ.6:...t<.Rj".0.X"#.Dd...f.5.
n....E0.*.E..tRy.>i`..\.......`!.Ed.^.....}..".~.l.?.9..6....s.1...
z?....e.K >..0....W,nd...k.....N.g.G?^:..(.cS0c<..V...P#Bjo....M
.....0..o...,....A.p.....\...Z'2T5.........^[email protected].....
........l`y..1.,.h.N......d.......< z<....c.g..G.f..M....._..M.3
=.|... .r.{-.. [email protected]..]G.<"..R/j........U.F.\..Q.c.A..u)....6_.=?..
....~q1I0.l....K^...$......f..R..j..A %J4Ip.....L;..m..i...~(......_..
A..z..Be .b'.....r..8".i.t&.......a.~..8..C....P&d.....*.M......'[email protected].
.b...Yp..v/l,.3G9.......2I..[....]`.X8.q..>%n..t..nW....!.. ...M...
...,.%.....>#k.g.A.jf..sC`S ..v.{[....$~F...|..zr!..hK}U.....N..S&d
"...v?$..|.V.4QWy.....T)K2.T.'........Ee.j<Ml:f@...{....i..7...d..Y
.7 .;.y..zmz\9.a.....Y..E.,.I....-e/V.%......Z.........../Y....)..O.6.
....h...G.8../.9.VzU.....C....P...s....Q..e.;.....>*.k._kd...9.qJ..
8.L........o......J-.P&.RY#.l}. ............g...g...".Al.......


GET /b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1


Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.scorecardresearch.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: hXXp://b.scorecardresearch.com/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
Date: Fri, 01 Aug 2014 15:04:04 GMT
Connection: keep-alive
Set-Cookie: UID=31aee1e-23.15.4.18-1406905444; expires=Thu, 21-Jul-2016 15:04:04 GMT; path=/; domain=.scorecardresearch.com
Set-Cookie: UIDR=1406905444; expires=Thu, 21-Jul-2016 15:04:04 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
....


GET /b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1


Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.scorecardresearch.com
Connection: Keep-Alive
Cookie: UID=31aee1e-23.15.4.18-1406905444; UIDR=1406905444


HTTP/1.1 204 No Content
Content-Length: 0
Date: Fri, 01 Aug 2014 15:04:04 GMT
Connection: keep-alive
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
HTTP/1.1 204 No Content..Content-Length: 0..Date: Fri, 01 Aug 2014 15:
04:04 GMT..Connection: keep-alive..Pragma: no-cache..Expires: Mon, 01 
Jan 1990 00:00:00 GMT..Cache-Control: private, no-cache, no-cache=Set-
Cookie, no-store, proxy-revalidate..



POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:50 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html
....


POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1


User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:50 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:50 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Conten
t-Type: text/html..



HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:05:01 GMT
Connection: keep-alive



GET /system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Content-Encoding: gzip
Content-Length: 219
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Connection: keep-alive
Vary: Accept-Encoding
[email protected].....%.k...Efi.V.{w..4.....y.......p....,v=
q.G8...%..v..k.>..,..~.T......9..Le..~yJ....>`.Om.6.....X<...
....teY... I...L..I....f....jkO...A.{<DE....48rD._..Q..>..8.>
.....p....A`.G.......5.|.......


GET /static/marketing/main/css/templates.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 1650
Connection: keep-alive
...........Ymo.6.....[..I.G.{....4i.uN.z..e.d.....!.M...}|[email protected].
.x.{.............}r.:zqlY..G.,.p..j~.K..l.....*g..k.m.at ..-k.fM...CGX
.B..T.../. .h..eJ...f......hZ.u.m..b.,.d.D#...Yy..Ds..f-.2<....E...
.n...h...>... j-P0_.....G.H...o.:..ny.......Y.x8..Q.G.uVl)](.o.o.p~
=.\.'...y}.K/....(.t......B....Hk.[....A.....`o.J../....G..&..8.(.....
.I..Nc..%. .....b......e.1...?.t..PY.|1.^.4.......7.c.N[ .G.UG....f...
. ..]..3._g.]...kz5l...|U....\^_O.'...6....pC7..x..W....%4s.._..3vj...
 ....w3.Qz][email protected]~...'.<;.<...1...=...H.........W.=V...?.k.~
y.F.`.{K...#w...:O..iZ....!.r.8^U.P..T8.?...;.=<....2.E.....T.g....
3.l....1...B.Qz?Z...".....1......sQ.3E..X!.,S...eH.L.."..g..m..E......
..Q..~{..xuJL(..,%.A.H..Hi........Q.`-.K.n.l...s..O.<.........?..o.
x.X.?..U.`/.J%x...z...$^G.h..w..;..W..-fj!.Sr..L...k.....-.....C....Bj
...a.....'.j..GG.w.J...C.....8*~7.J|.a.Y...JJ\mV..G..Cd..Q.Y..".n.....
7.#..6Bk6;.g....ITE...U......4..5F...5.v>.;"..r5.2.%..aQ...........
T.....6.g.n.#.?..g..r..J...H0.Lp$.....e....~8..s....F.%..u...I.v.l...i
.......B25.e....D#.....L:.M..l.lZ.Y.8...w..L.".?.sF...yGiKu.J!.UYr8.,1
.K.f..R.R..Q.......J......0..6....._..H..;W.{.^_.qXV...j~j..../......}
`.%.......D-.(#.b._....v..,..;..B.b.5.....R...}u........gk....R..Ca^9.
2.2Q..XP/.y.....m...}. .W.^.*....],...._p.....Kf..A.:.)P.e..:AR.E(.;.j
....y..R.7;a.G-..Vh ..........*..-.X.1%.......G....3A...5..W...3....r&
gt;!4..|Q>.(.-.,.S0.....g.D.e..k.k.k ....!.u}50...R..h..\u.../...J#
.~..L......$.......I.0.......D..).....S.q..dDt.>.......kw..._..
<<< skipped >>>

GET /static/marketing/main/css/gamebox.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 940
Connection: keep-alive
...............0........LW7".7z7..g...$jF$..m....'..$r.......%...O...!
.SG..p....S.O>2r72.."...|..w..m.&Szz.9[.7[......j.a..%!8......~3>
;...h.2..4...soNO..d...j......l..L(.6.c...?.%.,..3.tfWY .....tu`L....%
.......0.3..i..(.br..-....K...1..*.....T...U._b .o.P..<...3.. .Gq)N
...@e%....).<L.ZT.........#&..$.=N>/..7..$o......!. ..ak..0&i".B
Oc_.*pD,.....T.....?].<*.[.aD..b.^O&.b...(..(.....vY.-g.........R~.
.(..B.~.>\=.....".x.?).T.$ ..ED.(.Z.......]...g..{..\N.s...0N.j.R.h
.9.l.....'J..yU....u...P.c...K.........:.Q..w.[L.b.=.L..*6zg.R..Wf....
.&4..Ui....EH^l]...%..........9.S.e..w....R.j.m.e.v.?...u.D..@].7...do
.t.3Y.\.9.!.).Q.......V. ......i..!.9.(.&..N....&...k...Qj.....$...-:T
.....{..P../X..............y....o..!o..".....=.kR7.]......][..~.\.6..&
gt;.........m....u#y....3...D7...z3...*..=....BG.9.;.=k......~../....%
...1....Nh...hM...*...z..x.........Up.....S..f....... .......Y\qY.G.b.
...a.R.Fr.Qo...S.r.C.^...86fr'.[e.aq...$.H:..?Y@..........


GET /static/marketing/main/css/hover_elements_sheet.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 409
Connection: keep-alive
.............n. [email protected]....:....'N..H......f......!..... (:.
.Q..kKy..<.eG.Tv.c`..5.V.../....Q.w._..]_}@....z.../X.Q]V .I......'
.UW..8T...Se...Z..(.Y.EI&.^........!.\.. .t.,Z,..%..j...R\5....._.....
.....7h..f..|...L.I.3I....R..74n.Mai.x:Qp..,..AI..=:...2.gA.-. ...I.B.
yb./.T.....?q......\r.|.Z8..nQ.N....Q..w.;........^..d.9..h....'>.,
^..b.,x.|zfN...BS.B.gI..C...e.&......".........0..<Fl"....<.....
.....


GET /static/marketing/main/css/download_assist.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 217
Connection: keep-alive
..........}[email protected][email protected]..:........[..OW....f...3;q...j..6.0X
. .V.......B.*.........2] .V..F...%.:...........y ...%l..^mU,...b3..G.
........`...M..>...&...8.DqV;5.....{8k..G.H..d.u...%.YBg..=...:..@.
~.Bdq.........


GET /system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Content-Length: 284
Connection: keep-alive
.............J.0...W.;.^9(i]....d.!X.........%%.Ze.....^.D.@ .../.azzr
...tI..........gC.|........t\.....)fdH.U9...]...V ..*.q......l..1./h..
m.0..m/.ik7C. ..,..~....a.d.kP..g....)#..1.l.M.O..Q..I.......|..9go.h.
...el....6....\....$Y....,b.#<...bv.=.s...Q...g.#...........{G)....
=.?........


GET /system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Content-Length: 46010
Connection: keep-alive
.............W.9.0.{....}w...!.d2.;...'.._.Mf.........Yw......V.>ZR
..&..g.g....R.T*.JRIz.......*...].[[.............$..N .w............}.
.K.pp..G..(L.....Rk4Z:F.d.8L..]8\.....`..s....k....(...u5._.....q.....
h|....:JX.n{....N.!..;.i..}'...q;..E......4...8.......,../...#.>.38
7....,.'......D%.. \r~.bz..g).M.`..4...`....m..Q..K....(.D....O1.9.1..
>.._..QX.#)..L/.t..W.u/...I......e.Ys\7..U..^......,:[email protected])u.>
;'..f.....'.Q.^s.../_PJ...0I...C...m..4Ip..-.....5.....J...q.*......._
J...1..4....(N.K.8^......0..&......*.......@~5g........3...$^.oZ..ra#.
.B.....g..n....0&.J.7nS...}D...&iB...@1)I.I.`:.m.....FL......(.\......
.Aw0.nSW..8....\n...N.....Q._..  ..gq.ut.V\..b.:.o.......b...x.T....X.
.2..|....(...b...L..su~.X.............t4R*c...... .<.............$V
..S.h;.......,...x..'.H....nx..:...&..#.c.k......F.01.0.....&.Yz.s,k..
v.}.................kCA..:}I}..7.P .9...Q..>b.5l....8...>.,.Bz..
 P........s.a...=%.N.U..'.. .....y...... y.j.F.z.)..j..I.......B....v.
.l@..*......eS.XJ...ZY.Dl......S..!...*:...X..rf.|.Di.T..uy........}&g
t;.8j.`0...0..K.Q<...Fd9......q2...%..!..yE-...1=E..E..Xc.q.....w.=
9n..[.v....hM=8.n.u.........^..s.9.1.T..y{f..>...-..Q....6...U"..%.
..p.:.W(@[%...az=...hc.4.10...pIdZ..\887.^....&.8...i8.0....}..(6.8I.x
..%... .O.?=U..?....K#.*.|.......0S5..?*:[email protected])N...(.$.?
.7......W.H.p<....r@1,........}`.0.).....C..A.2.....ls..J2zCN@9G.@.
K3..b.^..."5Hi-11a}..H..6..d...\...0..U......./_...&.....16......k.I..
.&.|..K....x4....Z." B..H.)..L..h.g.g........c2Q.]..:Si.%.&.SyJsA&
<<< skipped >>>

GET /static/marketing/header/css/header.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Content-Length: 1821
Connection: keep-alive
...........Yko.6.......i....Bn..m.'[email protected]............._IrN.Tj........N
...N/5.*X_.....i....^...D....UX}e_...=.%Uz.>.x .?....I[../.6. .b.H 
. .H..b`..,.......*.a.ZJTVw.....c...k..EoP......V...:j.(.....Z\8b....#
Uy..)F.....P.R`....&%%....r>.bP.i.1.hp..A.>........R./....*s...G
.#o.f<....sX.k....gf..Zn.7.V..M...5w.s..(.......SL.!.....6o..3.p.}4
..f..... ].0#5..)Y....7...s.MF0.Y...|....a.b.S...........T.<gQ`..9.
..'.}G)...Q...y..0*.! .....`.=..O.!..<....9...D....d....s.~.,.sP..q
.k_.ok}C1_)...$....]..H..x...=..v.7J./#.M.....<==.s..2R6OUY........
....bTV-M....N.xB..y..|.RV.gX...`.f..tcf.........&.jk......fSW.q...\l.
;&....u.(........t.}.d....D.....$....<.....MV...)I7..l..E.A@Z......
DO.Z.CAz...IBZ]-..X....%?a...L.I........C...d.......D.2.....@..){T....
8....t......ieUT.H..|nJ.#Pa......i...\......0.q.....n.......gP.s..u.D.
Y........dg....s..h7t.{.0..lbF..1:...Cz.me.EgV...t>x .\.E.1.|<..
..F....0.(................t<...[. Gm.u...L>....xxE.u.....Uvz....
..X...n....w.....W..[k97Y.]......e. ........j..9..s......c.....;. '.s.
de...... t....9).....".Y..9.....(...&...._.* O7.6..C...*.N...k.Y...^..
^.............6;A.........m.(..1..:!...u...@(%g...nh.....dO.....h.)k..
8..`<.Q....9.\..b.wEws..*{...j...j.V.!.D.u..$V...Y....iQCXNK.l.3...
...F..2.....y..?T.{...x..w.!...7^*.... *...Hd..NH.....A......P)F...^%.
..............3(c8..=|..bO4.0.........M.....k.9RW ...z!....T5yH....Y?.
Z.....s.&G......6y......Y4B....(<s...c......F.>.@...%.a$......R.
...6y......a.......H.G.((...K....V........ .G......c...q.fB...3X'\
<<< skipped >>>

GET /static/marketing/main/img/background_pixel.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1591
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:92F9539BA75
AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.did:27704965522811E1800CB
3176D22E618" xmpMM:InstanceID="xmp.iid:27704964522811E1800CB3176D22E61
8" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:165525FDC050E111B59EE6C32F2CA589" stRef
:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................b...............W..................................
..............................aQ...............................?......
............$v*.#P DE.;..........7..$P....F.U9...)4..7<QA....TRh.@S
...TV..R.0..............Rb.......H.X.R..* ....Vj...).....".J....* <
.y.NqEf..* ..@Vj..*......Q^}.&..>(.... ..B..E9.yTS.Rx".E .r....
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Content-Encoding: gzip
Content-Length: 1052
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........X...:.}.J....J=RC..\.SO......p.U..13.F... !..!.y......^....
..\....aD.lS.....6..K.T/n..8..8~...Ls.O..>|Sw{B..LW...yC%.,....>
..XaQP..G.n%WK.>~..&.AI..i.}..mx.J......K.8#SI~.&..J%y....%..ti...(
..!..y......`if..b.K..G...nm....\.A.. e.t.AS.....8....&)..4.A*L...HZ..
h/O&.K.....R.*u.X.)...........e.P.@o!..St...G.r.F.....G.z0...i........
M.M<hgi.L.]x.......K.jBiQ..QWG..P.....k........0t...3.....;n>D..
.S)....~.`|.....&..N..S.\.%j..N....P3..U..e...d..T]Q..Xt........._..U.
...7.).........(.{.........&... O........ ......V.\.73..j........;.v..
.Nrf.l.7...........q..a..M....(.....2..Y."4.$.u.......j.jN].6....?..=.
n.....x...0d..k.-.~...,.u\q..%@.{z...D.{....^.g|........F..{S...on....
0....?..A....W..|.Q-7. ......v....G[....).C..*<.....}..&..0._}.8...
.eJ..E.W%[email protected];..J.A.3.......'..zE..'........
..R..U.*..<..........v.............=s{[email protected].]..]......n
.P._C...Pr.md..ti.b....Q%..?..a6j..L..D..............U'.........i..4.T
...mI.y.....O..7.U^....sA...L=.8...9...!.jV|..0>..&X:S{.;'....wv.;|
e ...J*Kr...O^......I.l.......


GET /static/marketing/header/img/logo.png HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 26369
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
.PNG........IHDR................Z....tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:B3983B1C9B50E111B59EE6C32F2CA589" xmpMM:DocumentID="xmp.did:D417
35F6522711E1BBABC9A21DA171C9" xmpMM:InstanceID="xmp.iid:D41735F5522711
E1BBABC9A21DA171C9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5079397E5F51E11183EA8A
A91EE6894C" stRef:documentID="xmp.did:B3983B1C9B50E111B59EE6C32F2CA589
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>......c3IDATx..}.x....;.]....^.{.........C0=$..
HB .BH.PL...B5.....m..\$.jV.]..2..3 i..-2$_..}4..v....s.S....w:~|../..
.<......&.G............._...r#8........."p....t.~.....#m....H[W@...
[email protected]<.G...J.7..G.ZW..F.b.G...XO..#.,...p.NO.....?....
./.*9`.. .A....._....=?M..i./A.{....?......?._..H:..D..|....w.h..... U
..h..G..?Z.Ft.HMX.R.W.....A......8......{.......<$...|...Ep...g9.;^
..................49....To....j.....t%..H.q..@V........<h......v..'
[email protected]. .!.............^..]O..s..'.......M.%.Pp.F..........
<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_left_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1227
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A40556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8DAB8A3F556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................].....................................
.......................3s.....................Aq.2r..4............?...
9..'Rk...7UD....I........
<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_right_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1244
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D90AF3B556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8D90AF3A556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................d.....................................
.......................2r....6....................1q..2.B.3...........
...?...`S..4d.!s....m.|>\.N..h..L.........
<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_pagenation_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1260
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A38556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8DAB8A37556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................j.....................................
...........................R......V.....................Q.....S.......
.........?......L.*.{!r......O..M..-...hoF...u/..&V.......
<<< skipped >>>

GET /static/marketing/main/img/containers/green_pagenation_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1256
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8568556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F87F8567556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................h.....................................
.........................a...R.....f........................R.........
.......?.........x..TB..w2".&}...>.O....3$.P4.........
<<< skipped >>>

GET /static/marketing/main/img/sprite_sheet.png HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 272240
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
.PNG........IHDR.....................sBIT....|.d.....pHYs.............
.. .IDATx...w..E...3.......{..J...E.P.... "...P.G,D...E...G.GQ.B......
..o.-...ef~..so.... .;..k^.g.........g...B..TPA..TPA..TPA..T...Q......
....sy..........`.<PBl.^.,..m....= .!.. WA..TPA..TPA..M....n.....2.
..H....".T.G.u...G..5.m.F.....vk.......!.R...().R........"^.r.TPA..TPA
..T..D,..3...t...z`v........_...x.".T...Hk-.Z"m.BC.C.0"..Qd.Z........ 
.@)..$......qp]...."@E.....*....*.............K.H.i.........#...u<.
...C'......?=.HUn.{..X...7.....Z...A...C. .a..@..'.T..=.. %8J.9......!
.s.<.......*[email protected][email protected]../....BX...........
TPA..TPA..TPA..TPA?.....@l.. [email protected]..?7bo......C'..m.....20...X
V.B..b.!p.!..<..<.......... ......\."..4.!0*..A...!.&....c......
.....[_o).;...~..5.......V....lo/..6...B,.g...(.h...k.....a.!......Rj.
y.B..:7q.A..}.....'...:[email protected]_.........?..
. !.. .j..2.j..,Y..L&..5k.....7.].~......H)....UUU.UUU.........#.<r
...3.....}.c..1.\.A*....(..p..w....u..~.....>.8..|.c.a...y..w..n..k
m*.G?i....O...:.] ...[.....).aJr.'......... .J...k]G.S...x........m...
.......{.a'._.......R.%K.,...[n...l]..>)...R...K.s.r..a.*..X.G...?.
deTl....U.....\.n.WX.9..\1u.......&Z..$"U-".VV.<..i.q.P....D...#...
2..|^.(..?'U.uS.././j.;...}..%.....%>....W...(.|`...........J^.N...
[email protected]......@'..o..9$..t..`.......f.b..W...kL
..8.......R...Z.`H.x...l.&D).cA......h .....%....".#].^....tK.*.....D.
...F.#.q.....Way....O....hw.L.......... -..HDi.k.X|.H....Q.A......
<<< skipped >>>

GET /static/marketing/main/img/containers/labels_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1313
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:A53B9BFC558811E1BDBC91B6FE137091" xmpMM:DocumentI
D="xmp.did:A53B9BFD558811E1BDBC91B6FE137091"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:A53B9BFA558811E1BDBC91B6FE137091" stRef:doc
umentID="xmp.did:A53B9BFB558811E1BDBC91B6FE137091"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................c...................................................
.................................Qa.b....V.."....U....................
...Q..........S..TU.............?.....;...dz..r$Y..&.C.s5.H...v.=W<
G..-...:X=..rV...Z.QWv.O ..'.<.2...<..&...R..pH0....=2T.z.,I....
.Bv........1.r.....4.e..-|G$.TBj&xt.....;.........
<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_top_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1242
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D7B2B6E556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8D7B2B6D556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................b.....................................
.....................a.....V.....................!....S..T............
.?.....D.F.......c."Y.i...2Jp...........


GET /static/marketing/main/img/containers/yellow_corners.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 2323
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:AEB0E8BA556411E1A2C0A3AE56E
7EFC1" xmpMM:InstanceID="xmp.iid:AEB0E8B9556411E1A2C0A3AE56E7EFC1" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5069219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
..................I...................................................
....................................!1..Aaq.Q."R.#....Bbr..3C$d.UV....
....................!..1Aq.Qa......"2r...Rb......#3Ss.$4............?.
...e....g...J...[p..:(&.t...k.3.R[[email protected]
..._}._....W.....?..$..m.........L.G .~T....2..h..~..u..5=<. ......
y.t.....0.e[\..8e......=..........j..v.z.o...5.a.\...A....A ......
<<< skipped >>>

GET /static/marketing/main/img/containers/green_top_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1235
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F8486FDE556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F8486FDD556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................`.....................................
......................b.....V..................!..Q....S.............?
......S..hH....2...1%..yY.!......


GET /static/marketing/footer/img/footer_pixel.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 8258
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......Exif..II*.......................................................
................................................(...........1.........
..2...........i..........................'.......'..Adobe Photoshop CS
5 Windows.2012:02:16 17:49:45...........0221..........................
......................................j...........r...(...............
....z...........2.......H.......H.............Adobe_CM......Adobe.d...
......................................................................
......................................................................
......."................?.............................................
.............................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S
...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw....
....................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......
&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.............
....?..~.o...)*{.Z....z_k..G......uI$.........Photoshop 3.0.8BIM......
....Z...%G..Z...%G........8BIM.%.......m.l...F.4..?|.‹IM.:..........
..........printOutput........ClrSenum....ClrS....RGBC....Inteenum....I
nte....Clrm....MpBlbool.....printSixteenBitbool.....printerNameTEXT...
....8BIM.;....................printOutputOptions........Cptnbool.....C
lbrbool.....RgsMbool.....CrnCbool.....CntCbool.....Lblsbool.....Ngtvbo
ol.....EmlDbool.....Intrbool.....BckgObjc..........RGBC........Rd  dou
[email protected] [email protected]  [email protected]#Rlt.....
.......Bld UntF#Rlt............RsltUntF#[email protected]
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:44 GMT
Connection: keep-alive



GET /free/frg/products/667850/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 13 Sep 2010 08:37:27 GMT
Content-Type: image/jpeg
Content-Length: 18940
Accept-Ranges: bytes
X-Varnish: 1111897303 1111053655
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.........".2B..Rb#..r3$.C....Sc4..sD%....T5U&.......................".
2B.Rbr......#3....C...S$...cs.A...4%.5............?....&....Fy.F.X%[".
.tG...N..F...5q=...Sl..cd...D.0k.m*.\[email protected].......
.X...P..6Q.......Z.............X.El.f.....s...O0.L"..:.q..u...$V[....X
..8.DKn..2svO..fq.,...yZ;[email protected]......`U.{..,*.2
...j.(..he.$VE(..Q..8.....H!..T..I$.......t.&.....\......X..Gt...g..o.
4R.a>"].q...&w~..Eu.]....i%*.......0..../$..B..5..{m.\b.zP..Z...Z..
A... ...`0-.W....$.T9.r..E..t.e.9.....$..%uxiCX..%d;k.....yt.E..j...~.
..J.HUV.".J3k.......b..i.h...Sj.Bi6l.,0T..][.,....F..~......or.o<..
..\.u2P..%m.XZJ. !.i..K.......j.. Yf.......Ta..jHb.J..0.d. [.0..S....$
.J../.O...bY@.....\... ......X..1..u....m[..E.....(....G.6K%..S9e..O..
....@.$.....C.....6...JA..v....a..*....f.3.*..6..H.. Rt.........i$ni..
..M..&o...3..a..1.p.....V<.E,Fl5..(.q."...<=.......o...HJ......,
...l>..]..k.K....o.' *d.1on...uSCx..$...8.{.o...HcN....9.p...:....]
]z...Z..i$#.4=8...i...y.d.`.4S..j..QW.Nb.....D..Wfl..@.<.cq...5....
...t6.C..n.....;.g.....9...IJ......l;y.6...p..j........\`.. ..V.$._.L6
.H.LU6.. U@..."Y{`[email protected].[..g/..c..p.=..!.P.(.4......=(.<.;.[I'=!
.I$eu.|..A.43.X...".U...<[email protected]....%.}.<........:
<<< skipped >>>

GET /free/frg/products/558350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 06 Dec 2010 09:43:23 GMT
Content-Type: image/jpeg
Content-Length: 25436
Accept-Ranges: bytes
X-Varnish: 1111897184 1110525835
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:24 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!.1.A".Qa2#....q.R.$....B.3S.%..rC4..b.cs.T.5U'..........
.............!1..AQaq."......2...BR..b#.r..3..CS...$4%............?...
....\....l....)(.*J......oK...F...@..)....^r..uD...Q1...&3h.....Z N.D.
....:..}.}$e..9....U.-(..KpR8R..M.$.xsT4..<@8*...P...-k.....2.Q5D..
.O...we=..L..u..}.. .....pp....}B......"|.<.'tr.X.YO....gm).S.1....
&m..:.*....zN8\.].h...Vd..)..D......."4..l2~........h&...-.&...Li.-...
.5..e.ql...... ...7.(=E"k..c........;-..D...W.U.y.U..UN8...Q....^.../L
].m...u.<[email protected].....[h....../.62......8.)# ...Fa...lv|..y..>..[..f
...#."z...;.........V.\[email protected]..?6.......XY.b."L. .b.b...T./
.M[?.c...0.P8.!<@....$..r.O...^....l.^A.!.3\SbI.;.....f:..Dj....%%.
.....'.. ..[l^.........5<.....T....8...z.z\UW.O..'...8..s......d...
a.M...N".!8.. ..N...:.%d.f..M.}'...x.FBwDT......Z]h._}....Y.\9....R...
.z\y..=...e.y.&...Ui.N...Wp..[.....!p.4..^.Z.'.L;j$.=.q.l..\J%.)%.)..u
.....O.9.:..R.........h....K.".Cs...5.!........3.}/..I,.....c..>U..
y8f'....l...)...5v?..8...!.=e....a.c...n....&..C.z.7<..m..8.....T..
.........P.........0(!.9...K.4...8..nc....'....rn_.j.e.`...j.. Q...-7.
...H........M.....fG..f..0..`....#........f..np...y..2|jIA...P....w.wE
Y.fp............"E..! }lR...6.`....".@HJ*......w.8...o.....S...!L.
<<< skipped >>>

GET /free/frg/products/642550/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 08 Dec 2009 12:23:38 GMT
Content-Type: image/jpeg
Content-Length: 26784
Accept-Ranges: bytes
X-Varnish: 1267047727 1264829550
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:24 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!.1AQ"...a2#.q.B..R3....bC$rSc%.s4.......................
.!1..AQ.aq.".....2.....BR#.b3..r.C..S$............?....Wf........."...
...H..Oj.../....Ulg.r,xVOOd......].....UE.uB.E.....t.....E[.I*J....7.x
w...zhe.D^.|."..$...jj_.6S.)..).SV...H..t.....^JUK....`.h.M<*.6j...
*.....u...E...C...$<...).E......l!-;....z....|.4..|..a9Z..... .&.h.
.H...}W....\.Eu..1..Z7......U...%.N......}:....U......mU...6d(..h..&..
.w.D.TM:"..b.....yG..7.......`..#5"....__...u....r_....}........%. dpl
.....#4.P!!#1T5.vMSN...../.....R.&...U76..fN.m..nd....mlR..("........w
s..cF.D..Zj..aY.VU.Y..nI...qeGQ.s@......]QQv't.^..X............]K..U.w
Y5~B.....H.C......nWD#..h..It]Wr.u..#........7....*.-^O..2{.b.lG...9H.
.:%.d..m.&.%_....].^..;u.....e...a...}.W.......].jd2. .q....M....zh ..
5.6.8..n.m..B..>......y5...]S.t..VO.h....c ..$A.Zz/.owF.m.^r...3O..
.....:...........Lw.).n.....&.f.....* ....-..N......A...A....a.8...>
;....7..'..Q#.&.M.....nEG.SU......rhtM.Ow.........L2r..v...K..:..'....
tMS....)k..*...h...A......".....C..A.5..z.H.&L...:...a.W.;.........&..
c=*....G.$B.n<.."......Q..KhE......S.YK}9.......L.g.. 9.K/..$...7&d
..:..MU.M.....-.V.P.q.E{?p.v..7YHhf.....U.....G.......D..,*.P.........
k`...I.U=..Dm.ai.]9........_o_....V.#.\NU:.^.i....fef.|.^U.0.(.I}.
<<< skipped >>>

GET /free/frg/products/764350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 26 Feb 2012 08:57:18 GMT
Content-Type: image/jpeg
Content-Length: 12274
Accept-Ranges: bytes
X-Varnish: 1679730039 1679251035
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".........................................E.......
....................!1.."AQ.2aq...B....#3R.b...$5CSr.%4...............
......................3........................!1..AQa..."q..2.....#BR
..............?.......\....qOI..uD.JKi$.6..........v....-OU..`1=q..XA.
..l{[email protected]#=.*.$.....c;M..m.. f
..,u`..ETQ .....;N......~XB0........G.o.|1.....B..Xv{JU<..[..v.. .]
A.......v....ck.Q.m..PT.{.$...f2.h..t.O..Z.\U..xq.....;R....W.T[X.B.B.
......%........6.|G..T[....f....|.Xn.H......`^..b?6k..(T..9;.o......l.
.4.)..Ts.t....<[email protected]\5.....i..2.G...r.\a...F.q.2kDv.[c..r
[email protected]..:..*(Qf..}\....E.SP.Fi.DX......%A.V.B[).....?..../.l
*.x....'..s-..{1....c......(..b.}...V'2d..JMR...*..R......).\.....IH..
.O....T.T...A........B....2\.........f.Q.......Y.'..(e.v.[.A..>...M
......pe....X8..`....lx&......[N.[.<T......6[......].LdCA.....b..kE
.....t6..O....Z6W...Q.II..._..enkr..k=5....y....'.lHP..V......V$......
"X  ..;B.l....)L.Dih!A.7.n..mo..'vH.-[d... ..N.Fi....... ,.......P .V.
1"....G.^...;...!M.%....R:c'.Fs.).d\nZ.u[..-..94......[RcA..d1..,...).
j...,.g..Qn-.xE..b.&......e.'.TO[b..oda..!#6K...y.6....R.....w..6.E..C
Hv...7C.....%...(.....E.u..>"..;S.Zk. xHe..|#....B...g..f.&.... ...
$....U/j.M..f.r...'...,..F..'.Ea7i..(..g.D...rv......c.yIU.<K..
<<< skipped >>>


GET /free/frg/products/710650/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 23 Nov 2011 16:04:30 GMT
Content-Type: image/jpeg
Content-Length: 20072
Accept-Ranges: bytes
X-Varnish: 1156353546 1155589963
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......H......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
[email protected]......
.......P.....d.\H.. ...ogl."."H..)..K5).|....@...#.....:.... .xA.?O.n.
.~...p..0S...q.|$(.....^$..:..~." [email protected](.a\...,.
....e`.\.. J.o..^....J..nh:.......Z]..\.\\1.\...E,.f./...,.z....,.....
]F.....*"_.f...:..:~....O>..!.(... |~..Tf"z.z=......n......-.....6K
......Y..U..<......5Q...8....6.....q...j$}.....*..5..qip.......9..q
I..AwM.*i......8.1.P...).......E....1.....W.A...w.{.6..k.7T..B.B.M....
.......o.....o.yG.h..u1...{/...1..5...V....7._......z(...|......N.z.}.
..r.../.G.2.$...b..L.. .Y..R...G..?..N[....d.|...u kkW..i...h>...e.
....$.BD......3Z[......@..,.?2yb.....y....Gw..H.kH.......6.<B..vzc.
3X....Z;K}S..Z...csB..M(....s.....2...Y...g.n...Km..V.;.Q.....t.m..j..
...*.)....X.....|...:]N,..LG.'.n|..*.!.....^..7...n.NN...l.k.F.....G..
;..v{......: ....?e.?Fbk3.p$.....V....y...F.|.a..V._-.....(N...W.#
<<< skipped >>>

GET /free/frg/products/632750/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 08 Feb 2010 12:06:05 GMT
Content-Type: image/jpeg
Content-Length: 22958
Accept-Ranges: bytes
X-Varnish: 1111897218 1111532531
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......Z......Adobe.d....................
......................................................................
......................................................................
......................................................................
...............!.1A..Qa".q2...R#...B...b..3C.rc$%.'..S4Tt.&...........
..............!1..AQ.aq......."2..R.Bbr#.......%.3Cs.4d5....Sc.$6.....
........?....b....T)m.mCD.....t2Q(...L..{....~Q......:c...A...?...V'..
.m..v%?..R..h.$...uK..O..?..r1..2...;...P..A..Q..1.K..*(>"..j]...H.
...Y..`7..F).p .H.......1..(.aI.6..5JQ^..#.u.-........xCC!)..G_.T..F.2
...I.....\.a....?...iSE.u.....9..EAQ2.0..)...R.g.....5........6.|4....
..~;H...z...T..M......s...8!TE..tU.#....P..e.....?.8..I..N..a..hd.I.&l
t;I...F..`...#Im'.$.u...5....9....z.~..m...h.a5.%@........D...X....p..
...-.~)5....:..V..G..e..VT...B..^...R&a...h...j<...:X"7..*.}.- ....
.@a 9...YXY...j..#]k.|...."2.4. ........#l6.......|..P..8FA....[~%Z...
.R].8.-..u.....J.... ...aAi).;S.A.Z4..')......S.?n......}0..OR.|..~.m.
9JPQhA..C..c....d.}).......T%..o....*..........B.~...L...#.f=T)....z..
4.z..../.c.W....J.>.].Za.{m..jIK..N...t.."..Hrp....u;..G...0....".)
.z.|4<.3.....O..<.v.FpM.%..:.. .4<.._.X\|5....sj.....]Be....`
.....QO..M. .F0.....>......#.......Ec.\...s..5)p.[5..Y..9..n... .dv
..}Z..".....G.`}G?%R.....8.wT.F>[email protected]_...w.GP.1..
....O.Py$.}.q...%...8 .4Fb...'.D9....QJ...[B\.....j...B.Sg}(.... ?..SB
..3...H...C.z[.G.wUH.M)....lS.h$.a..\Yq!"i>.H.]....T.:..n.4..0&
<<< skipped >>>

GET /free/frg/products/765950/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 26 Jun 2013 11:57:29 GMT
Content-Type: image/jpeg
Content-Length: 49185
Accept-Ranges: bytes
X-Varnish: 1109789826 1108363347
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:24 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE2119
55FE55656C7D978" xmpMM:DocumentID="xmp.did:BF9ACF03DE5611E29D5CD82168A
991B7" xmpMM:InstanceID="xmp.iid:BF9ACF02DE5611E29D5CD82168A991B7" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:CFECAE02DCAD11E297D7DA6E15F12B17" stRef:docum
entID="xmp.did:CFECAE03DCAD11E297D7DA6E15F12B17"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
......................................................................
..............................................!..1"...AQ#2.aqB$..b3..%
E&'.........................!.1.A".Qaq2...#..B....Rbr3$.....CS......t.
..c..4T.5.d%&.............?.L:.r..PT0...T.1.2..N...F~-N..us..{/.8....-
.7`...%?O-z...(..;b..zQ.....8......h....p#8.......z...=z*.._....YX3...
.nk.h........AoB.A...........m.V..a;[email protected](.Q9Q..W.:...6G0.
<<< skipped >>>

GET /free/frg/products/559350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 13:21:44 GMT
Content-Type: image/jpeg
Content-Length: 15034
Accept-Ranges: bytes
X-Varnish: 1111897258 1109849730
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:00F0D465EA2C11E297FAE79CF
768BDAE" xmpMM:InstanceID="xmp.iid:00F0D464EA2C11E297FAE79CF768BDAE" x
mp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:E1799641E79A11E2A6FFB8C361BB07AA" stRef:doc
umentID="xmp.did:E1799642E79A11E2A6FFB8C361BB07AA"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
............................................!.1.A..Qaq"...2#...BR...br
....S$34...............................!1.A.Qa.q.."....2.B#....Rb.r..S
..3c.$t.............?..as.ocgD.r.R..1..........>..W.#._G..yeZ^....O
).P:E.6.....T.j...72[/.s#JEi..?~..l.`..&K...YR.Z....tjjmJ.....$.;...2.
|....#u....[..bM........C.....]x6..).......J...i.....~.!R.$...'...A.v.
..D....]............1KG{u^&.S...}..E........e...;}..\a.......e....
<<< skipped >>>

GET /free/frg/products/735250/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Jul 2011 19:31:49 GMT
Content-Type: image/jpeg
Content-Length: 20909
Accept-Ranges: bytes
X-Varnish: 1111321462 1111163977
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......I......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?..RMp....CS.s.(>..{..L.I..6 ..}.... I..;.......G...$....
....#.q...{..f..m...p.;.g.^..........\......d......U..#.s.$A..b.A..Z.Q
.TD.1..9...p.w.2H.E.....z.........0!\...o.|....X5x. ..!#./..3.....dl..
...5.2.7......g_....c.Ld..X=.D.bH".T..1..?2i.G..k...J...w?,.}..L8.GM-.
..";....y...FR3.",.._.....=jY.%e%..R;..{..8p..S...j#[email protected]:....c.
.<^.C..]P.......s>..\N..y..6............Z..z..V....H.....a,.....
........=.....D.A.....F...}........J...5._.. _' H.4.p...C.!.. .:......
....=...M...Za..J..3......E["..."..H6......;..1.6K#...b...a6.2*..<.
.K....`.........K ..0..q....=f3......Jx&%|...W..9%......F....=Fxx....L
.i.8I......O...^...kb..O.~../..%<..,...;....e........x..D...}......
...y../...VE.r.\..pv..}.}...OS.....3[..C...:>.......a...#...g...9..
...q...z..d....(...:...]&.i6...2YZ....wgk)..O..FX.........fF,..hH.:..a
-6H.)D.y.....Nd...$n68Sj.;...R..-.....}.\$l.h.ku.*.......T...d:%h.
<<< skipped >>>


GET /do/gatewayCD?sId=&subId=&actid=&callback=updateClientCookies&_=1406905525155 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:16 GMT
Server: Apache
Set-Cookie: JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52; Path=/; HttpOnly
Content-Length: 166
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
updateClientCookies( [{name:'143_TURNKEY',value:'Default-6414069054404
42383',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Default-MSIE
 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:0
5:16 GMT..Server: Apache..Set-Cookie: JSESSIONID=BDE7B377B564D173A6DCB
E9F18107F52; Path=/; HttpOnly..Content-Length: 166..P3P: CP="IDC CURa 
ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=80
0..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1.
.updateClientCookies( [{name:'143_TURNKEY',value:'Default-641406905440
442383',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Default-MSI
E 7.0',expire:'7776000'}]);..



GET /free/frg/products/450950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 25 Apr 2007 20:42:32 GMT
Content-Type: image/jpeg
Content-Length: 30468
Accept-Ranges: bytes
X-Varnish: 1111190532 1111049418
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!...1".A#.Q2.aB3q$....CR%.........................!1..AQ.
aq"2.........BR#..b$.r3C.....S..cs4%.....D.............?....q..V.B...j
<.....>..'..:`U....%#..2.zv.I....BH:.....*h...._#.F.....W....^Z.
1,%3......9L..aXw.dbz.....l.....<.TT.F.\..G#{/.u....^.......t.,....
'.....z.97.d..A.%c...j...c....<.[4..:;.....\....kUF.dO...[..\L.R. .
(.@i3.\g.(.c....%.f..~.?..{x...Qo.$.=......t..2..z.]c.q.....M.....%e#.
6.y.,|.........B.P.........N....9....I.r.k...y..qy.d.....F...k3L...)n%
.#A..RI..-E#..=.~.Y6U.....r...4.......3.S0...-...G .X.6&...._...,.k.d5
,k&..%.;.....D .g..5x.D^.....uf....EMp.z...I\...#I.x.......U=m!*.:S...
....>i`...lP-y..U..j!..7.....=.TU..M]k.Z..V..hH [email protected]
....E4..U.A........{H..U....n...S\...mn..E.?....<.>...z.vU......
;"`..c.LK.......\J.}.f!.a...^b....1......B...2...Tb.SN.w...[Z...EL\R..
......Z..xa3...6-....E.z...I...?D.pl.~...`.....(..(b.%..v1.zn.z.I.....
..Q4N.......r..m......[.a....".n.[x...I..R5{../.)\w...... ..2.!O..#Dv.
.Aj...DT.M......K}........56.-H.2.......c.......\.....c...d..<b..rV
.s..h... o....U)...4g.u!.n;...C..[J>......EGOmo..p<..p...&.....)
..*j..F..j..._..4.j..#8.....=..J...z..{.b..r.....s.......B. (.o..<.
"][email protected]). [email protected]...../T.k.m.@....)..<....-.\.
<<< skipped >>>

GET /free/frg/products/661050/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 13 Sep 2010 08:36:31 GMT
Content-Type: image/jpeg
Content-Length: 17879
Accept-Ranges: bytes
X-Varnish: 1111190609 1110319050
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......R......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?.......n7...5.9.}.o........9.`.... v[-.......1s.0...U......
.[..7..5,_.......{ mZj........[q..}C..8.bW.f.....>%..._.....3.#....
c..7...-kK|.f.mA~...,.V6$.i.j...U>u.........V.Nh...&.....3...4.Sr..
..[....Q)....61'..........;..k{r.O]z.d#...,..JrA.^.X^$.Z.d..j.UHf...s.
!.. S..=.*.[....3.3t......R........n..q....G. k ........ ...&.,\.|....
..>h...........&..~_._...;.......X......B..?...I.....&..U._L..Ei\..
.2}.onM.=>....`....s...|.X..qBz.zy..!......2~....a. ..}...jX.......
MIe......^...x.....".._... .r.HG...sp..5..{|..\.Q..}..?.[...-.<>
..ZR_../Ox.C,.H.X.^-.....w.5z....w}.r.t...C....y.4&..|.d90.....k1"....
.....,.... .R.."N..l.k.. ..AM...........l......n%..... VQ!....|.......
....n.... ...z..\.`.k..2........H..&..X....M.X\|$..v.....9..x....'....
................;......K-W.~}.k..?#..u....G.r$=......I..Z........o8.8b
..h....Zf..H|...C.....I...y<.?I.*A....%..KF.<[email protected]*
<<< skipped >>>

GET /free/frg/products/680950/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT
Content-Type: image/jpeg
Content-Length: 17864
Accept-Ranges: bytes
X-Varnish: 1109304790 1107277168
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?..y7..k.5.......P .$...................^.D.......=:....V...
6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I
..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e...
...6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5....
.....Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.
d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... .
...z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5
[email protected].}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q..
..^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.
P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......
:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb .
.6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&
..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2
<<< skipped >>>


GET /do/gateway?sId=&subId=&actid=&udom=partners.freeridegames.com HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:23 GMT
Server: Apache
Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/
Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/
Set-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/
Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:05:23 GMT; Path=/
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Length: 38
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})HTTP/1.1 200 OK..Date: Fri, 01 A
ug 2014 15:05:23 GMT..Server: Apache..Set-Cookie: 143_userName=""; Exp
ires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_password="
"; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_CAMP
AIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:05:23 GMT;
 Path=/..Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; 
Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Co
okie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Oct-2014 15
:05:23 GMT; Path=/..Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:
05:23 GMT; Path=/..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Content-Length: 38..Keep-Alive: timeout=3, max=800..Connection
: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1..({"gateway r
eplay":"{'status':'ok'}"})..
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:49 GMT
Connection: keep-alive



HEAD /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Content-Length: 12146312
Accept-Ranges: bytes
X-Varnish: 1926374319 1926325909
Expires: Fri, 01 Aug 2014 15:04:01 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:01 GMT
Connection: keep-alive
Cache-Control: Private,max-age=0



GET /dc.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: stats.g.doubleclick.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 07:26:35 GMT
Expires: Fri, 01 Aug 2014 19:26:35 GMT
Last-Modified: Tue, 17 Jun 2014 01:05:58 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15758
Cache-Control: public, max-age=43200
Age: 27528
Alternate-Protocol: 80:quic
...........}kW....w~.....;[email protected]).....H..$t?....M,
..~..F3c7.'"....{...E....A$.|...\...L2..`?.{I/.g....N{Wr0.X..^...d...g
.L. .........r.z.#..G."..~%.p..e_..p.^8...'.i.._.J.=!.6.....9./.....a}
....`.. ...>..t..ox..q....D..(v...W<.P.......^c....... ...F...@(
p.....NW5.a....`.n....l.K....:..... .h....!DO..~.r>.E...F..=. ..e..
.h0.].}..#P.0.ol.....K>..o.....%........{[email protected]..:......{..c.nz
P*..n...........[9..)Ta...m=z.m......(....N...&A...X.KCV5.R...<..._
|b&.$/l..3..1P'..O...s...x3.E..J.....[... .......8^...:z..".7.y.2.....
,C..Y%.0..4...^.V..y.#..`.6U...........y..w...5=...N..{....o;.u E.iPs.
..........$rW...._.m.?..@<..W.g...L...../.a./...x"........a '......
.|.n.. &S....Ea....r..P.......5.89..lto.$....z..s......|*.;N......AN..
mL..*..(...U...f2...,....J...y.qqA.........BTo.../k$..7r..9P..H.J.^...
....b..=..A..&...Qo.A?..W....l.........'".. ..D. ..EA.........Id.s....
.2.9.k.f......aZ.0.r..H....n0.#&.|xo.]X..-..-..5.....4(.x..4j&..V..p.N
)0..5..Cv.K.!........&A>...I....:>lh.A..>...U...J'..........B
.q..y....()..3. .... A".u{{.;.......W.....k-..zF.\`Q.0........\d..a..A
.1....5.y...`-^.F..M"tf.GM. .XY.YU...T.._.lH.......A=1..N....?Z..R ..{
...(.RS..^...)...8Em.e.EU..^.....<I.H..C.....R......%...<$......
...S......L.,.{..)..b....-E&.7...f.V.j..(...Bj.l..!..K...Z......T.....
.B..NU3%4.i...9.......a...>/..kE.`_.$.;.Ld;......x.H....\.8.n....D8
[email protected]@.-...k..Z.....J..D.R.m..J.5 ...U...$..jG./..>
;O.}.,R.....0q..l.;2o'oJj....|]M.........:!X...&![v..EO....E&?.N.$
<<< skipped >>>


GET /free/frg/products/633350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 14 May 2009 11:41:01 GMT
Content-Type: image/jpeg
Content-Length: 22203
Accept-Ranges: bytes
X-Varnish: 1111191246 1110490904
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1.A"..Qa2.q....BR#.br3.....c$.C..SsD%...................
.....!1..AQ.aq."...2....BRb...r..#...3.....sSc$.............?.J..m....
.._V.$.|..3..#.....HE]GI...k..;9SW....'m..k...b.._m....Y.R.u......BZ Q
.$.j%.]G&..z#....(.....=.....s..........I.%bl.q7...8...c.A.].m.h.,....
[H.N......x..[.\......t...U....W\..G`2....`.{....!.sE.D...]1..&:=..R..
.y...,.....RU..i.~b..ie.q#.5...SC..U.,.IT....N...3.w^......v......;.l.
..".K%..p..$..v$P!..r..:...T{d\0'....K..,....rT..P..{....qg....P..-.o.
.$....[[email protected].....^.I......n.6.........,...-?R.PG...;.h;p8.
55.4.W..w...Tii.;...r..&$.TQ.*.@)...y'}...pEv.UO6w..3N.j......&E9i..P.
..2).MW8.o...."...i]|u...*2............R...qQw..c....O5s..5.3...d...yM
...>......dM`....9.|U...C.......5X.a.n..?mX_,.....N.{..g...ND.p....
@..2....!.l..<=B}4.|.j J.."1(W!%t.%iS.B.H\.#*!....&.y....X\... ...$
.K..|:....s.N..jhd.K^...$B.\..(s.....BI...0..w..VY.I.\o.n.j........T..
Dv....m.hy).....:M..|...s..#.......w0.<!.s..Aqih!.....v...Yx...d...
'...z..jr8...K...UN.T.x...^..3....DN...S..8...qZB.$..Q...(..>...a.f
I;.......Y9V.....&..Yu.eA....eI.S...Rv$h....X.6.^...G..e.P.,2.:..t....
..i..B.p(N`....l=...7.6..5.....P....1(...^.......GPz.....;.7.....I....
.......W.-.{1.U.[.cl..<!!...ajK@!.iZ.R...B.|.6..mX.7.Ksa...qn'.
<<< skipped >>>

GET /free/frg/products/619350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 16 Dec 2013 13:51:05 GMT
Content-Type: image/jpeg
Content-Length: 16168
Accept-Ranges: bytes
X-Varnish: 1456967477 1456500431
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
......................................................................
......................................................................
..........!.1..A"Qa..q.2B...#.b.R3$..r...%..C..F......................
!1..AQa"2...q.....B..R..b#.r$...3............?..H{.........M....5J$..4
V..Q.Q...1\On.#R$........xE......5* .4.W6TD...g..-........L ~]....J.X.
s...:tI...T..C........yZG....X.R.A.N......0...%w..............P./ k&..
............~:..{?'qb>>......c{.R.:4..7o..4..|m..~>._.y;rG..I
.....-...,.~.. .....I..8..z|j..M..)....:.Y.2.82P".v.TS.........9..."..
#.T..v..X.......7l....n......`......J.'....F..=.../..B.^....{j..z.@>
;_..k..H.......cC.....!..u..iC.o]..Z..]...a.[r.|}.....H..|..........u.
SB}..Y...:...gh..#..w.^......{f.......?...Q....'*7H...|.no...$r.nc.:..
...IYD7....%....E]......l..&m.q....B..&...F.........3.....X...h.<R.
..PF.d...!_KDD..N.....9f....._...$.L.x..vN1..Ui.Y..b"..k..i$.......YT.
...]..,$..b.B.".......U.......&......)..._.7..V.D.G.U(._J.qM.k...U.Y.]
.j..r....K.... ..8!{.........X....S....=& x....={.'...7k.k....d.}...5.
}..[...zn=.B.0..W.X.r..-Jn.*....0.nE3..(.x.p...u)..,....y........uN|..
SO...G4....bE..#.RG..q.T....$.65>.6.]............o.."$..JM#..T..Y..
..h....#../.M5..[L.!H...)c**.t.#.......I>Q...<.[...W &H(.EQN.H*.
.Nco........s...q......c........J.....;-.o...\.\ZPN.F.%Hp.....*.'.....
.n...cou..)..J.R...j=cY....r..x..q,w.'.....R...Z...,B.s.........{.
<<< skipped >>>

GET /free/frg/products/701650/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 15 Sep 2011 12:15:52 GMT
Content-Type: image/jpeg
Content-Length: 18010
Accept-Ranges: bytes
X-Varnish: 1679378593 1678835593
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......F......Adobe.d....................
......................................................................
......................................................................
......................................................................
..........!".12B..AQR#aqbr.....3$.....C....Sc4%u.....d5...............
...........".12B.!AR...Qabr.........#....3..q...Cc4$T.............?.|.
....w....|.u...br$>.4$..k..@...\.Z..."#Y|;U...W..5.l_.j..V}/k..../0
..5...$6.....y.onX..P..]......M Jf.Cc...QA...)..rV....`....<.......
j:.="`o...ku...yHGj.<c.D....i....c..t...z<gePO.L...P...N.V......
........;...8.y..L~...av.e.dd;1.l...)...n ....J....;..M......?;G...wi.
..w..qU..q.4....\{.N...[..ml..O{............=?.1z.qe.-....3gjA...7D.3.
p.8..._..x..f..[..j.y ..a....r...<. ...&.n.SMJ1.6..`).M...u...Go..E
......M.JQyd.{..uE..2....&.M.n..t;.....&~Q...I.*.'[email protected].{.q,
.n..=..Ejf....7H......o..U.w.o..&.....................V...W....hfP..4.
^\TI.&.Lo._Lb..ov....V....33....V.).....S.zV.-./e.....Zwb`.*....q...Xp
j.... ..x..................7Hv.kj....vA>.;..4.)R.|...7z.a...v../?.O
.Xv.....5u...j..;...[...;e.5tj0.....<.4.5.D....($j....|...f.4..Y...
..H.M.......#......#.....!E..8..(y.L."...(../p.|.....e..O.[.. )r.'...a
..;t......D|.F|........Xz......^....W....$......^.!...i.....is"@...F..
......=...y$..Z=.^....19.._@#L...V;y...m.....b!/x.b......FT.4..u.~....
G...B4.3...D.o.D..\.H......s.D] ............s.9^.........*...N........
PVm.a.C1...k../ ....[m...V.. .`b...S......:.....D='DkT...G.m. ....
<<< skipped >>>


GET /freeride_marketing/SDM/SDM_standard/js/defines.js HTTP/1.1
Accept: */*
Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:25 GMT
Content-Type: application/javascript
Content-Length: 1371
Accept-Ranges: bytes
X-Varnish: 1111625342 1111347017
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:02 GMT
Date: Fri, 01 Aug 2014 15:04:02 GMT
Connection: keep-alive
Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Ma
rkting = function()..{..};..Exent.SDM.Markting.Defines = function()..{
..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.
exent.com/freeride_marketing/SDM/SDM_standard/img/",...freeride : "htt
p://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.userAgen
t.indexOf("Windows NT 6.0") != -1) ..{..  Exent.SDM.Markting.Defines.S
ERVICE_PROMOTION = ..  {..  .servicePromotion1 : "url('"   Exent.SDM.M
arkting.Defines.BASE_URL.cdn   "servicePromotion1.jpg')",..  .serviceP
romotion2 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn   "servi
cePromotion2.jpg')",..    servicePromotion3 : "url('"   Exent.SDM.Mark
ting.Defines.BASE_URL.cdn   "servicePromotion3vista.jpg')",..  .servic
ePromotion4 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn   "ser
vicePromotion4.jpg')"..  };..}..else..{ ..  ..  Exent.SDM.Markting.Def
ines.SERVICE_PROMOTION = ..  {..  .servicePromotion1 : "url('"   Exent
.SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion1.jpg')",..  .se
rvicePromotion2 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn   
"servicePromotion2.jpg')",..    servicePromotion3 : "url('"   Exent.SD
M.Markting.Defines.BASE_URL.cdn   "servicePromotion3.gif')",..  .servi
cePromotion4 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn   "se
rvicePromotion4.jpg')"..  };..}....
<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT
Content-Type: text/html
Accept-Ranges: bytes
X-Varnish: 1201441805 1199270395
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Content-Length: 1615
Connection: keep-alive
...........YmO.8..\$..7......i){-...tp..-.;.'.&nkH.(v(.....v.B_...]..8
v...........^...ct.??C........c..4{.}.?..-.i.~.#N.e..m...q...?..P....]
P............a......it...z.....1!.@b.....^.>...'d..0...../.\.......
k.hg'........o.........7....F.[[email protected],D..m?.,rO"a.lb..B.....Nn...
H*....G.N.k.i8.j8..SP<O.:.lo..C..R<.....Ws..u.B...N...7.C.<.t
K.}&p.V8,......h$...h8..f..P...R..^t.U/.F...........!.N.C..C.....F..L1
...0%...U...J.A/..FW...N2..E...-.....D.DKJ..Z..n."=R.,QU........... .}
...C..A.h._...0%...A^.....T....Z..-...cNP..MT*.........!....).n.r...j.
...b.t........ ..!.e.[G...:...i.X~b........?P.@:.0i3...=5F$J....C..~..
.$f.O@9.}.z....9.7H........Ni.'#w.(...B....[o.yk.).....!.o..K..!NC.Q..
.. .Y....q...G.4."6.!.8...h....)/r..I....<..|.....T....sy..Y..=....
g!../.i....9.= !.Z..eU.P._H.'._..P.d...0*e.Y$.D.#s.;L.S ..Fx..${......
r.{.....#...".p$w.....gQ.^E..#! .Q..u#O.2R......'4.H...\(. .)O.K...$.i
.....0.l......Bm'i.u..U.....k..v*.&.Q......\.Q.W..L.~....[E..[..i...,.
..*.S..lj..DU`W7......usJ.1.>:N}L....a(...8.f.....,.A=.4...........
[email protected]>.gc.=......... ..D..5...*...g8...H..j..|/..Y.....Stp_.
.?E.. .....z....%.;.....A......Hv.23.TT..Qe...Dw..]..t....r....*..v.1.
U.n.). ....]V....!..v2#j...1..)...S...},.4?..]..A.u. u....K9awP,..R...
.hP7!;.....!.U..L..L).i....$.(W.FM.f..AQ&.....U..........w......o....|
...F.............n....v]..<......0.....mD.:o8.....G..$.*....<..Y
G.^}.V:....c...f....<..=.#[i...'.FZ.\...dO...qp...ei...r...:w.|...'
...|.`.j........,.t..s.nn7..f..w....L...w...*;.......X.v1H}a..>
<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/js/defines.js HTTP/1.1


Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT
Content-Type: application/javascript
Content-Length: 1376
Accept-Ranges: bytes
X-Varnish: 1111680727 1110770841
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Ma
rkting = function()..{..};..Exent.SDM.Markting.Defines = function()..{
..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.
exent.com/freeride_marketing/SDM/SDM_standard_2010/img/",...freeride :
 "hXXp://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.use
rAgent.indexOf("Windows NT 6.0") != -1) ..{..  Exent.SDM.Markting.Defi
nes.SERVICE_PROMOTION = ..  {..  .servicePromotion1 : "url('"   Exent.
SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion1.jpg')",..  .ser
vicePromotion2 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn   "
servicePromotion2.jpg')",..    servicePromotion3 : "url('"   Exent.SDM
.Markting.Defines.BASE_URL.cdn   "servicePromotion3vista.jpg')",..  .s
ervicePromotion4 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn  
 "servicePromotion4.jpg')"..  };..}..else..{ ..  ..  Exent.SDM.Marktin
g.Defines.SERVICE_PROMOTION = ..  {..  .servicePromotion1 : "url('"   
Exent.SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion1.jpg')",..
  .servicePromotion2 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.c
dn   "servicePromotion2.jpg')",..    servicePromotion3 : "url('"   Exe
nt.SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion3.gif')",..  .
servicePromotion4 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn 
  "servicePromotion4.jpg')"..  };..}....
<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1


Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/jpeg
Content-Length: 48259
Accept-Ranges: bytes
X-Varnish: 1111680765 1109735540
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB
4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6
A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................=.|................................................
..............................................!a.1.A".Q.q2#.t....B.F..
...Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq
.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q.
..?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.
<<< skipped >>>


GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=4858524-7287785
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 494852605 494804948
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 4858524-7287785/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41
 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-
Varnish: 494852605 494804948..Expires: Fri, 01 Aug 2014 15:04:02 GMT..
Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: 
bytes 4858524-7287785/12146312..Content-Length: 2429262..Connection: k
eep-alive..Cache-Control: Private,max-age=0...>.W.O..Y.'...n....1l.
..^.YR...'...-..<.._...........'..,x.....`........IS.V.....(.a.....
i$.|.^.....W...P.(....&.....a...c.C......M..B.4..3..y.R.....,x..O.....
 ./HT*.]..5..Y.W=..f.7....y.vcs......H..)0.h[m...Z..ce[.XY...n...S....
G..t.vD'.. . e..<...#12....6....W....<./{...W....8..pk.VoaN.9...
...C...g$...........'F.......2..YZfq-..v....fd~Cd..-...s..T....t..S..T
...9.S..Q/.0..l.=Z...p0...F...}7....e...G]:~.q...l."...vv..~.#......S.
.....=1......4.X#3D.t..Q..........I..4v`.. .=a......ix3...CK.a.&....o.
g...X.n.)..z....G..-.X.|%S..8..&...1}....../.\.)..L.@wM..<P70.....b
..hR..B...O.#.l5f.....1..op{..8..)... I...0.O..}5Z...Qj`%f....6g..u..-
.|...O..m.A..... *yV.i\...=...Wj...v..p? ...v....:.......iKD_.t.k.....
.|....68.6... &a@..:.....I....'...iI.L..._. ...j..:"E...i).0R/2G&..w).
fet.,.....#J..m...X/.......i.;..E..}..c..Z..>..Xi}.....`?.....N..i.
.i..qY..!r.Ji.n..p....oz....<.U.:..Rur....Q....bE...F........zC.4..
.....s=~~..!...z.._:.-.z.9b.......1.f.......^?..'...I.(.>P.K.....B.
]5..;..m.e.!.........&..]...b^K...LCQx......Y^:.....ofd...]..`..aR....
o...p....h.e..l.... ol.lt......K.......,...r...........h.x`......|
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:55 GMT
Connection: keep-alive



HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:23 GMT
Connection: keep-alive



GET /free/frg/products/624150/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 06 May 2009 07:47:22 GMT
Content-Type: image/jpeg
Content-Length: 18319
Accept-Ranges: bytes
X-Varnish: 1679200751 1677933599
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.........!..1.AQ"..aq.2B..#.....Rb3$...r..%..c4.......................
!1..AQ..aq."..2.......B#.3Rr.............?..H...7.?v.f......X.o.6....t
3x.ZT..2...T.....?r9*e=W...[vd.w....kq....D.-_.e......\...a.?..k]E....
............{X...o..c..%x......X.@..).C .p.z1....t<1.....5..|.%X...
..~.[...^-......g.R.K(.....MT.:s..F...q.......;.'/...;....:..}k.......
......Kv#..ml.!E..j..6H7<..B?..l..@u_v9.]p....*....A..?.|..*._....p
......r..O.x..r{e.^>.......T..........t...[..V.....=E.9g...o...gs..
E:..G.W.!.s.?..{.d..a ..`....5...... ..6.....~.,{.a....=[E..K ..2..C..
.\...T.c..?........6......W....z..z..l<..........W.kZ.z.7......U.s.
..w.....#..T.$......z...[.K,k$1......$....\..9..Z....]`.P........1..
......L....;..[.p.0....;..q....r.h'[email protected]....<Qk.\..x...
S".....yFk..q....zZTGl..k..o...7.....}G..q.\.\..yv.?.............?...[
p..S..b.....,......D.v...fQ..Qb..[.......J\..8<n-Z^...F>..e;G..o
.{8.a.....r...zn..T$5c...Ze..|....g.......x........N9.;[email protected].
[p..a..(..q?...F.m........'.G....<g.....L~3l~R...P...e`......B.}...
..Y.DG$Z..o9bo0.........Z/...Y..I.VZ.L.B...PT.v..u....7...-.G0..g.4...
.M.m...L?......b:...VA.........1e..0*.9%6=....r1f.Fd..|..x.....'4..z..
.....^.8.;.qVm40.mkwG........vS...q'H.;y...\..y...<g?..6.. lL..
<<< skipped >>>

GET /free/frg/products/674750/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 30 May 2010 12:08:35 GMT
Content-Type: image/jpeg
Content-Length: 13779
Accept-Ranges: bytes
X-Varnish: 1078423183 1078015529
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......W......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............#.."23CS..BRbcs$..!.4Qr....DT.a.......t&.q..d..5e.....
....U6.........................#3.."2BbRrC..1..S$4......A.c..T%&7.....
........?......t..Z..[.n....j.9.H.R. R.d%_.....2N..I..8.I..a....m..X..
.U?W.A..`../...E.V.~..Z.....5..EQ.rxd.........>U.x)>Q.v....f..R7
.xJ.P.=$.!.{?#..]aY...\8..t.O6.u.....U...F%S.).4.....@..<y..5......
k.dG.ZM&Au9...Ov.J....M.c!.....\......Q;z.~.y.....vt.....B.w%=....-..f
.v..O..Z..........S8%ot....z......P.......!..F.u..:0....*,zA.1..R....w
.y5 ...C..a`...wb.V..p......:.....w....L@.$].=6\m......*;99M..x..U#.k.
O...Vv....../.k......T .#.z.t.F.\...Q<.......'.&....u....E.m7..d..,
....^....3..tN.R.......!..*."%v.2.1.T.U...Q.p.P.......y.y...H.E.l....k
U.n<[.R....H.]uO.71.~>.;Z.....0...n..P.:i...wmN.R.ZF2H.B5......k
......U..g....q...I.SoC"..It.I.'.}z..^..Nd.`.....?a.$`.i./.).r?.D.....
PB.{........,.B..?....T...F..^...o*...h?>..D.G..aZv....i.3.ke\...B.
..FBhP5.......a.4#..x.......c.&....:.W..*[email protected]*
....(....d.|..rb..<.Y.^K..Z..`(.:{A. &M..b...D..Vxr...[@..X..K^.)6i
..>...'...;H..........U#0.=..\.JE"UI.''.jI...._.2../....-95.R.cSV..
Z[..i.B.r.y.k..O.:...{.s%...I...B....(...g.'....a..:.p.r<.#..n....!
..../-..hJ<.a\3..C.....V.k.y...r.....Uv..4.3..A..".._...#BB)...
<<< skipped >>>

GET /free/frg/products/575350/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 25 Jan 2009 14:27:04 GMT
Content-Type: image/jpeg
Content-Length: 29740
Accept-Ranges: bytes
X-Varnish: 1679729950 1678424226
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!1.A"..Qa2.q.B#...R$....br...3CS.D%......................
..!1..AQ.aq."....2...B...Rbr.#.....3C..c$d..S.DT5............?.Z......
.-se..d..X..:...b_.L....'.B.K.[PCm....N.......Sr....?.T.%...K..8..09&T
....s...kb.5f.....@o..=2dZ.1..-TK.RTR.MM..t{.#.ey/...o$.{..$p.P4....*N
....n\}...s.}&_...[....2.x..S.. ....'.kZ%*.es..5........;.E(q....<.
....-..G"],......'......A_'zk.A.o......"".c..........J..nT........\[g8
gs......w...u.@}a.94%?..HI...5..'......N....T.=..'....@....~|..6X.....
..LiKrM.$.....A..r......#p.oN.1..a$..........8.#.N\.../...6..]U..O!c."
K...C......@Qi...%.%e*. ....4....A ..Sp......((W.^c>.....#.4kD.7.|.
"..u.GVKt},0.R.q)\[email protected].$x:.n.....u...^S..xe....e>..n...... 
z...Q...)i.....m..zBI.4W.h$iW..../*8.&[.c...U\I. >....u..8c.....C*.
.2;.K.*!.....rv...^..e....'y..c.\.VG'...W.>}qe.\...a..O......}.'.T.
.....J7S4`.......%}G'..........t..S.........[U.x...rI...L.*...r...h..%
,A#...?mS...}.TU*.....5^.2K..Ql..........& ...#.......^..~...s.;--8.3g
............6).?..:.....`H.;.~.C..R...#...<...U$.m.....4.FEs;H...A.
..a.~2v..r...i..L./w...|..2!............7T$6.....%B.u......i.7p.f.{Ms.
.........Y.'_..#Dr6Ap/.D....*...$.k..bp..{N}..1... {..4....q....S._/..
......u.^>... bRB.i...).........4...R'b.....%...K$....w.J..7.#.
<<< skipped >>>

GET /free/frg/products/766250/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 19 Mar 2012 10:53:17 GMT
Content-Type: image/jpeg
Content-Length: 11446
Accept-Ranges: bytes
X-Varnish: 1111897285 1109846362
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....H.H.....C.................................. ..& ..$... 
0 %' -,,. 150*5& ,*...C...........)$.$,-,,-0,,-,,,,*,),,*,,,,,,,,),)),
,,,,,,,,,,,,,,,,,,...................................................B
.........................!.1A."Qa..2q...BRb...#r.$............................*........................!1.."A.Q#2Ba34R.....
........?....hQI]....<hh#.!|.=.........m.>..U..,5.zZ.?tc...m.P.T
anG.....i\rR..........z;..|..%\."...9........{F.N/a....o..:.5....=.I.Z
...^;c...BvP.....G...8p..q.l..S.r....*~..Z(..%.y.....6>%.._........
.....d..h.K........c.h.S.h.......%.G.......A<...A.3..fy...;...~..U.
...*.&.t...M..J......-~.j.Jb.d.....C....;..>.nw8K.`.9......],[..P. 
......'...C....8..Y.u).Ni.X....P.v.....lv...N......$|.R..#..%..'...ZK.
.R......X....r.Z:O...8...m,LdT*.{..{..)...s=....qL.pAN..y#.....Z.}.>
;.A.V..q..........h\..!c.X....1. ...M..r.'..x.{..7./.0,-.Dy.y`BH..t.b.
O.}..........A..dUe..<.|}$..Q......)...W.\F.....G....F.t..B..u.QCNV
.OlP.........v........<.x....2...".@=9.8]5.-.....7.&oE/m...x.X.....
'pw.....I.....FGP.S..n......cr3N;f.%..)A...z........&....m.I....N.K./.
.'a$50Ib.&..2;.q.....M....j,.......;.o..Qsr.4..~g..i...CR5.E;.OK:'.P.o
....\[email protected]$c..m=md...<...;.g...u..B..n.<..M.ql..W..kUH..Y$
....v....A.G....G.Q.....3...#.k.=<....S....."...v.7.-....k..:.c:Yl.
..D......4..ml.-0j..*...........;.Dej.e...pG.........T.....?\d...I...C
d|.....I.I...~...^.......*.^.ceR4.v..u...D..h......4......J.....$s66..
J#.m.S'.....n..,..@R.._.$.#]..`..ze..e.m.......6y...~.a._g....fI.$
<<< skipped >>>


GET /connect/xd_arbiter/oDB-fAAStWy.js?version=41 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.facebook.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Encoding: gzip
X-FB-Debug: ZB 50aMstmsTvc/Q8Bzyb3YkyXotkTC nMtFOpOrjd9HqCdP06SGvCzueP0UYwZvOqczfcXu59vy W3jNMO3Uw==
Vary: Accept-Encoding
Content-Length: 9227
Cache-Control: public, max-age=30665886
Expires: Wed, 22 Jul 2015 13:23:26 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
...........}.z.F...<......")/.1........mlg........D,....H.g.U......
..-...Z]U][.........../..........yQ.E./_1...tj...<?.).Y.Xoy..I.L..G
3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad
..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'.
.zz..w8Ys..=X.?.T<vz[...Re..S.8.....g..p....fsvN.....5..4s.-..06...
[email protected]:.`r[.....ta%|a}...Y.....e........dR.nH.....Ho..'
...E.k6'[email protected].$..."(p'..\O..8. ..%..r.|ga.DX.x:6b..<#....D.r
[email protected]`Ep..T.qDnZ.y. ...]7G...x.".K...&h......b..)V..BXe.l.6..
..W).{R.l...n.N.Q..3.....l....OcN...w.....jj.<..0......).Y......x..
...E...t"`../.F.;..vz*.m<.(.4h....#.F,/^K`6...q..f..q.......<..X
.\..z..L.O......R...Wb..,.A.6H.F... .\^^...LH....(.wP...P<.k..$.B..
a..._....A..4.....;9 ...w=...gg....;.Y.8..... ."Z3...}...5l...K\.....V
......=.r.q.i..Z....<B.C2.&^...\....Y...#.,..H>d)X.....I.%..d-9.
....)v......)... .z........G."$.. .!..EX..n HX.,[email protected].
....K.9;..G.-.Q....'V.V........z..X............y4n]_.......|.l:r.Wj,..
#...Hy........j.....x....[(..o...G....X.{.-.=...SF...{N*..;Z..........
.`..0.J|.Zl6.V...,....}0......\....W#...x..A0..;.Z.......Mgd.o6.V"..sE
`..M]...W.U.Xvs.4....7..:....wb........LC.....0.W....sSNqsq...;v..{#,i
EW.r.....7..`..O.I...2<..Q.<(JB.>......W.(.'g`.4.3.....m...T.
.......w*....\.tw...y...}.@}_....&...[9P{k}7.G<./.1M#...BN.'(..Nh..
.........:.3qy.................N.;..1.>..xx$.~.....a...;.c.\......L
6.4.K.by>.,.2..g....}.,9...# ..~]{P...o.q...X...6....6.]......[
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:01 GMT
Connection: keep-alive



GET /free/frg/products/554350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 11:07:11 GMT
Content-Type: image/jpeg
Content-Length: 16660
Accept-Ranges: bytes
X-Varnish: 1110726342 1110402620
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3EB270A5EA1911E2A262D7F48
EA80A8F" xmpMM:InstanceID="xmp.iid:3EB270A4EA1911E2A262D7F48EA80A8F" x
mp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:EAF28A94E70E11E2BDD183F16790EF49" stRef:doc
umentID="xmp.did:EAF28A95E70E11E2BDD183F16790EF49"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
........................................."..2.BR.b#3.r...C$....4u61S..
.%5..ATd.aq.cs..D.e.!...tU&......................."2.B..Rr..#...b...3S
4%5.Cc.$d....s&.!1Qa...D............?.....$&..JH..g.$.6...-.VK..j..ls0
..$..s....M. ..../,.u..?..}.(..;...........z..|J...8.c. ..........X...
. m.]b..w.._....'.:ET..6O.u.i...T...^..^..z....c..`...T..Z..X.e.......
? ..,.[......u.s.Q..\.5.......W6..'..W..9.(..W/.FlrI...\.: .M..u..
<<< skipped >>>

GET /free/frg/products/616550/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Sun, 25 Jan 2009 14:27:28 GMT
Content-Type: image/jpeg
Content-Length: 30153
Accept-Ranges: bytes
X-Varnish: 1108941155 1107966858
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1".A..Q2#aB.q.3$..RbC4%...r..&........................!1
..AQa.q..."......2.BR..br.......#3..Cs$Td%&.c..4t5............?....}..
.~P.............pj.^jq...Qt..B.1.R.....4L>._#f.......z.....36.8...8
..E(I...:/Y..z....W..g....h.'.@..;.7..WT=.]...QY...9].;v..0....|.c....
...........9..p....~L....\...xP..Z.qw.."...&..MG.W..f.Vp...w.....d.t..
-..#oE....]..!.....Mc}.RHh..}.y7m-SB.>..z...U.$....o..9...1......X.
..&9..d#....w.l.^u.9o.s....R....U.~..C~.V?.8....O.D...G5.9....Ja......
..c........U...c ..wy{.....m...zWs-@..?..W.5...2...6...^...1.....T.|.z
o5..-.y.m.Q.M...}A..Hy..d.^.M.H.^......E.M...j ..66...^Rh....[Kq.hE.H.
RC...&...ut]5#y.......Z..v..~}...`-..J..p.C).................G..jZ..wm
8..P./.9....,.<..T.!.Y...}[email protected]^. ..l^{i.|..."...u.m..r...
2........VT "t.,..D........EuKM&.S........X....q6....2Zd...wkm!.wR..@.
.zd|[....K$..\^[email protected]'..M
G.V.0*hE.7.....s.l.F..K.i...i.BWy.}..>....U.O.N=..C.......4.U....mk
/*M..);.....k..'...m.V.a.Bn,........{..>,l..I=.jFA.9<..<.?!..
.. L....3jV.]<..q.;^7]...V.r3h...U...bsZ.!.A...t.]..>....].*.&o.
......q.V-.M.Z....re................ ....zz..0Ck.m.\.60.I%1....&w...G.
.,.yS...Xq~-.Y).5...1...5..#7..q.x\....../E~.XKp#......T........R.
<<< skipped >>>

GET /free/frg/products/608450/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 13 May 2009 07:03:16 GMT
Content-Type: image/jpeg
Content-Length: 26064
Accept-Ranges: bytes
X-Varnish: 1111897183 1110386755
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P.....&Adobe.d...................-
...E8..e..............................................................
......................................................................
......................................................................
..................................!. ..01"#$A2..@354..................
.....!..1.AQa"2q...B#....Rb3$....r..C....ST.c 4D......................
!.. 1A0Q"[email protected]....#`Br....................!1AQaq....... ...0@....
............................D.bK.eX.U...:..H[z..k......h..mM.8......M.
.U..1ur_....N...q ...j$.x....Y...Ct.c.u.."[email protected]...(...
.9..Y.f.=J.......$X..Xt.....YN..*[email protected]...#......U....EJOE...c.T.4 ....4
.k...x.H..Od.f.C.$z.6..R.9.......^.e.{*Y..2.._....<.5..5.hn.q{"....
X.D...p p.N.\.o.?..V.....\u.6...g].^.....kg.d..A..5.n..9.c..=.A...uX.)
....b..d:..y.Y..._.........z......P@D/..S.`..f....W.O...vr..co.]#..k..
&...6qo..T...X....R....e.tR.$..6..T... v<m...vH.".NX.s.-S>.....K
..to6.g.P.vi..H..c.O.>gi...c0G.....(....|..A.....{~u..... f.;X..w..
=..e.....E..F.j.R.......M...c}-Z......\......Y..m....R..OsFK..........
.....mM..d..s..].]=..............W'..T.#2.1Ku...>....j..cw9.&.CR{..
.P.-^.;]..E..Z..S.N..t.X....J..cdO.r..J..d.)}@r...x&J.T...^..leHP..Z..
@=>X..Lu...I......1P@@T...S..t.....BA.B.7"........../...l} ;eda5".E
H...l.....u..M:3.-...8<!......d....]).k.....Cc.f.*U-#e.... .Cu1.gHW
w,tnjT..C...S...?..T{IsZ...&....j....l)6...ad[...,....=.N.]..5./)z..7F
>.P...r..... .:.....a.......U.j..^Gyc<..]{$...9.L%.{..-...b.
<<< skipped >>>

GET /free/frg/products/631850/boxshot.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Wed, 15 Jul 2009 11:11:31 GMT
Content-Type: image/jpeg
Content-Length: 23693
Accept-Ranges: bytes
X-Varnish: 1111897182 1110402691
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d....................
......................................................................
......................................................................
......................................................................
...................!1.#$.3C..AQa..."R4q..2bScDT%....Bd...s.5EU&....t..
6eu..'..............................!1Q.#Aa.3$..q....CS.4...cs....DT%.
.d5."..t.62B..&...Uu...............?..<........k..c.E.6@#on].3.....
( .._O.....&..5B..^sYQ.......?>..." .....8q[|.....c..C.~.....2.....
./N..1.}.....0].D.M....d..~.Z./........".....w..$..I............8.5..D
8...N8..1..>.V .=...d..%..X.1_.......\*..<b....i>......A...].
..^!U..~y..dS&F.d..........>f.....j.Ei...g.....,..<.y.......z...
g.E....8..PUX#,...ws...JQ!."..B.ZJ.m..F.t...l*a...j.f.._. ......_.....
.>..\8.O....5Ys$.o..y......&t'.z...).|....i....z9..M....3LK..!..>
;......"O......Q.5.*..;....)..C.:..4.V.^`..W..P..0.</...)i........E
~}...#l}.|...]......R)r.tY.../F;)9f..6......6g.....<J...9.q...C.n..
.5..`.0....8>.c..yCve...8o>}TJ..KT/.PB.,.4..2o...}:.&.~..p.{._.B
..&..........=.UF.3..7.~.."W.2.C..L&....C.."IvwqQ..%.iz...{r{......0..
.......)........r...z...6j....U.F........h.....`..............{.J....:
...I.....b4.....3.M..p........{".TI...r6..kf.`.n....o,3....m(]n9:M.s.|
..J.\...z...X...EP.{..d......S;....7...<.4>.#.@......< ...U..
.....R...kA....F......Mm...]...-....7.5qn....'c...&.o....}['s.G.......
...<...U...5...O..a5.....")..^..j...C..kP3.....[)..6V..]..Op)..
<<< skipped >>>


GET /js/plusone.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: apis.google.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
X-UA-Compatible: IE=edge, chrome=1
Timing-Allow-Origin: *
ETag: "418518750ca35248ccdccce02192455e"
Expires: Fri, 01 Aug 2014 15:05:19 GMT
Date: Fri, 01 Aug 2014 15:05:19 GMT
Cache-Control: private, max-age=1800
Content-Encoding: gzip
Transfer-Encoding: chunked
Set-Cookie: NID=67=VAwxPeEWnf-V572H3NDhiALl0goy6niXxd0X8aMQOSMmv8znUA6vWNcHu3mNN_oKf9zeHEjjr2xL9e77yJGxH62Tk0ph6xiK-6jNDi6arNC357sOEXOSJ6HVXTyHx-Ne;Domain=.google.com;Path=/;Expires=Sat, 31-Jan-2015 15:05:19 GMT;HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
1298.............Ziw.F..._!a2..b!e;..Btl-../.$.I(...h..@.."......n...&
lt;..93.,5z....}... .m.X...a.'..z{:..u.a........ .n.#Q..c.....y.&.n.]A
...1O|...x?..I,...UB.K...F..........2.F......F!z.WK.<...W D..g...xT
....}J.X......<p...c....oG.g...1wI.....\.b.^.-R....G.9..Ln.e.(.x...
.K?.S>3.%Y...&.N.{n....A.....^.i.C]~b..2...uU.j.L.*.......i.R{}..WI
.o.L.{...6...4..f~. .].hx......]1....?.k.b]..3...I.....k.F...M....D..(
2."......*m.0.!.....b3..{.....F3.f.t.q.Xu...Oy..?...=..M.X3[U3..i.....
Tv...L.M..?..41<......I3.{*F.7.........S.2>.....h.....AA..5.....
{....P....-n....S.n.F.M....z;}c....^..-.`..j.[y..w.....c....]..#'c....
.. [email protected].^@.....hP.v.K%^(..L..I%^).R......yE.Q.#
....G.....C.#Ao.],u.Wv...!....T$.-...&v|.tO~....=I^...%c.9..V...S.....
.Nk..94...b.g......B...i.B..\.$... .V.=...l.X..kB\.C..^-.V3..&s......4
...u..vFXR.Y _f...q.bo....|Er.d...a....s.o.a\hM..i.-..:.....g.......L.
k`...4K..\b.,.{..d..PLl....o(Gr..]-.......1q...#L.<.q7........y`..`
[email protected]....{..qpa..F.[..il
1pa..ls.OC.h..........0C.]..2..%....H._.r... ..=......}3r.W.. ..`.j...
[email protected].%g{...6W.\F........V43?o...).i...n.*-..X
...r...%..s.c...bs.x.....y.u..`.i*(.sg..l...X.c..>Z}.....i.....S.D.
C8u.e....i...gS...h..d.............d6....L|........U.';5.{R<7...Bc3
].nh..xn..e......d..T6.2.&...U<..#.mHP..8q.dyr.'.A ...>..h.$N...
P.l\al".i1q.[.a...d...../v...Xv..e,s,r..P.9.ts.1[..*.H..].E@QH........
._.A..;....]w.u.....H.l..(a.p..........8y7.......=..([email protected]
<<< skipped >>>


GET /static/marketing/main/img/hover_elements_sheet.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 29426
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
.PNG........IHDR.......A.....'.V.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>


HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:07 GMT
Connection: keep-alive



GET /my_games?gameId=595450 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 15999
Date: Fri, 01 Aug 2014 15:05:12 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........}.v.8..o.9.....H..Z.or..%..l..L.};}y(...P......>...}..$.
..I..%9v:[email protected]............=..........{.....1V.._......c....Wd..l
....#7v......7.1.q<.m4nnn.7k. .5....j...AD.N.....~=...r....~P.#.6..
E.......n.....p.(.....x. v.......I{.!.2.5.m.....C.0.Y9.n|/....)%=....;
..K....Sx;w.J^..J..G:..B'.H(...2...... ...\..~............/OW. .:.A'.e
*\...j..x^pS.M.]h.....P*.E.k...y.........d.vH}.2..}..._Z......0..4..m.
......KDVZM..lnmmn.n.mVH.@_p84]G....n....5w6...`...JR..,.-....7[F.....
..7SF}.......A.. X..k..]...bF.._...`...G.yxs.1.z}..-.....v.....{..V?..
...A.. ..<..b..-.]=9=<9...l..non...nm..l....^...........%MMG.'.0
)4.7M..... ..k $.o_...i.FF....g..0.i..5/.-..R....._.^...._.6.T..G.<
yslr`.4.1.a.%;.....n..,..HI......L..7xi.1.7.K.......;VR..`_.......W.D.
.6..8...1...G...Z....u .:........!5.Q0.mx......~.=.N.A.j.m..R....F}...
..@R....{..G...(a...a))_.....p\..5.....=/.X..5....1.......o...>..1.
.o.B...;..oG.....=h.oF....A.."k..G.~C..... j....H....k.o.).0...``...k.
..oO G..K..p}..9.E....,!3.....6v5b9.}76...[[k.-....5[-.2;...\..].C;t.:
.....f...?.Ck|......n...(X..~....?...^.9...A..M.1.V......J.Oz.#..GQ..9
..d..8 ./.Z...g.n...\.....N;..0g.!8.U.G..#....v.5.C.c...}h......].0._.
......h..:.D.....-I.o........../.6.^.......<.z..~.z..*...GQo.v.....
..4)...\..o/....z......6....h.B.H=.z$....5..EZ........_....J.w.GQ....]
......o.6[kfs.l.'|...rnC...-...K........Q.*...*..BR%.w..s4...~..R.....
....e".......o..ud4i..Dd../ip...e.RI.!..(U.]K.h......Q......*Q..BZ9..7
.87..s.*........Z.\.2.\.yP...._........<...n.~.S........:.p..;.
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:12 GMT
Date: Fri, 01 Aug 2014 15:05:12 GMT
Content-Length: 5435
Connection: keep-alive
...........<ks.8...j.....J.L..L.F....8u...)..\..TA$h..H-..u........
.....J.".4..~.......p-.|5.........G7I/..Y.?w/3n.|o..w..........T....o.
..c...x,.....~<.*.........[q|"..........|z$......'...Gq...?l.S.z.q.
.2.f..l.f.K|%.ERD.. ...0.....T._..d.Tq..._.k.yi..]/M. ...^.......{!...
7.......x...;;9.p..W........X.~|....=..N.?........b.......Z|<;9..mL
(.#%.T.\eB..(..H .D2.T^.S.s.w._.|.......MD.....6.M..X.4S..x.9m.....5.)
.Iz*..l..a../j...x#~......._d....|5H&..i*7...2C10...0.a.......|!sX8...
.DX$k....."....L....Tw.`..t0"p..........b..H..5kM..ei.;.l.<D).G%...
........f..,`....T.$.....$Y.9|...\..b.FQ?8.6.z...!0L....J.^..i8..p).b9
.~.....zf.B.;... L6.s.@.%.E?.H].....\...[...g.;.,..x..^9...i1a.{.X...#
.^......7..D.%L.../<.J.G"z.&K|...../..W..E..=)bX.0 4...#...U...@.&l
t;....."...H#..U....)..|m0p)..8l....n....4.Q._j..M.p#S.KS....@\...3@..
.u%C#.Vm[.~cMa..>*.E.#....2EWW.VK.'P.f........R...,.B.k...Z.1.a.:I7
..CV.=.....W7r...H.".-..-.....q........y.oV...|]*...e(n.e....qo#..cDz.
....]......Z..DJf9Y.?...s..1..X........s.3x...Uw...iW@!.....>{.....
J..!|~&.]....L.......:>...o...0.....=......if:C................._..
..A..WM..M.2..r.!.XU.fm8K....p..........AZw.........U..4...I.x.H...3..
.G....7tcC.U....j{....!S..^.v....../*|[email protected]@ .vA4.a.>7
.-S....[.....u....bi'......y..\<..V..5.QH^J....x.G.oo...;{q..&dxH..
..V...d0~Ai ....h.l..B...."..=..<..{?MV ....4;.......6#1.(...,K..,)
e.3,.~...L1 .=.....g..b.f...F...^l.y.W...'./.....A....!.............l.
....._.6&D...!..kyi..^k....*.h.......d....`.P...>.........[. $.
<<< skipped >>>

GET /system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 3350
Date: Fri, 01 Aug 2014 15:05:12 GMT
Connection: keep-alive
Vary: Accept-Encoding
............io.F....?L.FDA.%.......h..0l.E.I...I.S...b........P..]`w..
".=o.5.>........dCv....0..i....yY.l...<.K.g..e.~......,....!....
.`..b../.X...{.qq.{.......,..Y...V....T<..s..D.....z^U<.O..<.
.....C.sR..~...9vx..<G.......... ....?A.K.sX.|x...9qx.O..,_.'..T...
`.C..V. ..4.(/...) 2{.Ky....!<....P....N..h...Z...|.F1...R|[email protected]<
;i;..^........JN...oyq.I...B..jPc1.Y.o....R.ky.7.........< ...4..{.
.D/.:x......P.P.WO...h...e..Q,5Ob.25 .xT.7".....Y.O.1.U.1B.ES.........
....N.K....4.AG.C.........?.6..._...^S..5Kx....../...Z....4W%....).S.j
.<.'.e.E..E....b....%F.g.~9......g.....,|....'y)!2....4em.R.[.oRNS.
;..L.....m..l>}?..r...G....>.q.I.j..K...Z.63.7X/..#0...F.."...J.
J.a..?qT...r..Ry}.Fb.!K.(y=. .M{`....7..q.G.....]..4.... .E.C.....P...
\X.E.OQ..H....Ws}..H..E...2ghg.5Q...'}o*..H......@..(-!;.A..L..hY.....
,..;..y....../`o..6.I.Oe8G.v!-.y.......Y..g..LmQ..W^^.).....8....5....
....YeT.y...3....I.(..Y...^.#.'~........[Bb..}....F.$,.,....e........_
K..C......O..._....\.V.z.w_.PQ...N.O..z._{7\b.iK.j..9..l.C.PQ..=.d....
E..O.........E....G;[email protected]..)8.l.G....B...^.".r..
..,o..D.......A...5W.......]...;?=8;~w.{.,.Z.z..P....}v..b.T4.L=...T{C
u%.f3.%.....lsS...t[#.4F....$.Z......:.iX2..L.F.^t....N..F.)u.-.k..(b.
... 5GyLq.,..j..3..e.T?M..5S.l....X........q...L..{.([email protected]....:..
...ya....zXAo.Qr..l.{...%{..d{.y...A........"...nW..v.9.2....z...:.C..
......'.lmX....t.{.*tES......%/ja..{...e.%J.......).:....~...HBsd...Y*
[email protected].}.;.._y.d.,.7<....w...J..
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 33690
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:13 GMT
Date: Fri, 01 Aug 2014 15:05:13 GMT
Connection: keep-alive
Vary: Accept-Encoding
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 436
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:13 GMT
Date: Fri, 01 Aug 2014 15:05:13 GMT
Connection: keep-alive
Vary: Accept-Encoding
..........uSMo.0.=;R...r...M.=m6..............d...6....].Q9......<.
Q.U..`s..^q.NU.....,..Eg34..0<..5l[.t...f/......~..&..Gm.aA...s.-.D
..B%..gO.wc..\...)..(.....m...cR"..\..c...`.,G..a,.C.*.....To ."..I...
.s..0.....K......n..!.q0\....8;./..].Vd..\..niAw.~.Z....N~..b..I...b.X
m........U.....2...,.S...T..R.C"....w....X./.F.iB....F...(c1J.'l..5.N,
z!.wO......M?.H.C...........%j.X...HD...\....EO......1t.& ......ML2.L#
....y..Th._.>..K..........


GET /system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:13 GMT
Date: Fri, 01 Aug 2014 15:05:13 GMT
Content-Length: 4815
Connection: keep-alive
............ks.F... .............7I...9.:.N'..Y. .1E*$e......}S.,%m...
......X.......5...DT..P.f......4g..d.....=.].u...i.WC6......h..*..s...
~..x=.9.........q%.*.....tCv......?/.^.d......D.....=....#.?.c.H......
g.],..~..H#[email protected]..}.ds~...f.J...b.4.L..aU.....Y...`....2.I.(~U(
.Q.......M\8.k"X.~.Z.....r..$P.........G@,....w*V.....m..._.-c>..3.
b .>-......*.:.....I....,IZ.e:Z...4e._..X..:..f..........p.r...W?.a
.\...........O......o._]..........W/"&.M...[.H?..".E.....#....W.1N'...
.O.|*....e..a.Q....Y.y.`..yZsR..M.2..p..I?.....{..$....3f.X......f..g.
f.P,.....J.]Q......f...X.."OB..C...b...EN.a^).e.........t..../.".4..[.
.o.1QF.q7..e)4.....b|.2q 2Dt..q....cg.a...z.x.fI)`......08M.[6.xU..H..
U..........[."...9 .E.xOS......D8C..E..L...T.o"T`.4......../8..g".....
?....j^".b..z.....L...........$....N..}...acB)....0`A.........o...Z..&
......~.r.j..T...D....../........)....H".AMo........EQ.R..0Pc.1...}.q:
@p0.o............-.......B.!..d`;s....p:..M.r...cJs....p..F.M.[....\..
..o....r........%.2QK.5.S..79xJ8z.=....{.|...g.'.Mqb..y...5...5..=mb..
.$.P......p....q.P.(..XV..: ...A.....>...-..u8P.(s5.Y%.~.WR.9......
j6...Q...Fy.$Q._H.b_}[email protected]........~.....j]~.....*0.`y.yf..1... ...
zDr.p.\.FE[F....A.iRp'..)...}R.s...a..tF...'0.je.....0IK=...,.........
>....>..S.5.,.......)g.,..O]..SP..($...d|!.9`.z...,..Q....JT../.
.a....Q)...'Z..g..Q.h..D......y.....=:...........Z...<&.A..O.3..3$l
\.'g_J...p..>.\..qb.t.../xY.....f.kKi.16.u).().B..m5..a.-..4.l7..q`
....F....S......`V..D.`....o..e......PC."8..R....:[email protected]
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 1417
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:14 GMT
Date: Fri, 01 Aug 2014 15:05:14 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........WMo.6.....P...5#..z.e.(..m...h.KQ..E.thJ.(;.W..CR.%....:@l.
..7o.3.......%.O._<g.c..`/........i...r.?y...V.fy!R...i0.^_}.4.{...
.........i..\.l>..,Y.4.6.~...\_.s&$.....=."..H.)..4.|.....T...}..,.
..L.nq|>D..P.E.....S....)E.z.6..._}x,U..B.......U.$...irJ.be...`...
.s.%U...._....MU)...';R....'I....'..A...|.....Z.....Q3........Rbk3.zxQ
....U..-..b.....PW9...,XX...6....!."^.L....`[email protected]...;z.....#..d*....
..q.KVU..L.3.&...9.-.|...7Ya.0.....d.3...._.NC$VE...FFEq.>m1Z..~...
i.."z.....J..#h....q...$'.u.m.....i..H..1.F..tR.|9.q......*Kz`>..!.
..iai..U..".V..{....7e...." DQ..e.&....W..d..9..-.l.\..<..gAQ4z#...
-_..Q....c....K.C..Y...k.C...y.u9.k58.T..4.C.?..........9......M.d.|..
k....]..vf.....y..#O%[....b.(..1u....W..t.p...vV::...r..go....J5|C.p._
..B.1T'.r.......(....! .....~@.#.~~.=n3......j8.f]].../...^Y....?....B
Kf.y.6..{....O.._."...6......A."./@..A... ..iz....X.....A..6....?D..cn
....L..8R.ds.(.....v.U..A.....)p1Amkn..Sg..w5;.R.K\5....bQd2:!.#l..u%.
...R.j.. r. p.].Q.....j..|Av.8.f...gI..K..\.f...g".p.'.@.........)..pj
...n.N.%.s..-.5plEw5'o...{Z.o..{.S.};...v...gw....nO...\....j.{Z..g2E.
.........l...w7..*V....*. .J.1.@..%M.f.\.....P.=?;*........03.U7.C5.9.
>m.......ye1...l...8x".#..Y{.W.:.'.Q.....G."..f.w..X.).i.E.35Z~ZL..
.].....NtI..%..{..kN..M.{.Z........N..ba..$D...,...n.#J...1..ih'.z..u.
..=p.L}.4..2Ms....fxr.!M.:1.H6...a...o....tC..Y.....y....p..E.^..p.Q..
#(...]...Mk..Y..[Y.....'}..8....Y#Q.......
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 2559
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:14 GMT
Date: Fri, 01 Aug 2014 15:05:14 GMT
Connection: keep-alive
Vary: Accept-Encoding
............iO.H.s.......I.KJ.:.az....h:...j5.Q.......6...{..WH`....\.
....go|...[^.|e...v.........ly....o..?n...>|a........_..~....n...?.
X\2_...07..A..*..`.p.U!..B.FS....&....*Vb.r.pSQ...,.by!.".J...$.......
......._w.\..J...^x...t...v.hf.*[email protected]
[email protected].....:...5.d..6........@ Y.'..@]7I....,..;.3.Y..B.]3 .*..X.Y 
kE.....A..} ......"...gb..6b....N.L.n f.v.9..m.D..#.efT..Y.):?v"."..L.
.ZM./...d.s.$[......I.......[.l.*.c...B|.yqt...7..Z9p.{.9.........w...
".....d~4R..f.q.yR".h........Cf./.6Q.D...`..0N.......dC,..........M...
.fq.V...G..o....'.f.a.FjQ...1.f...Hf.;.e.?..."\.qPE.Q.x...<X.}jk9g(
..fl....D...b..U..X...7.....D...<...F....=...J!..... >&..L#...5g
.`$.,..T..@/.h......b.e....[.....Y...9}.9. .K4..[.wC.T...!.?i.'T....&l
t;/[email protected].(|ZN....7...WQ..f........;9....YZ.GfT.y.DNS....y.`M.6. 
..$#U...:C.....gJ......)..D8..r#....O.[,.T.Ue.....r.i.M..R..J.;K[...W.
P.R..#.I%..Eq...1....oa..13\....].T........sVG}.iu..&.r.j.9.......".{;
.7...)...~......Q.U%....U...i.h.}..{...%.9Z.xz.y.B..Z.......N..'....Tc
:..H.o...Kk.M..&..=.I..fjO............H[.94.F1...qh?M.....&g=pE..B.=..
U.E.(}d... ...u..^...k.v....6/..c.5.....L.......["....j^??...s.....1..
.*/#3...H.,|..v.bJ.."..dCD7.....'.y.xn.0.J..aq....E .~29a........w...{
CK."\...\..o.?]WU...k%.j...n...7?.y....w/|...c.... ".\.j.28z....Oe...G
n..<.'F.=X... .q......8...K.....`....b...X...q.b..b.?..#....}P^(...
....a.6Nh.. .....ALQ...j}..)..m@.....^.........1..".%.p.....[....0..h.
...]1.....B/.;..A....f....f.0..L.>..$......8_.h..SJ.P....=...v.
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 1037
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:14 GMT
Date: Fri, 01 Aug 2014 15:05:14 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........V]o.H.}&R....V.S.J}"...S..8X...jeQ<v......Z........6i..J
E6.s..9...#[email protected].._P$.}J.F..3.>^.....K..)%...........;[email protected].
\O|4....Q$..>...6..cZ?.qB.[LVx5..8....Yr7,....C..,C...w......P.q0..
i.......<[email protected]..$.....pr.A.6N..$1..F,z..E.p..\r.0%..
..... .=..`..Z,...N...(..L....F.s&7..E..0...X6%....X.........X..<..
.K ).^.^.|..4w.6BY.|.U\..%Q..^...0F....[DV.........%....6W..S..m:..<
;3r.un..*..=.d..... .CX.X..so^D....^.c.\..4_.y...U..:h...._.....*.u{i.
.N....V.G...v....../..Fm...QE..L.Q......)....f.ej.p3e...zU.j\..T.jtE..
$.|...!#..x..:s....ld1.T..&q.......=~S...........B....U..h.l.d...%...Q
x.vy...q7/XJ6.zo....d....9%j^....%[[email protected]@..2.
..F.X.$(\U-R...p..'..J|...zZ......n"jK..i..l.u.IZ...R./.;.Uh.X...$&..(
.......2....b......"......8...V.C.l.0i>..aY...a~.LSr.......~U.. .gR
3d.k....w.......a.S]..y...$...X.F..s._....G.J.N...y....5.#.6.H;'E.i...
..=.p[ .\.,.5..j.....W..........I........l.V.......w..?.&.....}.@.....
c...J!.S=q.=......|h.j......>...^..........i....]......?.k~. ..J..K
...../H........


GET /system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 2522
Date: Fri, 01 Aug 2014 15:05:15 GMT
Connection: keep-alive
Vary: Accept-Encoding
............ks.H.3....s{F.....-..E..K..> w.uu...`k#$V..}6....!.....
.GH.=.=....o....V@.~.....9....y&.."........z...>.?....%.C......~..c
.7....z...S......}:E.)ZK.Z.9.S....Cl....|o..)...g.........].*F.v.D...:
C...............m..o4.....R..l.1.F...3...'...._.&....[..v...(.D...hL..
A.........:.../......3#....t:.[..yy!.......$..2.$st.{[email protected].}p..&
gt;..G.....b"F.TF....I-..^D..X.T...ZR...X.\r.C...;3...'.."CF...0....I.
.....%...kfF...U.V..%E..............CM{..PC.zx.........j..<!..Sep..
..A..._...........F....rC*UC.....D.I...x....b.. N.6.\.,...}.*6F.......
...#u!CU3...p..|o...."%...G..........R....G....`.=..yt!E...X.3W"T..t..
.0..y.p...M.U7...l#).k..^6-...Rb.A...O.....F..h ..2. ..&R....[.~.r.YP.
.T...Gs.(~.i..;%!M...H.L;.b.Swl.|..*[email protected].)V.M.X"l....4...0y....N...1
zri..ej.Z....K9mX._K.?.........h .E....3IX.UUj.~.....l......o=......i.
....z=.2_@#K..*].*X..G.# ...N".U.'..:......C-h0.....B=.YM...d%K.g.7.9E
..p..J.R&......-...Z.._..Y.6.J.t...0%...Y;..........2#.P..`.r.3...|s.y
.G %r...R......>..f>..0.y.._.yi..<....<.9..ex..9.*.N"u..ae
.>...!.....|.#..0.U......S..V...Q....c...."..0.a....b%....f/.....i.
.r5.$..>...........V.R{.`.....s../.z..<.'il.....Q.\%.z....|.ueB.
....Q3Q_<.......g.eU*g.'....0.o.I..cLS.J.(.......}LP..Fw..v.w0u\...
i....a....Z...5...*.9G`.L]j....LGK.[...|...N....{a...W.K..K.!M..".b.f.
.`c....wn.,%.^...<F...1......h.8...........j*.....T......6k....O.h.
.V.EG....U.-5%...vK>..y........a..$.g..Bi.....R.s.[.5...Q.....:}a&g
t;p#|.f<..&EQp..H[..`..\.M...Y.........h..Q.%~....l.oW..0q5...w
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:15 GMT
Date: Fri, 01 Aug 2014 15:05:15 GMT
Content-Length: 1228
Connection: keep-alive
...........W[[email protected]..)......e3.I....E...o.-_.....X"
.......y...P.....*._WB|g4...5YR....8=.=.i.........C.....gU..^,.U..!V..
..!....B.z.(.%.zPX....g..... &..?I...1|.../......./..~..m......'.U.,&g
t;"?V6.^..j......  ......VD..a..Ud...z....bDOAT....Fy.....=`....c..I.5
...........A...3=...I.k............,h...}..qK.&.....'a...=....qs...1D.
)F.c=g.....cl.b.....X#...q...1'.....e..V.............0.....Q..q.X.TR..
..B......M..>&._E..........,.h.<.....p..z...H...R]...8..o..*...8
.:.,r.[..j....`xK8..@.... [email protected]:...U..Bc.X.4MV...ox9..VNc
Y.L..]q.oM.......v......F.z......t.....t...}....mLl.*...._g..7..{\.4U.
.n.2-..;.=CF.... .....N..O.~.*.D.....F..'....V./_..W.Ss{..J,Of.Z:..D.m
.j...%R%Y..\..KI6.g.j.........(..G.u..Ri2..L P Z..a.3..}.......t..k.4~
..*..U8..........Lt..83....z.....O|/5M.....M.,./..m..v...fq...]Y3.J.$.
g0.h...C[u8.?.M}....f..T."6.M.3.77m6..X...Lc.Jc.....5.WD...d.........F
.V..6.?p.......C.......S)..}.3..../6..Z`P....\.Q.....-..n(A.....h4....
..em.Gj)...snr}..i.D_...._.N.m.[.........v...3p.`..}[email protected]..}F....~.
.\E....}..n...V....".B[@<9I.$..... ....-.*!m ...L.Xj....30.|..'....
.'[email protected]..{x..v...^..`/..E.\.Z7j...[wj..:8m,.{.@4).'
.........r'j......u. ..o...<.UFS.|...y`S..b<`v........
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:15 GMT
Date: Fri, 01 Aug 2014 15:05:15 GMT
Content-Length: 3944
Connection: keep-alive
.............w.8..........I.nw...%i..[..I.6.{O.......4%..oF.?!..]...h4
..{....t......w....<h.N.d.i.....$.'>7.p.....8.........F.}.b.6...
.F2....U.... .9..je.s.....f.M..D..3/.U.s>...'...,j...."p./.4}../)..
.^.]bD.H4b\Rr9....[.. ..Sb.Y...Y.../J.|.G`.G..n.!..%.'......<:.b.. 
l.D..wq...LY0.... /p..qC..Y.x........$.. :f~...t0..!.....q.....83N....
...xm.h.-.....1...y8n........<.;ww..fs.\|rw.&...W1..M...L.lJ.s...x.
.3... ....5..an..d.F.....>j...f..D..Ni.... ..9%.b$0.....[/).Gs.. ..
...8..p.....D.nk.nK.6.S?..'...y.Ot.#.i....^...M.`...C..h....7../.f....
e.......H_..2.ty.D..e......)(.......Y.......0y.F>w?........ZR!..5.U
.p.../[....tu......T..<....i....,.d......-.]L.(.\t0.....v...f..).m!
....^.Vg/M9\q]H..<.._rK. .O_'...~..|.. h.......s..<..".9..GK.. "
".F.....<...$.i.......I:(.....5...M.....4...L......'.(X..v.3.......
.....X..J.q.....4...-.=.z.g...kI&......H...........s.'......P\.mw.....
[email protected]:.`..^....\.l...yq.....m.5...w....B..K..B......f...V....
9SAA.jT...Ua....X4..96.....].D*....$..k.J.m.m.< .|..../.(.}..|..]..
..1O......Cm_.LGQ...x.q...w...n..W..%...Y....cm...u....mwG.......A....
..].T#............cv..Y........|...2qK.~6}.L.i.".. ..u.C.k.Z....."....
.....`B.......Z%...P..l..M0H..@.;......f.}B.e..4<....D-..@..!d.$2_.
h6...J......HA0..S...6..q...d.}S...-.....UY.....e&h.q.D.h......4. ....
....l_...P....~9....=G........3... ,db..a..M.~.h...M... '.2.y..y.T.d9.
...5.E'/`... .....!..'...m8`....].:9....s.*........Xe\......j.%p.w...:
`ub{.d.J.$!.."..c...PD........V.m.[(d.:#.T...k....g#dM.g...,..1...
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:16 GMT
Date: Fri, 01 Aug 2014 15:05:16 GMT
Content-Length: 580
Connection: keep-alive
...........U.n.0..i.....(@..t.:....h..]..`....&....H..%E..m..:..{.xw..
...Z...........#m:].4.....\.....g._J:...y..]..7`...I.eG.....4.? #`e...
.|..Y..<..V...p.b....R.r....k....;6......eW...O..`yNC..........0#..
._.9.....]../W......y(.2.., v.:[email protected]?.V.@,..&.t;.u.eT3.
..|..;.....v.F....DQ"..D..u..}\.ew.".-`g.XU.a.i.3.......{..s...:..N...
`..h..4R...?..s....Nav..i..,[email protected].....
..K.Sk....7..sE.|o.y..i...,......J.{_....;...va.....K..t.|.W....t.A.|u
./l. /....:...g.TT......E).be.;....... u.....S.....'P5..JE'......u..pq
.7..c...N>......rp[o.......


GET /system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:16 GMT
Date: Fri, 01 Aug 2014 15:05:16 GMT
Content-Length: 1394
Connection: keep-alive
...........Vmo.H..L...9..v.Lr.OP...E.W.%..S.E.{...uw.&.........^....y.
.y..i.y...o@?.,.0IR..~]&..H.9.2...1...p.k.0.S...3.O.-IS.,.*.U..#...f.;
.lA.L....../..-.d.~.i..........%O..'........2M..{F...<.Q.{....;...G
..?.t6:}8.....p.k..=%.>..{....h.xb....).:....fp.......?..=..]...=.O
...X>n...cvs..Q%.L6U......g..x..?.^...%..-R....,.1!3..e.X..gB..2...
..*{..J.J............2...!eS_..........CL...}.QC....u....z.o]$.-.$.hX.
D....?.>.o.G....Z..|x}3~.p}.76....[."9qm.n.z...................-..J
....I..ZY.,......7e.|[email protected]._..(,.!(..,............JUY."
O..7..F:a........;...4...~.....'.....%.Du..K..$.....o....b..ZiT.9n9.J.
o$]..;....U(.....,...z.~.G.~....%...*...h..|j.T...d7&v..W`.m...v6....w
.....PC^..l.b.;.........BG..h6..)Q...A.8I.t..s...e.#7...f.....|J$1.(cI
....mW..7lW........N.r.g4.......]Q..!.-Z......[:.kjKP.m..t...[...MA..b
.l5*.}..f,.k...~.E(K...b.....E........u....?Pn.B2'/...H..^.-%........1
...v..W9.4..eyS/.W.U.W.#.....]Bi.t.*...z.....%9.c.-..$....._..O[..^...
......b."|d.......%.<'.O..G#$Rr...'x.u.9..V.......N..C.DcSG.N....z.
[.......u..bs.\Y[..)DB...8Ab' ..e,.^)%yN.x...@.[..h8..^`X.m......VD3.=
..7........9.$X..p..&|..:.[...@_....v...mAq.... .....o...\D_....9.-MG.
......Zv...e..2:..?.YZ.._&.....Q.}g.w...$...t.K..E'*......=(.Xo./6.&..
..'j....n.T.....G....,5t.i.%.~!.....|...%YR....x.....>..F.....!U...
.jt...^S.,].bzx...q.......QL..]......u./Z P..k.....\Pw.9..V....2......
.J......W.......
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 4875
Date: Fri, 01 Aug 2014 15:05:16 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........<ms....u3.../9Q'...K..-w..I=u.._.v.WC...'......>.....
 E.oj.>...E`.............KIp.{.....................qr..\.Q..a<..
........g...#..W{1....m...........j.n..%.O....}:...;..CQ=dT..... ..3..
.."9..".Y..v... |f_.q.\.....Is.eS........L[...x#...N....98.....Z.q...2
PJ.Wvk.{o....................G......dK..a.2....&..i......F.I.;...~.1..
..c..d.}.7..{t.;.t.(;.g4Y0s:d...#.zA.{.h...i.I.q-:.. .J]...'.yD..(..fn
s.....v.%.b..Y.h.../..J.7.~...eu.....<.......e..`.m.%Xb.pLl9.....3.
r/.,.E.j...2.4..........{...M....K.)p..,b3..%..-.Gr.L.Z....:.m..%@...Q
cSJ.i.2.......qkh...Q...rm......^!T......b...4.{0....W/."..=....E.)k.N
R......4.....#:Z.1P.......I....._..%.4x.&...;.&)... a.8.&.....0IC.....
.=B......L&....<....x..NA...|..]..T.,.s......3.h.q..<nX..Q?....2
....O.....!....7p.0.].=6u.Q..j<....V.;M.i...4bir.ms@~%.!V.j.&Wu....
.CT..:....7...n....R.H...m.z&.]........].u.D.....>$.p;K\...?...S...
:.......o..~.....*c..K..jR.W..[q.U..T-{!N......h.Q.>zi..-..........
........."..=......nhH.3i`B..&...>rk`.....X...=M..'....2.i........|
V[..&.s..4Tp#.mn...7...1NGo.&.k....D.....$.....S..R.L...?..^G.<..l.
.....))..%./X.U# f..}8:.X...6..F0.D........h..)W......E..z.7..%...i..S
.0.#..P.4..%......([email protected].......{.....&V.
c)9Qk9f..2.._"cd.e.Y$..J.7(a...0..W.vddD......7.H.E.. #:.f$..q..<hM
@.........ol..5..X... !..\z...i..Hk.AoJ.3.-.b3j..c...kuie<l'.. ..#^
..d...~.........^.....v..P{i..~...._c.my1p.....6D.....X.....AY.i9.....
N....g.2}Rw...E!Zw.A.ZaLmV.m..#...MO-....N @.ME-.x.~D.T../..,.s...
<<< skipped >>>

GET /static/marketing/main/css/main.css?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:16 GMT
Date: Fri, 01 Aug 2014 15:05:16 GMT
Content-Length: 2803
Connection: keep-alive
...........Zmo.6.....b."M..._...z..mw..n...h..@[...,........_%R")....a
...p...P|.7Y..`..?.h...DEoQ..7.[.o.7h.>.z.,.%..5B..{.>.<D1...
,..J......).S...(p!i..OG|<...z...Wp ...>..{.L.._.../..x..x7.g...
~.....G.m........3......S.....?}..3....6.PZ...4._..-....wB..7....m.(.P
...1..Cg..{p{J.K..o...,u.2."11i../.W.m.........'.W.r..........n|%.....
n..x.......%[email protected]...&.[.. ..t...)..8..9}..&X.....\.a...a..
.{47.0`....)[email protected]..)...y=......Gpw.o....@._...`..Dp.?..Ml.2.Q.3.
\g...U.l...Xl...#..i..3p:...'..P....}...&^:Y.x...o....<.&..7p.8...z
}2....e......E.2..Y...zo....i2[....tF. .k7.I.....t......".a.=.......HH
r..4|.\R6i..|V.1.@@.z.]...%.".!hy.....9.....q.L.G.j.15...LT{...p2..24.
QDt..j..B.>..0..(..7[...<.....H\.`[email protected]...'.y.......
a.^..#&&A...D....E.Cf$...T.r.r.#......l$Y..6..1...G[9...Mo.#...?30O.5.
.Y.._.#..{9ikVBU......9. ..E..1..o....`N.H.x.Q........-.&..Gm.....z.$.
X...H..4.w...jP..75..z.K.;.k}..F....G.......-K.x#..(.`..H...M.b..UN.A.
...B..8e.5%.r ....W..../}............n..Ix.......*l..6......!I.Iz..*.`
.2.&..'..$..Y<h-Kj.i.....,R.....;=..J=6..1xvw.......^.\8'.{[...iF..
..K.........&n..9L.........NU.d0.|...t..SU....2Ud...4.I...n..[./......
.=PZ[c..a.>.0.P^cI.a..k....VCb...A.~.#{.@.... ..\.4....d.....(..Q..
kena.c...h{.2R.PV..I........&...<H=Gqu(jA...(.:....u..u|7.l... V.Gm
..|i3..S.J*.F,....i.=.6n..j.\m1..R"A [email protected].
O....pt$...Q.....y.X....'.(1.N....%..........h....5uKk......Ph.7..XGBN
.<v.<.<..D&.9?I...>.......}.kT<.k&l.m..c.@U[..',...
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Content-Encoding: gzip
Content-Length: 336
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Connection: keep-alive
Vary: Accept-Encoding
..........}P.n.0.<..?X..(......AN.I,.odo ...k'.....}xfvfm..?.g..u.\
../........f..>lYx.XSc...!?j......V......:.U..E.I..2.h:.}..H..Hbm..
..pm..C....V...Z...{.u`$..L..Y..;kE........tU.H_.....%../2{.!...i....N
I [email protected].$r.m.8h........p.......I.3Q.4(I.h&,.3...). O..3..(.p.........X
.^'^"..Ji[....NI....AO\.]YQ.......$...(..Bi...)r..1.....2......
...


GET /static/marketing/main/css/sprite_sheet.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 2713
Connection: keep-alive
............[..6....WP.<.......=......g...&...e<=S.. .0: k.v.&..
.GGG../.yO;...y^^.....Z.'............omW.K....s..^.............?..n.w9
.o~.....r.........G..!..$e..u.....5...z.7....2m........E............./
....~M..Ls..>:(.=q.;........V.o..>.........C.H..kQ.E...R._>{.
 ..Jq}=....>{.....]ux._ o......g....?JW..x~~)....=Is..}.T..~.[~{zH.
..1.O..hy........b|...;..xj_....."..-D..=1.9..#...%.,..<~.de.G.....
.....4B....R...F``...H.....w.9...!.Q.p8k..p...w...T.6........c QqHz...
...5D..).T.V.p`.f.........6..|.q.y<|....e.1)rQ%.6r.Yi..R...d...`...
.e.....q.V.dm..().[{{..q..a..z...W........!p.%4...<1.]...@.{..x....
.fm.b.R...W....\/.O...Qi..;>..Z../....$...`....p$X......O..d.m.Y...
2B......%hp.44Ty...J...o.h..I......Z..TgRGk.?Q..][email protected]...../.....8...
LTh...K.tH.w...d..........v.]Ov.4.#..T..$.J.c....mH...........X/|..[.C
pk.[s.m.'.25.<6P..."...S....!.....H3.Cpe,.z..-x{[email protected].@....
f.........E....J._T..qC.......&...z`D13.1...H......Ka.J..n.*....(..-y.
.b.j.l.8........H..W>.]3....#..D..>.n.......b.3 .t...g......M..5
l..........S...4..x....|C.?@&.......~...3%.Dm6...0.2}*u.X.o.Z.0.$..l..
......,P...K .... . ...,.o9/......q...N..hItdo ...'.....<....0.....
2...J..$6..y.O.LW..V...3h[..PH..%...B...,..|F{...........-..;.GT.$6..!
e.......lQ.....7.. zO..b3..c?X*0.....=...t...4.qB.Y0W..."'..Y.......# 
.G....L........*5.(^.`.].......I......J.x.D.A..=,L.Vsu..../j3...~..OP.
.&T. ...)K.Xl.W.,6U.....w...O. D..s.............A.N..C......Cp/.f.ox..
....j..V.d.>....EcW..r5...K....|.....*.A..*..F6....L.cr.]...i..
<<< skipped >>>

GET /static/marketing/main/css/tinybox.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 459
Connection: keep-alive
...........SMo.0.=._a)..{[email protected].!V...f.v..}mCRh....,y><3..sb 
...h...V.*......c.a....).....2&T["..#"/...o.P..%*0..EQb.R\....]..6q.oq
..q.k..`\-....Wga.D.{....V..X..M..A..I.,....\.eI ...A.y..E.~..V..;,..`
h[.z}..q.C4.v....\7...I0....Qs.2....M.K.....E{..U..".=...B.......Z....
.m....:M..h....g...m@....,....k.a..x....o@.'~..-.mlN.9....qg[7Y.......
.0....X....M[x1.c........2K.,..*.4..:..K4..A....P...O..8%.....*'$.FV.~
...F21X.._.....".4... g..6..[.q.y....9.T.k.......


GET /static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 36195
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............|T........L&3.I&.3.I2.!.$.8`.......1.J.1".H.R.,e)".......
""......M...Z...K..H.RK...kY..d..y......b........s..{..s...s...?.=Za.F
)La*.?Ua......~....-...........'. ..Y...9.m.^v.{....;..Vv7.,b....p&.M.
.o...g>....l(..m8.._................|.L..J.......n..6)..>.......
..]... ......o.......g.Vm..a_.-\]..?..._.............c..y.Gw}.!_.u...=
.g..;..g^fW.y|....}.....y'ck.co...%....Y...3............1eh.........\.
.w.^6g.C.y.................=..j<_y....yPu.c.2b...=p....~;......w>
;8..C...!...3.....u..y....).......bo..O.eG.O-I....8H.z.3..X......2....
=.W.s86...'...1L...9.......t.%..z..r...z....I.......}{&S\.......].V.).
T...-....&.Ec...8....).>.?..7..'XZ-.._,....6.mN...o...C......n...?.
.....g.d.b ...G9..2.2:2...f<..D.&.DGG........2..]....omJn.x_r.....7
.o25.........'..o......oMn....|.......M.\.o\....KPH..'.1 ....`P.8.....
F&.....,....N...O.d7.<v. bSq..L....W...*..X......I..x.l...O..g.._..
.x...9.......3?..q.OZ.X.p.E...:d...i.~s=......a..<.V.G...Oq.0..$V"&
....D....*.G.`P....'X5.G.:..)...Kl`........oIla_...~...q...66......i.]
l:....*...a.@.:[email protected]......$x.<.6.M`...,....;.........^.... .w
.AX.p....^..@7........._"|..kx...HTTP/1.1 200 OK..Server: Apache..P3P:
 CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Type: t
ext/html;charset=UTF-8..Content-Encoding: gzip..Content-Length: 36195.
.Cache-Control: max-age=86400..Expires: Sat, 02 Aug 2014 15:05:17 GMT.
.Date: Fri, 01 Aug 2014 15:05:17 GMT..Connection: keep-alive..Vary: Ac
cept-Encoding...............|T........L&3.I&.3.I2.!.$.8`.......1.J
<<< skipped >>>

GET /static/marketing/header/js/header.js HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:19 GMT
Date: Fri, 01 Aug 2014 15:05:19 GMT
Content-Length: 1812
Connection: keep-alive
...........Xms.F......x".`.~I:.r..:....L...0B...I.H'....w.N...1i....t.
.... .Cc..4..0..:..c...`<4..J.rhh...4..g....oi\$.V*@%<........x.
.x........^[.[gM....:...Ub^.OI.9.c... .... X..G<J#.N<~gH....Ibh&
gt;...N...MrD...wl*<.l......[8=6.F~..d?y...d..L.`.*....v,......h.G.
.<>._.Zgo.S.N...uy,]y..!..YH5......i:'.g..8!.!.g=.....W...ub....
..Q.......&.#D.&)D...(...".q..}....:!..>...:1...Xb.e>Zs*z>...
.......J>.\.....<....J,(..`I..T...Yn.?. .([email protected].".-.>
.tL.S..D.-........%QJ.4wQ..2.I.S)..4.4.E5S...T.J.7..........v?...!....
.......6...~...8......r..%.x.*...Yn.P....b..P...bg..".M.K L....1.i.;qJ
%-..Z:.9.......g.....;.........2O)...2q_mL...}.........4In...."..en...
.F....P.T.Zg.i..b..D...b....&.....(O.Q.)...g..:....B.tnRB7....M....:.l
..5..fC..Y.bEJ...XL.V..0...<.%d.....6.}..]>....r...>....\..*s
No...I .a.`D......"..,..4..H(W...P.&.Z..dYC;.5GK..bU..ac...:.P..4..2).
..X@$s.l..r. y..d..6Y{<}C.......sb.U........(E.C.........a.. ......
T..j.Q...$B(0"8..F.G.*.|&.....'....[.}8.(i-F_......(r[>.....OPU. *.
.veg.N.OF.(..?.=t..F.A....d..wP....y.a!U.tE.[..a6.........A.S...T....Y
Y..;...1.Vw.Uih...l.^T..&6Ys`....$.K....N..z.^.....ON@..>.#E.~.....
G..]..xK'..$?0e.b....5....h,.Z.a.pT....GJK....6.d...M2.11P...m......x.
..R....`_.Y..s....\...<9r....G.UP...t..J.....fY...D5w.~Bs.].p..\n..
v.3.....rQW...K..h.....!.e{..k......g.7..._j5T^[email protected]... .a..
W.......Y..i,..p............Lb..=!..F..,(.8...1.)..y.:.4u.S-.>.| .I
`}..zc..DNxY ..P......h.QKX..R..|'Yl..R?....S.h... 3c..g.|...g...j
<<< skipped >>>

GET /static/marketing/header/img/ui_elements.png HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 26274
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
.PNG........IHDR..............."T....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /static/marketing/header/img/icons.png HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 34162
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
.PNG........IHDR.......l......d.\....tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:F249C00A9951E111A7D697F015223A85" xmpMM:DocumentID="xmp.did:23E2
C840532E11E197DDFBD349484D06" xmpMM:InstanceID="xmp.iid:23E2C83F532E11
E197DDFBD349484D06" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B36963060153E111A7D697
F015223A85" stRef:documentID="xmp.did:F249C00A9951E111A7D697F015223A85
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>p.......IDATx..].`....{wi.v..4. .......T.(]DQ..
JS:XA)J.."E.). .B.-... .....K..7.../.$(........y.fg........i          
./(B,...........$         ............K..........B,...........$       
  ............K..........B,...........$         ............K.........
.B,...........$         .............K.........B,...........$         
.............K.........B,...........$         .............K.........B
,...........$         .............K.........B,...........$          .
...........K.........B,...........$          ............K........
<<< skipped >>>

GET /static/marketing/main/img/containers/green_left_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1219
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8570556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F87F856F556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................W.....................................
...................A...4t....................q2.............?..<...
..P.......[.........


GET /static/marketing/main/img/containers/green_right_rib.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 1232
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F85E1ABB556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F85E1ABA556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................^.....................................
.....................q..3....6...................1..2B.............?..
.%D @......U.0...#\...........


GET /static/marketing/footer/css/footer.css HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Content-Length: 403
Connection: keep-alive
..........}R.N.0..=...1.D.....0KG/[email protected]!:..dq..5....
[email protected]]...W.D8...C.k......K..UwY....2.....^M}O,....
..?Z.[.$j..I......FG....R....C.>C.........wa.._.oQ...w..rl....t.1W-
.P..g..r.....:..l..F.......#1i...8'[..<.......\.B.n6..*.V.vi ?.....
,=. ..X'}0 N..z.\q...].~I}0.. ..!,.]*.D..H5.....Q.....o...E...m.d...VI
}...p..XC..b...`....q.c#.....a..l..&.j.SX..U......7...6........


GET /static/marketing/main/img/containers/labels.jpg HTTP/1.1


Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK
Server: Apache
Content-Length: 3454
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:FABB056B558811E1B193BFB3C877D24E" xmpMM:DocumentI
D="xmp.did:FABB056C558811E1B193BFB3C877D24E"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:FABB0569558811E1B193BFB3C877D24E" stRef:doc
umentID="xmp.did:FABB056A558811E1B193BFB3C877D24E"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................c.0.................................................
............................................!Q..1AaR.q.."2.#3C....u...
.Bb.S.t..5e67.........................!1AQ..a.q.."2Rb......Br.#CSs..$.
...34t%5...cT..............?...c..cA4.A..S....7.t.....F...#....L.0..EC
F...v.`..Z....7.*...P...T?.^`..v}e.8.!...k..v..;.5..q....C.J_OW../r..1
.Jk...m.I.............j.Zq....W..&.!...[ ....D....yvB^p..s. .....G.1h.
v........}......2.{..n..N...K....$.a^.....J..C...;#.-..B5.....a..j
<<< skipped >>>

POST /action/JSONService HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Content-Length: 103
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

{"service":"geoService","action":"searchGeo","domainObj":{"site":"frg_partners","lang":"en"},"data":""}
HTTP/1.1 200 OK
Server: Apache
Content-Length: 59
Content-Type: text/plain;charset=UTF-8
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}HTTP/1.1 20
0 OK..Server: Apache..Content-Length: 59..Content-Type: text/plain;cha
rset=UTF-8..Date: Fri, 01 Aug 2014 15:05:23 GMT..Connection: keep-aliv
e..{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}..



GET /freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css HTTP/1.1
Accept: */*
Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT
Content-Type: text/css
Accept-Ranges: bytes
X-Varnish: 1111625333 1111321627
Content-Encoding: gzip
Content-Length: 346
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............n.0.E. ..HYS..I:..j.].?`.......W../...Q[../...... ~..w.u.
^wJ..s,Y/L6h...I....u2.q<..s9m..F.Q..z,........AM...FqG...JVC.(.HUm
 ^oFe.&..$ ;Q.:2.$..S.7..R.bpo.&..P.4.'Y.....U*i.....W.d....j...F.?...
B..a..i....1 .q.Ad...o.V....!&X^^7.}.-.....v...=5...r....&."|.#3]....N
t....$.Q......e.....vC.m;.]v..U4......8Y._............c....../C......H
TTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT..Content-
Type: text/css..Accept-Ranges: bytes..X-Varnish: 1111625333 1111321627
..Content-Encoding: gzip..Content-Length: 346..Cache-Control: private,
 max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01
 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding.
..............n.0.E. ..HYS..I:..j.].?`.......W../...Q[../...... ~..w.u
.^wJ..s,Y/L6h...I....u2.q<..s9m..F.Q..z,........AM...FqG...JVC.(.HU
m ^oFe.&..$ ;Q.:2.$..S.7..R.bpo.&..P.4.'Y.....U*i.....W.d....j...F.?..
.B..a..i....1 .q.Ad...o.V....!&X^^7.}.-.....v...=5...r....&."|.#3]....
Nt....$.Q......e.....vC.m;.]v..U4......8Y._............c....../C......
....


GET /freeride_marketing/SDM/SDM_standard/img/header.jpg HTTP/1.1


Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:24 GMT
Content-Type: image/jpeg
Content-Length: 24975
Accept-Ranges: bytes
X-Varnish: 684596343 684455615
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:635F5D80FD3F11DF973A8
2E7643F8FE6" xmpMM:InstanceID="xmp.iid:635F5D7FFD3F11DF973A82E7643F8FE
6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:94A0E3898D9311DF986DD6F6636C425C" stRef
:documentID="xmp.did:94A0E38A8D9311DF986DD6F6636C425C"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>....Adobe.d.....................................................
......................................................................
......................d.|.............................................
.................................................!A.1..."...Qaq2.T....
.B..#.U...Rbr.3Ss$DEV...4d..%.F.Cc..t.fvW....5u&6'7...................
....!1Q..Aa...q."....2R....B.D..b...#3.r..C.S...c.$4E5............?..T
...R.q..j3N).0.....mk.Vv0B .....`...v.-_(T.U{0......L.3.P.5?...j..
<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1


Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/jpeg
Content-Length: 48259
Accept-Ranges: bytes
X-Varnish: 1111680765 1109735540
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:04 GMT
Date: Fri, 01 Aug 2014 15:04:04 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB
4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6
A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................=.|................................................
..............................................!a.1.A".Q.q2#.t....B.F..
...Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq
.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q.
..?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.
<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif HTTP/1.1


Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/gif
Content-Length: 79037
Accept-Ranges: bytes
X-Varnish: 1111680936 1111349232
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
GIF89a|.=.................u..f...^.v..i.Q..3..Ku..W....o...........Vho
/g...S.n.e.-f..h..F......R{......&...j.W.....0...R......W........d...(
............H........F....F..............9UgQ..3.....u..3u.......%...-
^....s....U..5..G........x...]...3.....4.......mOk........"..x.."...x.
..,p...B....*V./JY....d........J........6.$...Y.l........L...vS......G
...........0...3..I...... .w.....Y....r)W...S..3...Y.I.........{......
...........!'w...T.>dye.....u............2.j"$`r....x.....)R.....X.
g..G...U.....G.7..X...k..I.g........E......Z.......:}.K...............
..t...4=...R...~|wR=x.........ok......................................
......................................................................
................................................~........ .c1J........
..............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="...
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:m
eta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 
       "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-s
yntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http:
//ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1
.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM
:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:Docu
mentID="xmp.did:370D4B19B36411DF92A0A43CC032876F" xmpMM:InstanceID="xm
p.iid:370D4B18B36411DF92A0A43CC032876F" xmp:CreatorTool="Adobe Pho
<<< skipped >>>


GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=0-2429261
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 494852606 494804948
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 0-2429261/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......d... ... ...
 .......5...O...(.......4...O...i......./... .......&...*.......!...Ri
ch ...........PE..L...>.J=.................0...0...............@...
.@....................................................................
.....hI..........(...........8C..P....................................
[email protected]$.....
..0.................. ..`.rdata.......@... ...@..............@[email protected]
...dn...`...@...`[email protected]...(..........................
.@..@.................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /meter/VVV.freeridegames.com/13.gif HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: images.scanalert.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Expires: Fri, 01 Aug 2014 15:15:00 GMT
Content-Encoding: gzip
Content-Type: image/gif; charset=UTF-8
Content-Length: 57
Vary: Accept-Encoding
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
..........s.t..Ldd`dh``8s......O.F ..."@2.LL.......G. ...HTTP/1.1 200 
OK..Server: Apache..Expires: Fri, 01 Aug 2014 15:15:00 GMT..Content-En
coding: gzip..Content-Type: image/gif; charset=UTF-8..Content-Length: 
57..Vary: Accept-Encoding..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connec
tion: keep-alive............s.t..Ldd`dh``8s......O.F ..."@2.LL.......G
. .....



GET /pki/crl/products/MicrosoftRootAuthority.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 22 Jun 2014 05:05:27 GMT
Accept-Ranges: bytes
ETag: "ec45e394d78dcf1:0"
Server: Microsoft-IIS/8.0
VTag: 279122442000000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 603
Cache-Control: max-age=900
Date: Fri, 01 Aug 2014 15:05:27 GMT
Connection: keep-alive
0..W0..?...0...*.H........0p1 0)..U..."Copyright (c) 1997 Microsoft Co
rp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority
..140621173809Z..140920055809Z0:0...:..../...V..091210010336Z0........
$... ..020225080156Z._0]0...U.#..0...J\u".F....9.N...`...0... .....7..
.....0...U......$0... .....7......140919174809Z0...*.H.............S.&
gt;l.._....)j.k%..vm.'Y.....Q......p,..X.#..6......8...............xT.
.>.E..H.#......U...'.../....p....(5.....,..F:.......~.....M..".....
.I"....;0.]..,.OI}.....f.2~.].,u...hp.W,.'wj..%<......Y.N.. ..u',..
 ..v$#A....l..9..m.T:s... .>Z.k...l.....kVyi......o.....



GET /do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:02 GMT
Server: Apache
Content-Length: 95
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
 ..........<html>.<head>.<title></title>.</
head>.<body>.....   .....</body>.</html>..HTTP/1.
1 200 OK..Date: Fri, 01 Aug 2014 15:05:02 GMT..Server: Apache..Content
-Length: 95..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type
: text/html;charset=ISO-8859-1.. ..........<html>.<head>.&
lt;title></title>.</head>.<body>.....   .....<
/body>.</html>......


POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1


User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:04 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:04 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Conten
t-Type: text/html..







The Trojan connects to the servers at the folowing location(s):







iexplore.exe_1932:




%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    FreeRideGames.e:608
    GPlayer.exe:252
    GPlayer.exe:1132
    GPlayer.exe:1956
    %original file name%.exe:860
    Regsvr32.exe:1752
    RegEdit.exe:936
    RegEdit.exe:1584
    setup.exe:908
    Free Ride Games.exe:1756
    

    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (11297 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (515 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (4508 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (15278 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (6224 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (14367 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (541 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (42648 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (256 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (157015 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (1941 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (5 bytes)
    %Program Files%\FreeRide Games\Info\4.clg (1093 bytes)
    %Program Files%\FreeRide Games\Info\3.clg (15349 bytes)
    %Program Files%\FreeRide Games\Info\6.clg (1093 bytes)
    %Program Files%\FreeRide Games\Info\5.clg (15349 bytes)
    %Program Files%\FreeRide Games\Info\1.clg (15349 bytes)
    %Program Files%\FreeRide Games\Info\2.clg (1093 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\Free Ride Games.exe (1775 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (6389 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\cmhelper.exe (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\resourceDll.dll (161 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\ExentCtlInstaller.dll (98 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\setu20fe.rra (14400 bytes)
    %Documents and Settings%\All Users\Desktop\FreeRide Games.lnk (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgToa3a.rra (1 bytes)
    %Program Files%\FreeRide Games\repo2b8.rra (364 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8b3.rra (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defafc30.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\cliec5d.rra (509 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13b0.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\mask\updae80.rra (96 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd519.rra (15 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_865.rra (10 bytes)
    %Program Files%\FreeRide Games\Skin\NIBmps\NetI410.rra (1890 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12a6.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\canc5c5.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4fa.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115e.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd43f.rra (4 bytes)
    %Program Files%\FreeRide Games\cmhe2a8.rra (4456 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game140d.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1093.rra (2 bytes)
    %Program Files%\FreeRide Games\Game25a.rra (65287 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd28.rra (966 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1333.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data567.rra (31 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14aa.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb53.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e117d.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\defa41f.rra (2 bytes)
    %Program Files%\FreeRide Games\Data\vers316.rra (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbe2.rra (3404 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\fb55.rra (7560 bytes)
    %Program Files%\FreeRide Games\GPlr23b.rra (32516 bytes)
    %Program Files%\FreeRide Games\npGa14e8.rra (13264 bytes)
    %Program Files%\FreeRide Games\Skin\Langs\0409\EXEt6ee.rra (843 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaac6.rra (14 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd529.rra (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (323 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\auto96f.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\myGac2e.rra (22 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main144c.rra (18 bytes)
    %Program Files%\FreeRide Games\Skin\html\OffLad6.rra (9 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm827.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos77b.rra (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrtfc20.rra (8434 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc1e.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_17f8.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\nobu661.rra (2 bytes)
    %System%\d3dx335.rra (32512 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14b9.rra (1 bytes)
    %Program Files%\FreeRide Games\Repo299.rra (31560 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\data1f29.rra (1568 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\logi9ad.rra (2 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\data1f58.rra (156954 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\debu3e1.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_76b.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\pinb690.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7b9.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logoa78.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13bf.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1362.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb25.rra (17 bytes)
    %Program Files%\FreeRide Games\glut1ce.rra (4314 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\yesb6de.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1313.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Exitaf5.rra (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlafbe2.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaaa7.rra (4314 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dial97e.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1006.rra (2 bytes)
    %Program Files%\FreeRide Games\Win815f2.rra (2334 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (21 bytes)
    %Program Files%\FreeRide Games\wh_P2d7.rra (4456 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos78a.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topRa88.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8c3.rra (19 bytes)
    %Program Files%\FreeRide Games\Skin\mask\errod76.rra (144 bytes)
    %Program Files%\FreeRide Games\Skin\icon\faviaf5.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd18.rra (966 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs147b.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascba.rra (16 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d112f.rra (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbb3.rra (6040 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info1304.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\erorbef.rra (8 bytes)
    %Program Files%\FreeRide Games\Data\Loca335.rra (14 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ea.rra (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbf2.rra (2104 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help7aa.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bannf3b.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos120a.rra (376 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\Chec5a6.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\mg42f.rra (7 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\signd37.rra (4 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\ISSe20ee.rra (10504 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe17f.rra (10504 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\clos613.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascca.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\mask\playdd4.rra (144 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7e8.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\preRd37.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load1258.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dropc6c.rra (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbc3.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\og_id09.rra (625 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (1164 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada59.rra (2334 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo151.rra (515 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data160.rra (15968 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\yesb6cf.rra (2 bytes)
    %Program Files%\FreeRide Games\frg-2e7.rra (4456 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto558.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_2807.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a111f.rra (5 bytes)
    %Program Files%\FreeRide Games\exs.ini (1638 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\licefbc3.rra (9 bytes)
    %Program Files%\FreeRide Games\AX322b8.rra (3404 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1239.rra (247 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd47d.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\skin9dc.rra (11 bytes)
    %Program Files%\FreeRide Games\Skin\dat\GPlr9ec.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd50a.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan13cf.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord1287.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\playd18.rra (729 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load142d.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l11bc.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd49c.rra (12 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_a98.rra (10 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13a0.rra (10 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Servb92.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_940.rra (13 bytes)
    %Program Files%\FreeRide Games\ExentComponents.ini (1073 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12b6.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\dat\Loca325.rra (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Strifc20.rra (2 bytes)
    %Program Files%\FreeRide Games\FRGN383.rra (17 bytes)
    %WinDir%\Downloaded Program Files\Exen354.rra (32172 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\setu213c.rra (4412 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Fontfc01.rra (39 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1277.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\inde3a2.rra (34 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\framcda.rra (14 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm817.rra (1 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\setu215c.rra (1568 bytes)
    %Program Files%\FreeRide Games\Skin\Skin3a2.rra (352 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\0x041e7d.rra (21 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLea2a.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim539.rra (13 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC1381.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\upda6bf.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\upda6cf.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR14aa.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBoa1b.rra (1 bytes)
    %Program Files%\FreeRide Games\Data\Loca325.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\Langs\0409\Erro6fe.rra (10 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\logicf9.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR149a.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\GameInfoDefault\md3f0.rra (383 bytes)
    %Program Files%\FreeRide Games\Skin\html\OffLae6.rra (387 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exsfbd2.rra (12834 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ1352.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_930.rra (12 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1612 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13bf.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4db.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\icon\GPlrb63.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m11cb.rra (18 bytes)
    %Program Files%\FreeRide Games\Skin\mask\logid76.rra (96 bytes)
    %Program Files%\FreeRide Games\lice2e7.rra (9 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\switd57.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho587.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb43.rra (34 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_a3b2.rra (3404 bytes)
    %Program Files%\FreeRide Games\Skin\Langs\0409\Stri6fe.rra (11940 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_m3c2.rra (24 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm836.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10c2.rra (1 bytes)
    %Program Files%\FreeRide Games\exs316.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\NIBmps\NetI400.rra (1890 bytes)
    %Program Files%\FreeRide Games\Skin\icon\GPlab63.rra (17 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\setu212d.rra (256 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\dl41f.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd48d.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\icon\MyGab82.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun1248.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb16.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_884.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\errocab.rra (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGafbf2.rra (9 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10d1.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_94f.rra (4 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\layo20fe.rra (515 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec14d9.rra (807 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada69.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\mg_i9bd.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topLa88.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load141d.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa95f.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\dat\Loca335.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7c9.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\Mostbc0.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\sett9cc.rra (6 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x0418f.rra (21 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\canc5e4.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear146b.rra (13 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o11db.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_875.rra (32 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\fram99e.rra (5 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g119c.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\Sett393.rra (1 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu19f.rra (6041 bytes)
    %Program Files%\FreeRide Games\Skin\icon\IAFb72.rra (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corefc11.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dl_i98e.rra (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regifbc3.rra (29 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\jquece9.rra (3404 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb15.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i11ac.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_d3c2.rra (15 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott13df.rra (35 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\back5b6.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\clos623.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\upda6b0.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto548.rra (32 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Settb92.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\pinb671.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\yesnd66.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Connad6.rra (296 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro98e.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi10f1.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd46d.rra (3 bytes)
    %Program Files%\FreeRide Games\Clie393.rra (262 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_1807.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\pinb661.rra (2 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\data1eac.rra (14400 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb34.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\mg_id09.rra (20 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\exs20df.rra (7168 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd45e.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\pbc2e.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi1248.rra (262 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Tray383.rra (17 bytes)
    %Program Files%\FreeRide Games\GPla1ce.rra (154846 bytes)
    %Program Files%\FreeRide Games\X4HS1be.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_70d.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc0f.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc72d.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_75b.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\MyGabd0.rra (4298 bytes)
    %Program Files%\FreeRide Games\report.ini (86 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\play1110.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\splad47.rra (6 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\clos633.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1268.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ac.rra (12 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e114e.rra (4 bytes)
    %Program Files%\FreeRide Games\exs2f6.rra (12834 bytes)
    %Program Files%\FreeRide Games\X4Ex1ae.rra (16732 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi1100.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g118d.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12c5.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear147b.rra (10 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (807 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\Chec596.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\mask\logid86.rra (48 bytes)
    %Documents and Settings%\All Users\Application Data\FreeRide Games\setu211d.rra (6041 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1371.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\icon\MyDob82.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\attaa0b.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8d2.rra (11 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12d5.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc72d.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Chanaf5.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_855.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc71d.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\spla9dc.rra (2 bytes)
    %Documents and Settings%\All Users\Desktop\Play My Games.lnk (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialbe0.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7d8.rra (3 bytes)
    %Program Files%\FreeRide Games\3rdP2e7.rra (26 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_c3b2.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_846.rra (27 bytes)
    %Program Files%\FreeRide Games\AppL2c8.rra (32102 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\tracd57.rra (7 bytes)
    %Program Files%\FreeRide Games\Play My Games.lnk (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u11fa.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_p3d1.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\GATrbc0.rra (2326 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4cb.rra (10 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\canc5f4.rra (2 bytes)
    %Program Files%\FreeRide Games\FreeRide Games.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10b2.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help79a.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\skip6b0.rra (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxfc01.rra (86 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s11eb.rra (12 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\og_i9bd.rra (1 bytes)
    %Program Files%\FreeRide Games\exs306.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_74c.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb05.rra (34 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa96f.rra (2 bytes)
    %Program Files%\FreeRide Games\Game289.rra (8760 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dl_ic5d.rra (32 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\pinb681.rra (2 bytes)
    %Program Files%\FreeRide Games\npEx373.rra (8760 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12f4.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g11ac.rra (9 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_95f.rra (19 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\botta49.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info12f4.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_07e8.rra (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnfc11.rra (11 bytes)
    %Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu170.rra (14400 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\erroc9b.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1219.rra (483 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14c9.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\nobu642.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\yesn9ec.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Helpb72.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\AC_Rc4d.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1323.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRia2a.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13fe.rra (181 bytes)
    %Program Files%\FreeRide Games\myGa393.rra (2334 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\skip690.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115f.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10e1.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_911.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\icon\Onlib82.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\GameInfoDefault\Game3f0.rra (12 bytes)
    %Program Files%\FreeRide Games\Skin\icon\FRGLb24.rra (17 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12e5.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd44e.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\dat\Loca326.rra (7 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaab7.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\key_cf9.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flasa59.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro99e.rra (1 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_901.rra (15 bytes)
    %Program Files%\FreeRide Games\Skin\GameInfoDefault\Spla3f0.rra (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exsfd97.rra (7168 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\logi3e1.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8f2.rra (19 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\skip6a0.rra (3 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\nobu652.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8e2.rra (22 bytes)
    %Program Files%\FreeRide Games\DoDl306.rra (4456 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc73c.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pids42f.rra (58 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8a4.rra (4 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retra78.rra (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isrfc30.rra (18974 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e113f.rra (5 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\iconbef.rra (8 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo143c.rra (14 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_921.rra (13 bytes)
    %Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\spacc3d.rra (49 bytes)
    %Program Files%\FreeRide Games\Skin\Popups\1\canc5d5.rra (2 bytes)
    %Program Files%\FreeRide Games\Skin\Langs\0409\Erro6ee.rra (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\header[1].jpg (4881 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\defines[1].js (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (18524 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].html (1208 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[1].css (732 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\beacon[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_PROGRESS[1].htm (2073 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Exent\GI20140801150510GMT.Log (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (1286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDMLog.log (2605139 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[3].css (732 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion3[1].gif (24079 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (223946 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDM_DB_148.xml (560 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_HEADER2[1].css (471 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion4[1].jpg (23149 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\13[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\header[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (347 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\conversionTracking[1].htm (95 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion2[1].jpg (23210 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\defines[1].js (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion1[1].jpg (19117 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\boxshot_sm[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (366 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_uninsdm.bat (175 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Exent_SDM" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '595450'"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now