Trojan.Win32.IEDummy_ac26c80826

by malwarelabrobot on April 30th, 2014 in Malware Descriptions.

Backdoor.Generic.336764 (BitDefender), Trojan:Win32/Sisron (Microsoft), Trojan.Win32.Pasta.kod (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.Click1.39914 (DrWeb), Trojan.Win32.Pasta!IK (Emsisoft), probably a variant of Win32/Agent.CZNDTTH (NOD32), Generic.dx!vzs (McAfee), Trojan.Gen (Symantec), Trojan.Win32.Pasta (Ikarus), Backdoor.Generic.336764 (FSecure), SHeur3.YHJ (AVG), Win32:Malware-gen (Avast), TROJ_GEN.R3BE1GJ (TrendMicro), Backdoor.Generic.336764 (AdAware), Trojan.Win32.IEDummy.FD, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Worm, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: ac26c80826819dfd18f18ab68c626b3e
SHA1: 3a374497b0eb5b8f28b220fbc2dd0f6896ad3943
SHA256: 8eb169cc0bfa79a2b09d4e476b4ea89699da6120958cc415eb01d7a86799125c
SSDeep: 12288:zYaLttgDdcVly1UbeN/69D4xjEYKzo7fOOEbZgeDQ:c8tgDKVEKxR4jqofOtZgY
Size: 628736 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASProtectv123RC1, ASProtect13321Registered, UPolyXv05_v6, ASProtectv12xNewStrain
Company: no certificate found
Created at: 2004-03-04 15:54:42
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

wuauclt.exe:1876

The Trojan injects its code into the following process(es):

iexplore.exe:516
%original file name%.exe:1076

File activity

The process wuauclt.exe:1876 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Trojan deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process iexplore.exe:516 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hackbase[1].htm (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vipbanji[1].gif (2467 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20080602030123852[1].gif (8121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vip444[1].gif (5860 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip222[1].gif (7284 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hackbase[1].txt (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index[1].css (3116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (2485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bjjubao[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\topbanner[1].htm (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\api[2].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20140318015153597[1].jpg (2890 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140423091537911[1].jpg (9173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bbsvip2[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vip333[1].gif (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20080602030236487[1].gif (5309 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hd315[1].gif (541 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c92a22fae515eb6aac02112ae7b01585a15de84b[1].swf (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\off[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\flashclick[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[1].js (3123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip222[2].gif (1952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\vip111[1].gif (3806 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1fd62ab0397e4cc2d3af35700a98982c[1].swf (2793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\0f1fcc8116f02f3798b2c29eafec71cd[1].swf (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c92a22fae515eb6aac02112ae7b01585a15de84b[1].swf (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140424102228681[1].jpg (7439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vip111[1].gif (3097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\config[1].js (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\baoming2[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Std_StranJF[1].Js (1975 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c6c15df4b23dc29d42af976e735ef9d2[1].swf (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (59265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\point[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\api[1].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jian[1].gif (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20131126102515224[1].jpg (9601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[2].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\netchina[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140310102126290[1].jpg (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\baoming1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\focus[1].swf (3065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\css[1].css (6234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\prototype[1].js (22263 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.hackbase[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140310094959731[1].jpg (4916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\search[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\menu_bg[1].jpg (4257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jian1[1].gif (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\topbanner[1].swf (772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[3].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\api[1].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vip333[1].gif (1115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\net110[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\time[1].js (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip333[1].gif (7097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[1].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bcv1[1].swf (18462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20131126105258238[1].jpg (6413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140331042935872[1].jpg (103840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3dboard[1].swf (772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140310103055867[1].jpg (14799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\body_bg[1].jpg (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140310102756390[1].jpg (19486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yewu[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\menu[1].js (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\titlebg[1].jpg (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\api[1].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip444[1].gif (1680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\chaxun[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20131126084733851[1].jpg (14057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20080602022912816[1].gif (5245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\search_bg[1].gif (71 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20131126115121831[1].jpg (22141 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip111[1].gif (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3975a6d5f4815aa87e6a87b6c5fcfecc9946843d[1].swf (1466 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140331044409662[1].jpg (8223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ac4f3526441feb390f07012b7867f7a7cc4f8fd6[1].swf (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\api[3].htm (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20131126115042105[1].jpg (29109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140428022323350[1].jpg (3309 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\union[1].gif (1725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a68216ea44e13fd1c5c948384e7bb1b74279bfe5[1].swf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].gif (768 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vip333[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vip444[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip222[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vip333[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip111[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip222[2].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c92a22fae515eb6aac02112ae7b01585a15de84b[1].swf (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip333[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip444[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\vip111[1].gif (0 bytes)

The process %original file name%.exe:1076 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\QQAV2004.lnk (545 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\msg.lib (2 bytes)
%Documents and Settings%\%current user%\Desktop\QQAV2004.lnk (545 bytes)
%WinDir%\qqav.ico (10 bytes)
C:\site.lib (886 bytes)
C:\qqav.ini (151 bytes)

Registry activity

The process iexplore.exe:516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Type" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"NOTEPAD.EXE" = "Notepad"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014042920140430]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014042920140430\"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Type" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "iexplore.exe"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014042920140430]
"CacheOptions" = "11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Count" = "12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"NodeSlots" = "02 02 02 02 02 02 02 02 02 02 02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
"(Default)" = "Java Plug-in 1.3.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Time" = "DE 07 04 00 02 00 1D 00 03 00 16 00 06 00 45 03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
"(Default)" = "{5852F5ED-8BF4-11D4-A245-0080C6F74284}"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Type" = "4"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Count" = "12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Count" = "9"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_02"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Window_Placement" = "2C 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Type" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"MRUListEx" = "01 00 00 00 00 00 00 00 03 00 00 00 02 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Count" = "13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Time" = "DE 07 04 00 02 00 1D 00 03 00 16 00 07 00 03 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Count" = "16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Time" = "DE 07 04 00 02 00 1D 00 03 00 16 00 07 00 F3 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1208111653"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_03"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Count" = "13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\Toolbar]
"Locked" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_17"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014042920140430]
"CachePrefix" = ":2014042920140430:"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014042920140430]
"CacheRepair" = "0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Time" = "DE 07 04 00 02 00 1D 00 03 00 16 00 06 00 64 03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_23"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014042920140430]
"CacheLimit" = "8192"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Time" = "DE 07 04 00 02 00 1D 00 03 00 16 00 07 00 12 01"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 64 89 F8 06 A3 5F E7 8C FE 39 D7 DA 2D B5 4F"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links]
"Order" = "08 00 00 00 02 00 00 00 00 02 00 00 01 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_08"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Time" = "DE 07 04 00 02 00 1D 00 03 00 16 00 12 00 86 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_09"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\JavaPlugin.160_18]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1076 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\txtfile\shell\open\command]
"(Default)" = "notepad %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\comfile\shell\open\command]
"(Default)" = "%1 %*"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\exefile\shell\open\command]
"(Default)" = "%1 %*"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\piffile\shell\open\command]
"(Default)" = "%1 %*"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 61 E9 6D 25 87 C6 C0 99 55 5F 2C 76 D0 A3 87"

[HKCR\batfile\shell\open\command]
"(Default)" = "%1 %*"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.hackbase.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "Explorer.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"qqav" = "c:\%original file name%.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
4096 880640 323072 5.5448 fa05cb0168d01010d74283b815719c6e
884736 94208 20480 5.53688 01b8c4dab68473cd53f7e838dccccc4a
978944 4096 512 0 bf619eac0cdf3f68d496ea9344137e8b
983040 4096 512 0.132037 62e738e6b99b193f31e2378e56af6bb8
987136 16384 1024 5.07261 82b3800eb9e74b3d72d33dabe61a7575
1003520 86016 82432 3.99999 e551254ca0e844fa11b62db324cfe119
.rsrc 1089536 499712 121344 5.07217 66700ddfec2a000ff3624e730fbed55a
1589248 61440 0 0 d41d8cd98f00b204e9800998ecf8427e
.data 1650688 77824 77824 5.2528 8ea7ec6e0e59df3cd7768c6fda9fef5d
.adata 1728512 4096 0 0 d41d8cd98f00b204e9800998ecf8427e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.hackbase.com/ 218.28.219.241
hxxp://www.hackbase.com/qqav/news.htm 218.28.219.241
hxxp://www.hackbase.com/index.html 218.28.219.241
hxxp://www.hackbase.com/style/css.css 218.28.219.241
hxxp://www.hackbase.com/style/index.css 218.28.219.241
hxxp://www.hackbase.com/data/js/config.js 218.28.219.241
hxxp://www.hackbase.com/include/js/common.js 218.28.219.241
hxxp://www.hackbase.com/include/js/prototype.js 218.28.219.241
hxxp://www.hackbase.com/include/js/time.js 218.28.219.241
hxxp://www.hackbase.com/style/images/body_bg.jpg 218.28.219.241
hxxp://www.hackbase.com/vip/topbanner.html 218.28.219.241
hxxp://www.hackbase.com/style/images/logo.gif 218.28.219.241
hxxp://www.hackbase.com/style/menu.js 218.28.219.241
hxxp://www.hackbase.com/vip/topbanner.swf 218.28.219.241
hxxp://www.hackbase.com/style/images/menu_bg.jpg 218.28.219.241
hxxp://www.hackbase.com/images/focus.swf 218.28.219.241
hxxp://www.hackbase.com/style/images/search_bg.gif 218.28.219.241
hxxp://www.hackbase.com/style/images/search.gif 218.28.219.241
hxxp://taurus.danuoyi.tbcache.com/bcv1.swf
hxxp://www.hackbase.com/uploadfile/200806/20080602030236487.gif 218.28.219.241
hxxp://taurus.danuoyi.tbcache.com/materials/original/2008-12-06/ac4f3526441feb390f07012b7867f7a7cc4f8fd6.swf
hxxp://taurus.danuoyi.tbcache.com/materials/original/2009-07-01/c92a22fae515eb6aac02112ae7b01585a15de84b.swf
hxxp://www.hackbase.com/uploadfile/200806/20080602030123852.gif 218.28.219.241
hxxp://taurus.danuoyi.tbcache.com/swf/2010-07-23/10-05/0f1fcc8116f02f3798b2c29eafec71cd.swf
hxxp://taurus.danuoyi.tbcache.com/materials/original/2009-06-28/a68216ea44e13fd1c5c948384e7bb1b74279bfe5.swf
hxxp://taurus.danuoyi.tbcache.com/swf/2010-07-23/10-10/c6c15df4b23dc29d42af976e735ef9d2.swf
hxxp://taurus.danuoyi.tbcache.com/swf/2010-07-23/10-52/1fd62ab0397e4cc2d3af35700a98982c.swf
hxxp://taurus.danuoyi.tbcache.com/materials/original/2009-06-28/3975a6d5f4815aa87e6a87b6c5fcfecc9946843d.swf
hxxp://www.hackbase.com/uploadfile/200806/20080602022912816.gif 218.28.219.241
hxxp://www.hackbase.com/images/flashclick.gif 218.28.219.241
hxxp://www.hackbase.com/vip/swfobject.js 218.28.219.241
hxxp://www.hackbase.com/images/titlebg.jpg 218.28.219.241
hxxp://www.hackbase.com/vip/3dboard.swf 218.28.219.241
hxxp://www.hackbase.com/vip/chaxun.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201311/20131126105258238.jpeg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/201311/20131126084733851.jpg 218.28.219.241
hxxp://bbs.hackbase.com/api.php?mod=js&bid=68 218.28.219.242
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201311/20131126115042105.jpg 218.28.219.241
hxxp://bbs.hackbase.com/api.php?mod=js&bid=69 218.28.219.242
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201311/20131126102515224.jpg 218.28.219.241
hxxp://bbs.hackbase.com/api.php?mod=js&bid=70 218.28.219.242
hxxp://bbs.hackbase.com/api.php?mod=js&bid=71 218.28.219.242
hxxp://bbs.hackbase.com/api.php?mod=js&bid=72 218.28.219.242
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201311/20131126115121831.jpg 218.28.219.241
hxxp://www.hackbase.com/2010/vip111.gif 218.28.219.241
hxxp://bbs.hackbase.com/api.php?mod=js&bid=73 218.28.219.242
hxxp://bbs.hackbase.com/api.php?mod=js&bid=74 218.28.219.242
hxxp://www.hackbase.com/2010/vip222.gif 218.28.219.241
hxxp://bbs.hackbase.com/api.php?mod=js&bid=75 218.28.219.242
hxxp://www.hackbase.com/2010/vip333.gif 218.28.219.241
hxxp://hm.e.shifen.com/h.js?aa34293d67c95b9ea9e7201a9150b74a
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=633043539&si=aa34293d67c95b9ea9e7201a9150b74a&st=1&v=1.0.57&lv=1&tt=黑基网 - 中国领先的IT安全技术门户 软件•人才•社区 [9:43]
hxxp://www.hackbase.com/2010/vip444.gif 218.28.219.241
hxxp://www.hackbase.com/vip/vipbanji.gif 218.28.219.241
hxxp://www.hackbase.com/vip/off.gif 218.28.219.241
hxxp://www.hackbase.com/vip/baoming1.gif 218.28.219.241
hxxp://www.hackbase.com/vip/baoming2.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201404/20140424102228681.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201404/20140423091537911.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201403/20140331044409662.jpg 218.28.219.241
hxxp://www.hackbase.com/images/jian.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201403/20140331042935872.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/news/uploadfile/201403/20140310094959731.jpg 218.28.219.241
hxxp://www.hackbase.com/images/top.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/picture/uploadfile/201404/20140428022323350.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/picture/uploadfile/201403/20140318015153597.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/picture/uploadfile/201403/20140310103055867.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/picture/uploadfile/201403/20140310102756390.jpg 218.28.219.241
hxxp://www.hackbase.com/uploadfile/picture/uploadfile/201403/20140310102126290.jpg 218.28.219.241
hxxp://www.hackbase.com/images/jian1.gif 218.28.219.241
hxxp://www.hackbase.com/style/images/point.gif 218.28.219.241
hxxp://www.hackbase.com/vip/bbsvip2.gif 218.28.219.241
hxxp://www.hackbase.com/images/union.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/icp/hd315.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/icp/netchina.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/icp/bjjubao.gif 218.28.219.241
hxxp://www.hackbase.com/uploadfile/icp/net110.gif 218.28.219.241
hxxp://www.hackbase.com/images/yewu.gif 218.28.219.241
hxxp://www.hackbase.com/include/js/Std_StranJF.Js 218.28.219.241
hxxp://img.uu1001.cn/bcv1.swf 195.27.31.240
hxxp://hm.baidu.com/h.js?aa34293d67c95b9ea9e7201a9150b74a 61.135.185.140
hxxp://img.uu1001.cn/swf/2010-07-23/10-52/1fd62ab0397e4cc2d3af35700a98982c.swf 195.27.31.240
hxxp://img.uu1001.cn/swf/2010-07-23/10-10/c6c15df4b23dc29d42af976e735ef9d2.swf 195.27.31.240
hxxp://img.uu1001.cn/swf/2010-07-23/10-05/0f1fcc8116f02f3798b2c29eafec71cd.swf 195.27.31.240
hxxp://img.uu1001.cn/materials/original/2009-07-01/c92a22fae515eb6aac02112ae7b01585a15de84b.swf 195.27.31.240
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=633043539&si=aa34293d67c95b9ea9e7201a9150b74a&st=1&v=1.0.57&lv=1&tt=黑基网 - 中国领先的IT安全技术门户 软件•人才•社区 [9:43] 61.135.185.140
hxxp://img.uu1001.cn/materials/original/2009-06-28/a68216ea44e13fd1c5c948384e7bb1b74279bfe5.swf 195.27.31.240
hxxp://img.uu1001.cn/materials/original/2009-06-28/3975a6d5f4815aa87e6a87b6c5fcfecc9946843d.swf 195.27.31.240
hxxp://img.uu1001.cn/materials/original/2008-12-06/ac4f3526441feb390f07012b7867f7a7cc4f8fd6.swf 195.27.31.240
log.mm.vip.cnz.alimama.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /api.php?mod=js&bid=74 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:26 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=74";</script>........
....H................



GET /api.php?mod=js&bid=73 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:25 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=73";</script>........
........6.......y{...



GET /style/css.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:10 GMT
Content-Length: 9553
Content-Type: text/css
Last-Modified: Sat, 25 Sep 2010 16:49:51 GMT
Accept-Ranges: bytes
ETag: "7aa9eeabd15ccb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
img  {border: 0px;}..html { min-width: 776px; } ..*{margin:0;padding:0
;font-size:12px;font-family:Arial,Helvetica,"....";}..body{padding:0px
;font-size:12px;background:url(images/body_bg.jpg) #deebf3 repeat-x;ma
rgin:0px;line-height:180%;font-family:Arial,Helvetica,"....",sans-seri
f;text-align:center;color:#666;}..div,form,img,ul,ol,li,dl,dt,dd{margi
n:0;padding:0;border:0;text-align:left;}..h1,h2,h3,h4,h5,h6 {color:#66
6; margin:0;padding:0;font-weight:bold;margin-right:auto;margin-left:a
uto;}..table,td,tr,th{font-size:12px;background:#ffffff;}..li{list-sty
le-type:none;background:#ffffff;}...clear {clear:both;}../* ........ *
/..a {color: #444444;text-decoration:none;}..a:hover {color:red;}..a.r
ed:link,a.red:visited,a.red:hover,a.red:active{color:#fe6600;}..a.red:
hover{text-decoration:underline;}..a.white:link,a.white:visited,a.whit
e:hover,a.white:active{color:#444444;}..a.white:hover{text-decoration:
underline;}..a.black:link,a.black:visited,a.black:hover,a.black:active
{color:#ffffff;}..a.black:hover{text-decoration:underline;}..a.blue:li
nk,a.blue:visited,a.blue:hover,a.blue:active{color:#444444;}..a.blue:h
over{text-decoration:underline;}../*........*/...fb{font-weight:bold;}
...fi{font-style:italic;}...fn,.fn a{font-weight:normal;}...f10{font-s
ize:10px;}...f12{font-size:12px;}...f14{font-size:14px;}...f14 a{font-
size:14px;text-decoration:none;}...f14 a:hover{font-size:14px;color:#6
66;text-decoration:underline;}...f14 a:visited{color:#666;}...f16 {fon
t-size:16px;}...black{color:#666;}...red {color:#fe6600;}...blue{c
<<< skipped >>>

GET /style/index.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:12 GMT
Content-Length: 5451
Content-Type: text/css
Last-Modified: Sun, 26 Sep 2010 13:19:44 GMT
Accept-Ranges: bytes
ETag: "e0c8467c7d5dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
.fodinfo .dis .pic {background:#ffffff;color:#666;width:100px;height:9
5px;margin:5px;font-family:'........';text-align:left;overflow:hidden;
}...fodinfo .dis .pic img {background:#ffffff;color:#666;width:92px;he
ight:65px;padding:3px;border:1px solid #ccc;}...announce_list {backgro
und:#ffffff;color:#666;}...movie_more {padding-left:15px;background:ur
l(images/more_red.gif) no-repeat;}...tab {background:#ffffff;color:#66
6;float:left;width:357px;height:230px;overflow:hidden;border:1px solid
 #ccc;margin:5px 5px 5px 0px;}...tab2 {background:#ffffff;color:#666;f
loat:left;width:357px;height:230px;overflow:hidden;border:1px solid #c
cc;margin:5px 0px 5px 5px;}...tabbbs {float:left;width:725px;height:23
0px;overflow:hidden;border:1px solid #ccc;margin:5px 5px 5px 0px;}...t
abpic {background:#ffffff;color:#666;float:left;width:725px;height:171
px;overflow:hidden;border:1px solid #ccc;margin:1px 1px 1px 0px;}...ta
bnews {float:left;width:286px;overflow:hidden;border:1px solid #ccc;ma
rgin:2px 5px 1px 0px;}...tab li,.tab2 li {width:235px;height:20px;line
-height:20px;overflow:hidden;}...tab .pic,.tab2 .pic  {background:#fff
fff;color:#666;width:100px;height:95px;margin:5px;font-family:'.......
.';text-align:center;overflow:hidden;}...tab .pic img,.tab2 .pic img {
background:#ffffff;color:#666;width:92px;height:65px;padding:3px;borde
r:1px solid #ccc;}..../* TAB2 */...fod {width:456px;height:22px;line-h
eight:22px;margin:0 0 5px 0;}...fod li {float:left;width:47px;cursor:p
ointer;font-size:12px;background:#efefef;color:#666;text-align:cen
<<< skipped >>>

GET /data/js/config.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:12 GMT
Content-Length: 49
Content-Type: application/x-javascript
Last-Modified: Fri, 21 Dec 2007 04:42:44 GMT
Accept-Ranges: bytes
ETag: "07a40ed8b43c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
var phpcms_path = '/';.var cookiepre = 'phpcms_';....


GET /include/js/common.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:13 GMT
Content-Length: 7405
Content-Type: application/x-javascript
Last-Modified: Wed, 09 Jan 2008 05:33:40 GMT
Accept-Ranges: bytes
ETag: "0529e308152c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
function openwinx(url,name,w,h)..{ ..    window.open(url,name,"top=100
,left=400,width="   w   ",height="   h   ",toolbar=no,menubar=no,scrol
lbars=yes,resizable=no,location=no,status=no")..}..function Dialog(url
,name,w,h)..{...return showModalDialog(url, name, 'dialogWidth:' w 'px
; dialogHeight:' h 'px; help: no; scroll: yes; status: no');..}..funct
ion setidval(id,value)..{ ..    document.getElementById(id).innerHTML 
= value;..}..function getidval(id)..{ ..    return document.getElement
ById(id).innerHTML;..}..function checkall(form)..{...for(var i = 0;i &
lt; form.elements.length; i  ) ...{....var e = form.elements[i];....if
(e.name != 'chkall' && e.disabled != true) e.checked = form.chkall.che
cked;...}..}..function redirect(url)..{...window.location.replace(url)
;..}..function confirmurl(url,message)..{...if(confirm(message)) locat
ion.href = url;..}..function confirmform(form,message)..{...if(confirm
(message)) form.submit();..}..function setcookie(name, value)..{..    
name = cookiepre name;..    var argc = setcookie.arguments.length; ...
var argv = setcookie.arguments; ...var path = (argc > 3) ? argv[3] 
: null; ...var domain = (argc > 4) ? argv[4] : null; ...var secure 
= (argc > 5) ? argv[5] : false; ...document.cookie = name   "="   v
alue   ((path == null) ? "" : ("; path="   path))   ((domain == null) 
? "" : ("; domain="   domain))   ((secure == true) ? "; secure" : "");
 ..} ..function deletecookie(name)..{..    var exp = new Date(); ...ex
p.setTime (exp.getTime() - 1); ...var cval = getcookie(name);..   
<<< skipped >>>

GET /include/js/prototype.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:13 GMT
Content-Length: 45073
Content-Type: application/x-javascript
Last-Modified: Fri, 21 Dec 2007 04:11:08 GMT
Accept-Ranges: bytes
ETag: "0d625838743c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
/*  Prototype JavaScript framework, version 1.4.0. *  (c) 2005 Sam Ste
phenson <[email protected]>. *  Prototype is freely distributable un
der the terms of an MIT-style license.. *  For details, see the Protot
ype web site: hXXp://prototype.conio.net/. */..var Prototype = {.  Ver
sion: '1.4.0',.  ScriptFragment: '(?:<script.*?>)((\n|\r|.)*?)(?
:<\/script>)',..  emptyFunction: function() {},.  K: function(x)
 {return x}.}..var Class = {.  create: function() {.    return functio
n() {.      this.initialize.apply(this, arguments);.    }.  }.}..var A
bstract = new Object();..Object.extend = function(destination, source)
 {.  for (property in source) {.    destination[property] = source[pro
perty];.  }.  return destination;.}..Object.inspect = function(object)
 {.  try {.    if (object == undefined) return 'undefined';.    if (ob
ject == null) return 'null';.    return object.inspect ? object.inspec
t() : object.toString();.  } catch (e) {.    if (e instanceof RangeErr
or) return '...';.    throw e;.  }.}..Function.prototype.bind = functi
on() {.  var __method = this, args = $A(arguments), object = args.shif
t();.  return function() {.    return __method.apply(object, args.conc
at($A(arguments)));.  }.}..Function.prototype.bindAsEventListener = fu
nction(object) {.  var __method = this;.  return function(event) {.   
 return __method.call(object, event || window.event);.  }.}..Object.ex
tend(Number.prototype, {.  toColorPart: function() {.    var digits = 
this.toString(16);.    if (this < 16) return '0'   digits;.    
<<< skipped >>>

GET /include/js/time.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:16 GMT
Content-Length: 673
Content-Type: application/x-javascript
Last-Modified: Fri, 21 Dec 2007 04:11:10 GMT
Accept-Ranges: bytes
ETag: "0357848743c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
var day="";...var month="";...var ampm="";...var ampmhour="";...var my
weekday="";...var year="";...mydate=new Date();...myweekday=mydate.get
Day();...mymonth=mydate.getMonth() 1;...myday= mydate.getDate();...myy
ear= mydate.getYear();...year=(myyear > 200) ? myyear : 1900   myye
ar;...if(myweekday == 0)...weekday=" ...... ";...else if(myweekday == 
1)...weekday=" ...... ";...else if(myweekday == 2)...weekday=" ...... 
";...else if(myweekday == 3)...weekday=" ...... ";...else if(myweekday
 == 4)...weekday=" ...... ";...else if(myweekday == 5)...weekday=" ...
... ";...else if(myweekday == 6)...weekday=" ...... ";...document.writ
e(year ".." mymonth ".." myday ".. " weekday);....


GET /style/images/body_bg.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:16 GMT
Content-Length: 526
Content-Type: image/jpeg
Last-Modified: Sun, 27 Jun 2010 09:38:23 GMT
Accept-Ranges: bytes
ETag: "364d827cdc15cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
.......................................................?..............
.^...............................................................a....
Q!1Aq...............................?..%.\..?....g..).3....'...1RC/. H
...)y.D..a,[email protected]&F.K.ET..M...\`*......I........J.
q.......u..f.r)7^..f.......$.|..l$.5.5E....ET2.%G ..J.0)[email protected][email protected]
.. V^|.)~."p.n.W.}......................


GET /vip/topbanner.html HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:17 GMT
Content-Length: 815
Content-Type: text/html
Last-Modified: Mon, 30 Aug 2010 12:07:05 GMT
Accept-Ranges: bytes
ETag: "8ea189dc3b48cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
<div style="z-index:-1">..<object classid="clsid:D27CDB6E-AE6
D-11cf-96B8-444553540000" codebase="hXXp://download.macromedia.com/pub
/shockwave/cabs/flash/swflash.cab#version=7,0,19,0" width="710" height
="67" title="................">..  <param name="movie" value="/v
ip/topbanner.swf" />..  <param name="quality" value="high" />
..  <param name="wmode" value="transparent"/> ..  <embed src=
"/vip/topbanner.swf" quality="high" pluginspage="hXXp://VVV.macromedia
.com/go/getflashplayer" type="application/x-shockwave-flash" width="71
0" height="67"></embed>..</object>..</div>..<d
iv id="masker" style="cursor: hand; margin-top:-67px; width:710px; hei
ght:67px; z-index:1; visibility: visible;"><a href="hXXp://vip.h
ackbase.com" target=_blank><img src="/images/flashclick.gif" wid
th="710" height="67" border="0" /></a></div>....


GET /style/images/logo.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:17 GMT
Content-Length: 4983
Content-Type: image/gif
Last-Modified: Fri, 05 Feb 2010 07:51:52 GMT
Accept-Ranges: bytes
ETag: "09c271438a6ca1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..C.......................................................!!!###
%%%&&&)))   ---///000333555666999;;;===>>>AAACCCDDDFFFHHHKKKM
MMQQQRRRUUUVVVXXX[[[]]]___```cccdddfffiiikkkmmmooopppsssuuuwwwyyy{{{}}
}~~~........!..$.").(..4:.<B.FK.SX.\a.ff.qv.{......................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................,......C.....9..H......*\......#J.H.a$7n"U.....
. =.:.....(S.\.R!..C.......7M..)[email protected]:d..."B..)..i.$..J.J...&F..9.F
.M7I.4......g/...d.."E..a .H.Ch..m9.$[....y.i....35.../.9.#Kn.)I..l...
..3'CF0.f..H......;:.\#F.,e.FS..U..n\D..9. E.d).!:o..]b......2N......#
..,x..............j.1d]!.$F.()...xN.$Q....AJ....$.l..cC4a.%.1..B......
).^C.$..%.m..".P...(....epH.&88aF"..H.#.8".D...C..J.I...U.Fp.4.!L...Cs
...|M@...'L..$.d...Z..........e...g.Q.!h.p...h..#.....>..H".Y...|F.
.h%....J:..p.(..C#[email protected]......,[email protected]....
............%b..YB...].o..WC$..........D....t...m^q..hRR.......m......
 ...:[email protected].'.$....iBG!^= .&o a.B1..GAm.......Q"..B.#.(.C.<.h2
.".I..m*`.Cu.y...a...`<..tB.Q.!?.....Y.Iqo..,'75DE.Z(BP.-.!H...
<<< skipped >>>

GET /style/menu.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:18 GMT
Content-Length: 494
Content-Type: application/x-javascript
Last-Modified: Wed, 28 Aug 2013 13:20:29 GMT
Accept-Ranges: bytes
ETag: "ed86c65df1a3ce1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
function fod(obj,name)...{....var p = obj.parentNode.getElementsByTagN
ame("li");....var p1 = document.getElementById(name).childNodes;....va
r newp1 = new Array();....for(i=0;i<p1.length;i  ) {.....if (typeof
(p1[i].innerHTML) != 'undefined') {......newp1.push(p1[i]);.....}....}
....for(i=0;i<newp1.length;i  )....{.....if(obj==p[i]).....{......p
[i].className = "s";......newp1[i].className = "dis";.....}.....else..
...{......p[i].className = "";......newp1[i].className = "undis";.....
}....}...}....


GET /style/images/menu_bg.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:18 GMT
Content-Length: 7493
Content-Type: image/jpeg
Last-Modified: Sun, 06 Jan 2008 06:37:54 GMT
Accept-Ranges: bytes
ETag: "0cd8aaa2e50c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
..........!1AQa...q......"2b..U...BR.#3S$.E....Ccs.Tt5.r4D.%..d.......
...............Q..!a.R..1A..q2...."B....r.b..#C.............?..rU..j..
....O,|.S?....|........?. ..LN..H........U....t-..$...'!\..Z.x*..[.P.H
.Ym...[.\......Wr}.!.....3.A........}.T....N..Kl...du...3..X..R.A-3..)
0.P......^J.|......?...<S..;..^j.Q3.S....H! j......F.c.Y.!...W7....
. .....W<.MzV.VH.t....y....N...VH.._..H....VON.*.......Uu. B.Y...dJ
6.....9...?..O..!%..w..Vd..xE5.1.... .R..V=.*....Y.7{....y...V-..V@...
}.U./....[.Y.o..YUu......x Ux...?T|[email protected]<......n..VHY.\.
.U]j...ON.. $.l\.eTt|..Pm%....J.......]r...v.r....s.=.T%.U....].\.$w..
.3..v.Or...Z..4..RT...%)..}.q........r=!k... .x...\...eu{._.u*;2.Yw...
....Z........~ \..4. og.Z3.. Ueb..M....H..<....z.7-........~!..^...
V....q@... ;.=.l;{6........Y;F.K...9....m...&.r..F...j.d.....VB......:
...Rt[.Y ...>...s.W<...*..o./X.....i.a..Y.\....._J.-C.....i.\...
.}.=.td....w....*U,... ...RF.1~K".f...:....(t......q..^.._<Q..9VH.~
.z..K.....n.$r@.....}r...'E.H..7....:........HY.]...Z<..((N.\.$....
... ...\3...t..Y .z.........g3...`%..*.....=..<.Y.r..k0..q...BU{...
[email protected]..._<2Z.*../.d..J......5..P.0.d...s..*..c..'.`
..oWQ.i.KS.......B...?.ub_._<*....@*..xT....'....f.....`...}.g.
<<< skipped >>>

GET /style/images/search_bg.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:19 GMT
Content-Length: 71
Content-Type: image/gif
Last-Modified: Sun, 06 Jan 2008 06:38:12 GMT
Accept-Ranges: bytes
ETag: "06245b52e50c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.. ....===...!.......,...... ........i.Vt.1.0....q..I.fj...l.^..
;....


GET /uploadfile/200806/20080602030236487.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:19 GMT
Content-Length: 13000
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:09:32 GMT
Accept-Ranges: bytes
ETag: "066a695d3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.........M..V..P..^..R..X..d..p..d..v..e. ~.>p.#u$!U31].,p=KU
IS^@EsLU|Q]cZek`Yxgpt.(..7..>../..6..<..:..?. [email protected]..
C..D..H..M..F..@..O..B..J..L..C..K..X..W..Q..X..Y..I..F..R..T..b..g..u
..e..e..a..o..l..y..b.-O.!P.%W.&T.&\.&Z.*].!S.&W.&X.5\.0[.1_.*a. i.&q.
3f.8d.3a.:b.:d.1u..Y..\..`..k..c..f..t..x..r..h..|.({.1x.Ub.Bj.Ej.Ny.Q
n.Pr.[z.jc.dq.s{.m}[email protected].._..V..b..?..4..!..L..A=..........
................................../.. ..4..=.. ..<.................
[email protected]..^..Q..a..g..v..q..z..`..s..m..R..f..w..y......
......................................................................
......................................................................
......................................................................
.......................,............?..H......*\......#J.H.....3j.....
. CVt!....(K.<.2%...c.......8o...3g..>..5)r...H..,z.(..P.>uJ.
...X.Z].5...^.~eJ..S.G.&M{..........%..\....pj..y....50a........A...|(
t.FAM..9J.......#...4..{S.^..u\.Ja.mM..#M...t.... A".ql#.....i:D.s.C..
.:T.%.A.j..Y{...1rh..s.W.Sl....].R.zcG...>[email protected]...[
!....q.4.A..}0.r.E7.._Lw.t.}..hA....t...7.lC.0.tC./.....9...Xr...l..%E
)[email protected].\ ....o..L
8...N7.."...8../....-..2G.Z,.CSN.c)*?.D...r..2.X..990I...X..Ys.$.5.6..
.U..:.J....w$.w.....I&........D&..b.e(@.[&b..C&.d....:..A14.E.s...,..2
.1.."...H.........."K...2h.q.........J.zk[&.....'SP2.V\...,#[email protected]..
j>SJ.)3...........~.......%b.....J.,n...a&Cd..qD..`....d.....0.
<<< skipped >>>

GET /uploadfile/200806/20080602022912816.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:20 GMT
Content-Length: 11205
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:08:23 GMT
Accept-Ranges: bytes
ETag: "807549405d3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.................................&."..(#.!8."(.#4'..&..&..&..4..
6..6..5..#.&..24."9.*1.2#!.8#.)(-)*4.3/,168))3 5>2.659..I.*L39D._/.
y..j,[email protected].%G .E'.K0.U&.F )G4)G26W/-X6(X:5q..n.%b(.n4/H;
FEI;WB7pG6GGJNIRMRNIS]WIFSLWVRNWVXV[e\eTXdrcHFhRIgYWsKEyUGw\Sf[h~Zfcf\
xcZkhkgitksvxhhwjp.piuuxSj.\}.sy......3..:..H..Q..g(.S(.l..n-.wM.kJ.w.
.{"..)..O..z..y..r..h..{..K..H..T..l..}..x......'4..1.,5.3C.:J.O5.YK.g
U.id.tj.yv.ng.nv.wh.zs.ML.Vb.mU.xj.*..-2....'..--.6C.8E.IQ.Wf.xd.OP.hh
.{..}...y..[..u..u....................................................
......................................................................
......................................................................
......................................................................
..............,...............H......*\......#J.H.....3j...... C..I...
.(S.\[email protected]..$...."..).J.#.......a ."..q.. 
..ng;.x%.i..p..u./K.$]....w....y....n....zX.. 7..#K.L7.Z.}3."Kwp...,O.
\9......U.n3.....- V.Zab..D,5!8...H}..\...N _..,8...$..........n.z..X;
..OP.qpp../_.35...x'Ym...$}...g.u..d...o.qS.~..u..... K.u.C.X...V.Y..x
...]A..D.c..3X2..6.i..x.).5..\.u`_b]..B....M2..P._..'.`..f",.%P.)..(.H
[email protected]|%...{..._.1....m.A..p3....S.@)Ni.HL%..u....l6....}...ak6%..
".'L....'...SE..l..8E`y...q..e|[email protected]>....k....@>..sX2...
.E..),[email protected]..&.t..Z>..s..A.#Q=...nR....S.4.V.
c...............zFZ..T.f>....n.......6.....)){....x.'.......k.k....
{%Q..4OF...r>..t..x..A.X9....1..b.(...j%..=...$.@.<..?..%>
<<< skipped >>>

GET /vip/swfobject.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:21 GMT
Content-Length: 6676
Content-Type: application/x-javascript
Last-Modified: Sun, 30 May 2010 15:51:56 GMT
Accept-Ranges: bytes
ETag: "0b6c47100cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
/**. * SWFObject. * lavaguo. */.if(typeof deconcept=="undefined"){var 
deconcept=new Object();}if(typeof deconcept.util=="undefined"){deconce
pt.util=new Object();}if(typeof deconcept.SWFObjectUtil=="undefined"){
deconcept.SWFObjectUtil=new Object();}deconcept.SWFObject=function(_1,
id,w,h,_5,c,_7,_8,_9,_a){if(!document.getElementById){return;}this.DET
ECT_KEY=_a?_a:"detectflash";this.skipDetect=deconcept.util.getRequestP
arameter(this.DETECT_KEY);this.params=new Object();this.variables=new 
Object();this.attributes=new Array();if(_1){this.setAttribute("swf",_1
);}if(id){this.setAttribute("id",id);}if(w){this.setAttribute("width",
w);}if(h){this.setAttribute("height",h);}if(_5){this.setAttribute("ver
sion",new deconcept.PlayerVersion(_5.toString().split(".")));}this.ins
talledVer=deconcept.SWFObjectUtil.getPlayerVersion();if(!window.opera&
&document.all&&this.installedVer.major>7){deconcept.SWFObject.doPre
pUnload=true;}if(c){this.addParam("bgcolor",c);}var q=_7?_7:"high";thi
s.addParam("quality",q);this.setAttribute("useExpressInstall",false);t
his.setAttribute("doExpressInstall",false);var _c=(_8)?_8:window.locat
ion;this.setAttribute("xiRedirectUrl",_c);this.setAttribute("redirectU
rl","");if(_9){this.setAttribute("redirectUrl",_9);}};deconcept.SWFObj
ect.prototype={useExpressInstall:function(_d){this.xiSWFPath=!_d?"expr
essinstall.swf":_d;this.setAttribute("useExpressInstall",true);},setAt
tribute:function(_e,_f){this.attributes[_e]=_f;},getAttribute:function
(_10){return this.attributes[_10];},addParam:function(_11,_12){thi
<<< skipped >>>

GET /vip/3dboard.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/index.html
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:21 GMT
Content-Length: 2490
Content-Type: application/x-shockwave-flash
Last-Modified: Sat, 22 May 2010 19:26:52 GMT
Accept-Ranges: bytes
ETag: "02614bbe4f9ca1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
CWS.....x..XMl...~.\r.ZR..G...;n\K.m.8..J.l...H.J...&....Z..e..-:h..Ab
..zc...|h{*.K...C.&.{[email protected]\X}of..").M....y.........C...g..Q......
yss.!....7..;..._r........i.....r.1<.CH.a...C.]...>$.>....~v.
...\..3..M.X...F".....7.... .a$..#......{.....3..{....VPr.$elB.. .....
.p]{..0|.0.a...... 7;8.....0..E.gC...../. )..;.^^].o.Fg.b.vt..-Xk-"m).
\ S3..7.`[.X.L.....^3..YqV....U...:\%..u.{.;\.:.P.9(.bgkvI..]..j."4.j.
UEE..0..jz..4."h..Ql..[Vqj.b6..!..}M_.%....&4th...C..%.J%[email protected]
..7....o.M.T#...>....'.?%..oA.,...n.......q.....9.......n7M..a..Ve.
[email protected]... ...P.H[....... .....7.(.j:r.;z...fV-.d..y...`....
..r...khd.V.tZ(\....k:..P\Z..n.....&..]F.....mY....4.5.*.hv.[...Mn.c..
E.|p..G........Y5..W*..!.B....z..^.7..j.L(7..1....V'.<t..i...#..i..
[email protected]...... .E.....R..{..Sm..I....w..
.... ..?...Ij.....B.82...20..P.U2.u\G.X;..1ld..I...;.Xdn[A|..S......@.
53...Ad.G.......#.M.i..!...........B..TY.....z.. -s../...l..^.....!...
..~n...$w.C..TW..<Ta?T.....8.L..Y.l"....n4.#v.[l.W..dy.'.ivEV....(.
.'...c.9j..V..3..SKk...gN....I.u.9.=...x.t.E1O..u...........!..C.\9..3
'..C..s.IW.U..T%...x...]...P...r....@.<....~....S........I.n.KGbH..
..Ob.6.RJ...o..:..U..I.y\m..p,s.h..&..en#.S....o.&r........v....ul..\J
n..1........wl...!........Q2.......fa... .=...>..rz|.3......Y......
.wa.~..s...'M.g....}...=........#o;F.....^.y..g...K..q]wf.*...?...>
..4...i..)...HyT%.a?...g.h\sB....H.O........v...........\......:.z....
c....:h......F....$......y.T...S.x.W>....$.(c...c.."b....&....Q
<<< skipped >>>

GET /uploadfile/news/uploadfile/201311/20131126105258238.jpeg HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:22 GMT
Content-Length: 19883
Content-Type: image/jpeg
Last-Modified: Tue, 26 Nov 2013 02:52:58 GMT
Accept-Ranges: bytes
ETag: "829c4f9d52eace1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF..............Photoshop 3.0.8BIM........Photoshop 3.0.8BIM..
.....e.........../OUSTPM,RTRFLN,OUSTCM,OUSINM,ORTAP,OCABSM,OCATCM.....
..............RTRPIX..(..00054276..F..20131114..P..150436 0000..Z...%G
............MICROSOFT-CYBERCRIME/.....a.....CBRE9AD15VS00.....:rel:d:b
m:GM1E9BE1MMR01..7..20131114..A..Hermes..F..2.1.0.216..P... JASON REDM
OND / Reuters..i.[A sign is pictured in the hallway of the Microsoft C
ybercrime Center in Redmond, Washington..s..X02204..x..A sign is pictu
red in the hallway of the Microsoft Cybercrime Center, the new headqua
rters of the Microsoft Digital Crimes Unit, in Redmond, Washington Nov
ember 11, 2013. REUTERS/Jason Redmond.....en...................>CRE
ATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality....C.........
.......................... $.' ",#..(7),01444.'9=82<.342...C.......
....2!.!22222222222222222222222222222222222222222222222222......8...."
............................................................}........!
1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefgh
ijstuvwxyz............................................................
..................................................................w...
....!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXY
Zcdefghijstuvwxyz.....................................................
...............................?......N.*....(4.Rje..(.....N).y....rM.
*dn*.S.. ......XI...<752.;.........v...O...J......... ..Q.V...c.?..
.|..q.q........Q`G#...=T.9...>...9...!..'.b.U.O.Y.g).......RI..
<<< skipped >>>

GET /uploadfile/news/uploadfile/201311/20131126115042105.jpg HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:23 GMT
Content-Length: 68563
Content-Type: image/jpeg
Last-Modified: Tue, 26 Nov 2013 03:50:42 GMT
Accept-Ranges: bytes
ETag: "f8c014ae5aeace1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.............C..............................................
......................C...............................................
..........................X.."........................................
..b.........................!..1..AQaq...."u....#267s..$&38BRrt......%
'45bev...(CSUVc....DFd.....E..................................C.......
.................!..1A.Qaq.."234......5.#BRr..$b%......6C.............
?...|M$..L.....3DLQ...*.....)4T! ..5&E.5.K..".".z.Z...^7..nrP..,.V....
BOP7..o<..a{...........%[email protected]^..X;e....>hA....Ut.~.cA
`r..Q_.~m..ZI*u.a,...Q.t.|.....i.].rw.w ...Q..Y..[2'.O)....J$L.......q
............['m.....u/4f...z..X.....IQ.....u..oZ..w.E....JR.....N...zp
.[.n....yJO....U .Z....0...[.ot..B.u.S...>....X...z..2./...bT.. .I.
...4W.XR[[email protected]...~.'J..5iP1J...;~iL.l]?h...jS..0....t
..hm!.i.M....Q.#.........y-=..h...N..)C.q1....H6.[GI.....0j4......\.iE
....)..\HI"d4...2F.u.5I..]..GZ.....=.j{.....m6?.9.-.D...Y.$I......L...
.......9.j.....p......9..ah...W.Wp..BR.0<...j.k.1.=_|..y;..$.>..
=.h.D.!...jn..........i...,. ...V...B.......?.&G.N.V......e.\'.K....=v
..5d.[7.mS .)I.....=p..u....)p.S.)....}QL7............._..u..<.@SkJ
..RA.U}k.4.o}].R;...D.T.....EOZ#.6.Im..E....J.. .....I....O...t..h.;0.
..ix.B.V..B..c.o .v.*...C...'.S>..!.5..Z.".J......W...-......z..H..
;t.....B..z...n]..Z\%)*=..Q.......l.O6vR...@....|.'....\..../i....8.5N
.Q.N...j.......T....6....j.[m......?.U%....|.I..=....a/_dT.....{.!.e&l
t;.......A. 4._..V..;y..._..Iv..W.>.... ...C.Mu..J...xi..N.!...
<<< skipped >>>

GET /2010/vip111.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:27 GMT
Content-Length: 6334
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:16:35 GMT
Accept-Ranges: bytes
ETag: "80cbe7ab3145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........//]28m8AxPPQJKtfUqw.Ykkk.9..;..B..M..d.2S.,Z.0g..[.
.e..n..q..s..j..r..w.!k.%u."}.3o.6w.JW.J].I`.[d.Wd.Kg.Gi.Lt.Tj.Zl.Zu.U
w.d].gh.gj.ju.{z.xx.cl.fv.fw.y{.x..Qx.a{.x.~~.~.....................).
.6..>..#..*..)..7..(..5..5..:..S..l..h..j..|..z.....y..J..B..C..Z..
V..Y..Y..J..Q..]..F..E..F..Y..^..X..h..`..h..j..v..y..y..m..g..z..x..x
..f..l..n..s..w..x..Y..h..{..u...u>.D>.~W.wq.KK....%%.<<.Q
Q.cc.tt.{...2..G..r..L..q.....(..,...../..9..[..s..S..u..M..w..\..i...
......................................................................
......................................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*]...S.*.J.J....X.j
.z....\G~......h..$.._T.......^Z.m..<...........kI....=7...O.<}.
..W.u...3G..S....^....P..1c&.Y.\.f...k.9v.....z.g."{.....(g..]..-Y2e..
..n..............?...=...i..ES.|..].....'.......5.3;z....xNy..h....'..
..{..7.|t....p....r...-..f.w....G.....0.. s.EH!}...a..j.E...........'n
d.\....*....t..W!.8....[d...Vx1............Kyt.(,.....I9e.V..%.VX1..{z
!F...)......FG..b.......j...Z....[.....v..._....$.i(R..C.'.,..tQ.....i
... .86..Vx.i...KD...3N.C.....x....I...t...,...J/....*.x......,....n.H
...:....[..;...T..2..f.-....0.{;[email protected]....\...I.2.:..#.A.
.k.p,8....4#.9..#. ....'....2....-..c.<..r...$.t.:...9..#L. .|.
<<< skipped >>>

GET /2010/vip111.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:28 GMT
Content-Length: 6334
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:16:35 GMT
Accept-Ranges: bytes
ETag: "80cbe7ab3145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........//]28m8AxPPQJKtfUqw.Ykkk.9..;..B..M..d.2S.,Z.0g..[.
.e..n..q..s..j..r..w.!k.%u."}.3o.6w.JW.J].I`.[d.Wd.Kg.Gi.Lt.Tj.Zl.Zu.U
w.d].gh.gj.ju.{z.xx.cl.fv.fw.y{.x..Qx.a{.x.~~.~.....................).
.6..>..#..*..)..7..(..5..5..:..S..l..h..j..|..z.....y..J..B..C..Z..
V..Y..Y..J..Q..]..F..E..F..Y..^..X..h..`..h..j..v..y..y..m..g..z..x..x
..f..l..n..s..w..x..Y..h..{..u...u>.D>.~W.wq.KK....%%.<<.Q
Q.cc.tt.{...2..G..r..L..q.....(..,...../..9..[..s..S..u..M..w..\..i...
......................................................................
......................................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*]...S.*.J.J....X.j
.z....\G~......h..$.._T.......^Z.m..<...........kI....=7...O.<}.
..W.u...3G..S....^....P..1c&.Y.\.f...k.9v.....z.g."{.....(g..]..-Y2e..
..n..............?...=...i..ES.|..].....'.......5.3;z....xNy..h....'..
..{..7.|t....p....r...-..f.w....G.....0.. s.EH!}...a..j.E...........'n
d.\....*....t..W!.8....[d...Vx1............Kyt.(,.....I9e.V..%.VX1..{z
!F...)......FG..b.......j...Z....[.....v..._....$.i(R..C.'.,..tQ.....i
... .86..Vx.i...KD...3N.C.....x....I...t...,...J/....*.x......,....n.H
...:....[..;...T..2..f.-....0.{;[email protected]....\...I.2.:..#.A.
.k.p,8....4#.9..#. ....'....2....-..c.<..r...$.t.:...9..#L. .|.
<<< skipped >>>

GET /2010/vip111.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:28 GMT
Content-Length: 6334
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:16:35 GMT
Accept-Ranges: bytes
ETag: "80cbe7ab3145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........//]28m8AxPPQJKtfUqw.Ykkk.9..;..B..M..d.2S.,Z.0g..[.
.e..n..q..s..j..r..w.!k.%u."}.3o.6w.JW.J].I`.[d.Wd.Kg.Gi.Lt.Tj.Zl.Zu.U
w.d].gh.gj.ju.{z.xx.cl.fv.fw.y{.x..Qx.a{.x.~~.~.....................).
.6..>..#..*..)..7..(..5..5..:..S..l..h..j..|..z.....y..J..B..C..Z..
V..Y..Y..J..Q..]..F..E..F..Y..^..X..h..`..h..j..v..y..y..m..g..z..x..x
..f..l..n..s..w..x..Y..h..{..u...u>.D>.~W.wq.KK....%%.<<.Q
Q.cc.tt.{...2..G..r..L..q.....(..,...../..9..[..s..S..u..M..w..\..i...
......................................................................
......................................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*]...S.*.J.J....X.j
.z....\G~......h..$.._T.......^Z.m..<...........kI....=7...O.<}.
..W.u...3G..S....^....P..1c&.Y.\.f...k.9v.....z.g."{.....(g..]..-Y2e..
..n..............?...=...i..ES.|..].....'.......5.3;z....xNy..h....'..
..{..7.|t....p....r...-..f.w....G.....0.. s.EH!}...a..j.E...........'n
d.\....*....t..W!.8....[d...Vx1............Kyt.(,.....I9e.V..%.VX1..{z
!F...)......FG..b.......j...Z....[.....v..._....$.i(R..C.'.,..tQ.....i
... .86..Vx.i...KD...3N.C.....x....I...t...,...J/....*.x......,....n.H
...:....[..;...T..2..f.-....0.{;[email protected]....\...I.2.:..#.A.
.k.p,8....4#.9..#. ....'....2....-..c.<..r...$.t.:...9..#L. .|.
<<< skipped >>>

GET /2010/vip111.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:29 GMT
Content-Length: 6334
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:16:35 GMT
Accept-Ranges: bytes
ETag: "80cbe7ab3145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........//]28m8AxPPQJKtfUqw.Ykkk.9..;..B..M..d.2S.,Z.0g..[.
.e..n..q..s..j..r..w.!k.%u."}.3o.6w.JW.J].I`.[d.Wd.Kg.Gi.Lt.Tj.Zl.Zu.U
w.d].gh.gj.ju.{z.xx.cl.fv.fw.y{.x..Qx.a{.x.~~.~.....................).
.6..>..#..*..)..7..(..5..5..:..S..l..h..j..|..z.....y..J..B..C..Z..
V..Y..Y..J..Q..]..F..E..F..Y..^..X..h..`..h..j..v..y..y..m..g..z..x..x
..f..l..n..s..w..x..Y..h..{..u...u>.D>.~W.wq.KK....%%.<<.Q
Q.cc.tt.{...2..G..r..L..q.....(..,...../..9..[..s..S..u..M..w..\..i...
......................................................................
......................................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*]...S.*.J.J....X.j
.z....\G~......h..$.._T.......^Z.m..<...........kI....=7...O.<}.
..W.u...3G..S....^....P..1c&.Y.\.f...k.9v.....z.g."{.....(g..]..-Y2e..
..n..............?...=...i..ES.|..].....'.......5.3;z....xNy..h....'..
..{..7.|t....p....r...-..f.w....G.....0.. s.EH!}...a..j.E...........'n
d.\....*....t..W!.8....[d...Vx1............Kyt.(,.....I9e.V..%.VX1..{z
!F...)......FG..b.......j...Z....[.....v..._....$.i(R..C.'.,..tQ.....i
... .86..Vx.i...KD...3N.C.....x....I...t...,...J/....*.x......,....n.H
...:....[..;...T..2..f.-....0.{;[email protected]....\...I.2.:..#.A.
.k.p,8....4#.9..#. ....'....2....-..c.<..r...$.t.:...9..#L. .|.
<<< skipped >>>

GET /2010/vip111.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:29 GMT
Content-Length: 6334
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:16:35 GMT
Accept-Ranges: bytes
ETag: "80cbe7ab3145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........//]28m8AxPPQJKtfUqw.Ykkk.9..;..B..M..d.2S.,Z.0g..[.
.e..n..q..s..j..r..w.!k.%u."}.3o.6w.JW.J].I`.[d.Wd.Kg.Gi.Lt.Tj.Zl.Zu.U
w.d].gh.gj.ju.{z.xx.cl.fv.fw.y{.x..Qx.a{.x.~~.~.....................).
.6..>..#..*..)..7..(..5..5..:..S..l..h..j..|..z.....y..J..B..C..Z..
V..Y..Y..J..Q..]..F..E..F..Y..^..X..h..`..h..j..v..y..y..m..g..z..x..x
..f..l..n..s..w..x..Y..h..{..u...u>.D>.~W.wq.KK....%%.<<.Q
Q.cc.tt.{...2..G..r..L..q.....(..,...../..9..[..s..S..u..M..w..\..i...
......................................................................
......................................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*]...S.*.J.J....X.j
.z....\G~......h..$.._T.......^Z.m..<...........kI....=7...O.<}.
..W.u...3G..S....^....P..1c&.Y.\.f...k.9v.....z.g."{.....(g..]..-Y2e..
..n..............?...=...i..ES.|..].....'.......5.3;z....xNy..h....'..
..{..7.|t....p....r...-..f.w....G.....0.. s.EH!}...a..j.E...........'n
d.\....*....t..W!.8....[d...Vx1............Kyt.(,.....I9e.V..%.VX1..{z
!F...)......FG..b.......j...Z....[.....v..._....$.i(R..C.'.,..tQ.....i
... .86..Vx.i...KD...3N.C.....x....I...t...,...J/....*.x......,....n.H
...:....[..;...T..2..f.-....0.{;[email protected]....\...I.2.:..#.A.
.k.p,8....4#.9..#. ....'....2....-..c.<..r...$.t.:...9..#L. .|.
<<< skipped >>>

GET /2010/vip222.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:30 GMT
Content-Length: 5302
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:18:45 GMT
Accept-Ranges: bytes
ETag: "803864f93145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f.......%%%<<<"7zQQQcccjj~sst.8..A..B..J..R..T..\..e.
#O.0C.2T.1b..\..d..k..p..l..v..x..f..y..x..u.$}.U\.E^.Sj.\f.ab.gg.|{.u
u.kn.hw.~|.M}......./..)..G.._.cR..c..u.&........................*..3.
.>[email protected]..[..I..K..N..Z..\..\..
i..m..}..q..c..i..l..h..s..x..u..{..o......HH.ss.tt..*........4..g..J.
.w..F..S..b..j........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................,......f........H......*\......#J.H.....3j.....
. C..I....(S.\[email protected].*].....P.J.J....X.j...
...`...)..T....}.....K...K..\.Ck..#.(-1.z...W.a..j..[..^.C....s...?...
.....e....Y...?O..,.rP.b~...{....c.....d{...&..._....T...N..m7..[....u
fg..r.../....3w.....d......a..Cx.u..wn.}.;..A.g.rDq'.`..e.^..c.e..g.ev
.$...H.Sh....N.......U.o.5.`.."W]r....G....:...N;5...<.6..|.....=q.
..=.......Wv....r...Q;.d"I.u.q..yH../....9.....G.......X.F...bs..a}..g
..#j4.0y.`G"....*..r.). b. .p..:....Ap..^c....s.....}....U..u.<..@.
%.p#. ..b.)`....`.2H&..C.8. T..q.c.b..f.N....cL.. ctN..v.Rv.&'.!.8... 
._|...Y.[/.\taH&..#.5.......V.aX..]O..G.....a_.Q.pv.#W.;t...........[.
.(7.r.RP.E".h3.4..5p........R\...Ln.....j.......C.. ....'....X/...
<<< skipped >>>

GET /2010/vip222.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:30 GMT
Content-Length: 5302
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:18:45 GMT
Accept-Ranges: bytes
ETag: "803864f93145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f.......%%%<<<"7zQQQcccjj~sst.8..A..B..J..R..T..\..e.
#O.0C.2T.1b..\..d..k..p..l..v..x..f..y..x..u.$}.U\.E^.Sj.\f.ab.gg.|{.u
u.kn.hw.~|.M}......./..)..G.._.cR..c..u.&........................*..3.
.>[email protected]..[..I..K..N..Z..\..\..
i..m..}..q..c..i..l..h..s..x..u..{..o......HH.ss.tt..*........4..g..J.
.w..F..S..b..j........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................,......f........H......*\......#J.H.....3j.....
. C..I....(S.\[email protected].*].....P.J.J....X.j...
...`...)..T....}.....K...K..\.Ck..#.(-1.z...W.a..j..[..^.C....s...?...
.....e....Y...?O..,.rP.b~...{....c.....d{...&..._....T...N..m7..[....u
fg..r.../....3w.....d......a..Cx.u..wn.}.;..A.g.rDq'.`..e.^..c.e..g.ev
.$...H.Sh....N.......U.o.5.`.."W]r....G....:...N;5...<.6..|.....=q.
..=.......Wv....r...Q;.d"I.u.q..yH../....9.....G.......X.F...bs..a}..g
..#j4.0y.`G"....*..r.). b. .p..:....Ap..^c....s.....}....U..u.<..@.
%.p#. ..b.)`....`.2H&..C.8. T..q.c.b..f.N....cL.. ctN..v.Rv.&'.!.8... 
._|...Y.[/.\taH&..#.5.......V.aX..]O..G.....a_.Q.pv.#W.;t...........[.
.(7.r.RP.E".h3.4..5p........R\...Ln.....j.......C.. ....'....X/...
<<< skipped >>>

GET /2010/vip222.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:30 GMT
Content-Length: 5302
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:18:45 GMT
Accept-Ranges: bytes
ETag: "803864f93145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f.......%%%<<<"7zQQQcccjj~sst.8..A..B..J..R..T..\..e.
#O.0C.2T.1b..\..d..k..p..l..v..x..f..y..x..u.$}.U\.E^.Sj.\f.ab.gg.|{.u
u.kn.hw.~|.M}......./..)..G.._.cR..c..u.&........................*..3.
.>[email protected]..[..I..K..N..Z..\..\..
i..m..}..q..c..i..l..h..s..x..u..{..o......HH.ss.tt..*........4..g..J.
.w..F..S..b..j........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................,......f........H......*\......#J.H.....3j.....
. C..I....(S.\[email protected].*].....P.J.J....X.j...
...`...)..T....}.....K...K..\.Ck..#.(-1.z...W.a..j..[..^.C....s...?...
.....e....Y...?O..,.rP.b~...{....c.....d{...&..._....T...N..m7..[....u
fg..r.../....3w.....d......a..Cx.u..wn.}.;..A.g.rDq'.`..e.^..c.e..g.ev
.$...H.Sh....N.......U.o.5.`.."W]r....G....:...N;5...<.6..|.....=q.
..=.......Wv....r...Q;.d"I.u.q..yH../....9.....G.......X.F...bs..a}..g
..#j4.0y.`G"....*..r.). b. .p..:....Ap..^c....s.....}....U..u.<..@.
%.p#. ..b.)`....`.2H&..C.8. T..q.c.b..f.N....cL.. ctN..v.Rv.&'.!.8... 
._|...Y.[/.\taH&..#.5.......V.aX..]O..G.....a_.Q.pv.#W.;t...........[.
.(7.r.RP.E".h3.4..5p........R\...Ln.....j.......C.. ....'....X/...
<<< skipped >>>

GET /2010/vip333.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:31 GMT
Content-Length: 6272
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:19:03 GMT
Accept-Ranges: bytes
ETag: "80cd1e43245cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........///.3x%/j%1k%7u58l1<s._..p.,x.6r3-A}5C{-aYA>p
QQQCHxDuHjjj.7..<.!>..F..O..a..`..e.'E.&J.-P.(S.5I.>S.7W.&Y.%
].4].8`.,e.&h.)p.:f.7k.9v..\..k.%i.&x.%{.9w.=..GM.JS.FY.VX.V\.Gc.^b.Vd
.Hi.Kv.Gz.Yk.Uw.X}.a^.gk.jk.is.mt.po....vw.ht.b{.y{.B{.P|.7..G..T.)V..
Y."k..i.-Y.Uj.Wq.it.N}.my........)..)..:..6..;..,..&..4..7.....8..?..I
..G..^..T..z..u..J..C..F..V..Q..Y..W..G..T..[[email protected].
.d..i..e..s..|..h..e..|..w..e..a..h..e..q..u..x..[..e..f..j..z......%%
.<<.QQ.cc.tt.....U..w.....*../..1..R............................
......................................................................
......................................................................
......................................................................
................................!.......,......f........H......*\.....
.#J.H.....3j...... C..I....(S.\[email protected].*]...
..P.J.J....X.j......`...Y.lEz.....I..k.4i.tM..M.*^..I..v..m..P....2.cG
o-.l..j.K9..z.0a.../&v..5f.Ms.......Ip.......8...o.....3g...;n.Is..s.f
..9.mm....].xj...K~.]z....o..60...r......&...........3 ...>fl.)$.kn
ub`'ii..t...I6....'..F.m.a.I;..........$...Er...\..U._....b.pB.&..S\e.
abcB.l..|....A...\..]..fs.s.f...b<W....\b..;.T.dg..T.x.]S..>.v.a
.-..&.h..dHb..io.U....).\.m.f....N8....,....0..S.....aD.qB....F.'~....
..)$zL>$.q|..)...iba=.`rM6....b...e<..rJ.M.../.."L....J*...... .
Pi...c..\.Yzd...p..*....HaAve.c....Y.>.. EXjY./J(..3..cM5.0.L2.,..2
..".*..c....#.BO..]&...fA.. ..M..cb....q..EP...,j=..w.5...Il.]Y.*E
<<< skipped >>>

GET /2010/vip333.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:31 GMT
Content-Length: 6272
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:19:03 GMT
Accept-Ranges: bytes
ETag: "80cd1e43245cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........///.3x%/j%1k%7u58l1<s._..p.,x.6r3-A}5C{-aYA>p
QQQCHxDuHjjj.7..<.!>..F..O..a..`..e.'E.&J.-P.(S.5I.>S.7W.&Y.%
].4].8`.,e.&h.)p.:f.7k.9v..\..k.%i.&x.%{.9w.=..GM.JS.FY.VX.V\.Gc.^b.Vd
.Hi.Kv.Gz.Yk.Uw.X}.a^.gk.jk.is.mt.po....vw.ht.b{.y{.B{.P|.7..G..T.)V..
Y."k..i.-Y.Uj.Wq.it.N}.my........)..)..:..6..;..,..&..4..7.....8..?..I
..G..^..T..z..u..J..C..F..V..Q..Y..W..G..T..[[email protected].
.d..i..e..s..|..h..e..|..w..e..a..h..e..q..u..x..[..e..f..j..z......%%
.<<.QQ.cc.tt.....U..w.....*../..1..R............................
......................................................................
......................................................................
......................................................................
................................!.......,......f........H......*\.....
.#J.H.....3j...... C..I....(S.\[email protected].*]...
..P.J.J....X.j......`...Y.lEz.....I..k.4i.tM..M.*^..I..v..m..P....2.cG
o-.l..j.K9..z.0a.../&v..5f.Ms.......Ip.......8...o.....3g...;n.Is..s.f
..9.mm....].xj...K~.]z....o..60...r......&...........3 ...>fl.)$.kn
ub`'ii..t...I6....'..F.m.a.I;..........$...Er...\..U._....b.pB.&..S\e.
abcB.l..|....A...\..]..fs.s.f...b<W....\b..;.T.dg..T.x.]S..>.v.a
.-..&.h..dHb..io.U....).\.m.f....N8....,....0..S.....aD.qB....F.'~....
..)$zL>$.q|..)...iba=.`rM6....b...e<..rJ.M.../.."L....J*...... .
Pi...c..\.Yzd...p..*....HaAve.c....Y.>.. EXjY./J(..3..cM5.0.L2.,..2
..".*..c....#.BO..]&...fA.. ..M..cb....q..EP...,j=..w.5...Il.]Y.*E
<<< skipped >>>

GET /2010/vip333.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:32 GMT
Content-Length: 6272
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:19:03 GMT
Accept-Ranges: bytes
ETag: "80cd1e43245cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........///.3x%/j%1k%7u58l1<s._..p.,x.6r3-A}5C{-aYA>p
QQQCHxDuHjjj.7..<.!>..F..O..a..`..e.'E.&J.-P.(S.5I.>S.7W.&Y.%
].4].8`.,e.&h.)p.:f.7k.9v..\..k.%i.&x.%{.9w.=..GM.JS.FY.VX.V\.Gc.^b.Vd
.Hi.Kv.Gz.Yk.Uw.X}.a^.gk.jk.is.mt.po....vw.ht.b{.y{.B{.P|.7..G..T.)V..
Y."k..i.-Y.Uj.Wq.it.N}.my........)..)..:..6..;..,..&..4..7.....8..?..I
..G..^..T..z..u..J..C..F..V..Q..Y..W..G..T..[[email protected].
.d..i..e..s..|..h..e..|..w..e..a..h..e..q..u..x..[..e..f..j..z......%%
.<<.QQ.cc.tt.....U..w.....*../..1..R............................
......................................................................
......................................................................
......................................................................
................................!.......,......f........H......*\.....
.#J.H.....3j...... C..I....(S.\[email protected].*]...
..P.J.J....X.j......`...Y.lEz.....I..k.4i.tM..M.*^..I..v..m..P....2.cG
o-.l..j.K9..z.0a.../&v..5f.Ms.......Ip.......8...o.....3g...;n.Is..s.f
..9.mm....].xj...K~.]z....o..60...r......&...........3 ...>fl.)$.kn
ub`'ii..t...I6....'..F.m.a.I;..........$...Er...\..U._....b.pB.&..S\e.
abcB.l..|....A...\..]..fs.s.f...b<W....\b..;.T.dg..T.x.]S..>.v.a
.-..&.h..dHb..io.U....).\.m.f....N8....,....0..S.....aD.qB....F.'~....
..)$zL>$.q|..)...iba=.`rM6....b...e<..rJ.M.../.."L....J*...... .
Pi...c..\.Yzd...p..*....HaAve.c....Y.>.. EXjY./J(..3..cM5.0.L2.,..2
..".*..c....#.BO..]&...fA.. ..M..cb....q..EP...,j=..w.5...Il.]Y.*E
<<< skipped >>>

GET /2010/vip444.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:32 GMT
Content-Length: 4768
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:02:56 GMT
Accept-Ranges: bytes
ETag: "038617d5c3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..............................#..$.#..((-..%..(..'..7..7..8..
!.$9.'! .*$.4%.83.%%%'(5/> *354 )7,095*;;<.3K1E:.\[.Yj.`t(FF$DY(
W_:AF0\e%ozK..L).L9.Y!.L$$J:'D?<V, V>4m..d.$p%.h'#NC/KB5YG ZG3\S
*XQ:fS.dJ8iV fT:xZ;.m=DFGKRJJQTUJEWFP\TGQQQY]c]eeiYHb[[nbJi`[xhHwdVccc
jktlpofz{ttt....7..x.#r.x{.>..). ...q.|.........6..!...............
..;.."..U..{..E......"../4....'[email protected]
T.{w.VB.zU...."..66..................."..0=.%%.2&.;;.J4.QQ.cc.tt.}...M
..Y..h..Z..e..v..k..t..h..y..i..r..v..W..d..s..i..X..n..v..c..z..l..{.
.k..{..b..j..u..k..x..................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*].....P.J.J....-Uj
......`...K.........l..H..6SGQmAj..U...._......,..I.......%F.&M..,!.I.
.J.W..<j...K.nZ%F...nfW.4..-...w.....1R.nR$..#....up..."&.y..K..N.$
.x.yo!k....@..*....Y.....:....4K.%...{.b..~.....%.....C..g....f.].5c.4
.\RI%.Ps.i.\..o...^z.!..%.5#_A..5!A....#......9g.#......I..<..V[r..
..5.8..}..(Wh.].`h.]r.g0.d.@/R..y..G.B..9.\.....@.'.j....x.iG..$.C.3..
..1....0..sQ...f.....Xm.UB.bW.g.$l".L%....oW...l..v.~.Y....J..~.u.....
.j........HD.{8.vIl.=.......`....xHj...q...4.Pc.....Z{s.)\a.nd.......T
t.......yx...ioR..%....t..V.B.i.L..z7....J$..uF..q}../.f..D....x....@.
U..e...,.....<.U..A.q..5..3....gi. eP ...j .....c..5..h.%......
<<< skipped >>>

GET /2010/vip444.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:33 GMT
Content-Length: 4768
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:02:56 GMT
Accept-Ranges: bytes
ETag: "038617d5c3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..............................#..$.#..((-..%..(..'..7..7..8..
!.$9.'! .*$.4%.83.%%%'(5/> *354 )7,095*;;<.3K1E:.\[.Yj.`t(FF$DY(
W_:AF0\e%ozK..L).L9.Y!.L$$J:'D?<V, V>4m..d.$p%.h'#NC/KB5YG ZG3\S
*XQ:fS.dJ8iV fT:xZ;.m=DFGKRJJQTUJEWFP\TGQQQY]c]eeiYHb[[nbJi`[xhHwdVccc
jktlpofz{ttt....7..x.#r.x{.>..). ...q.|.........6..!...............
..;.."..U..{..E......"../4....'[email protected]
T.{w.VB.zU...."..66..................."..0=.%%.2&.;;.J4.QQ.cc.tt.}...M
..Y..h..Z..e..v..k..t..h..y..i..r..v..W..d..s..i..X..n..v..c..z..l..{.
.k..{..b..j..u..k..x..................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*].....P.J.J....-Uj
......`...K.........l..H..6SGQmAj..U...._......,..I.......%F.&M..,!.I.
.J.W..<j...K.nZ%F...nfW.4..-...w.....1R.nR$..#....up..."&.y..K..N.$
.x.yo!k....@..*....Y.....:....4K.%...{.b..~.....%.....C..g....f.].5c.4
.\RI%.Ps.i.\..o...^z.!..%.5#_A..5!A....#......9g.#......I..<..V[r..
..5.8..}..(Wh.].`h.]r.g0.d.@/R..y..G.B..9.\.....@.'.j....x.iG..$.C.3..
..1....0..sQ...f.....Xm.UB.bW.g.$l".L%....oW...l..v.~.Y....J..~.u.....
.j........HD.{8.vIl.=.......`....xHj...q...4.Pc.....Z{s.)\a.nd.......T
t.......yx...ioR..%....t..V.B.i.L..z7....J$..uF..q}../.f..D....x....@.
U..e...,.....<.U..A.q..5..3....gi. eP ...j .....c..5..h.%......
<<< skipped >>>

GET /vip/vipbanji.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:33 GMT
Content-Length: 11597
Content-Type: image/gif
Last-Modified: Tue, 07 Sep 2010 16:55:00 GMT
Accept-Ranges: bytes
ETag: "04a8468ad4ecb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a............(..4.";.5>.*I.-R.:G.3X. G.:E.;[.;h.>p.:f.=r!?H
[email protected]\.BL.N_.Bm.Et.Sc.Zq.Fg.Hx.Vf.Xt.ez.f|&CL"LY(Q]"Zg#Ys2[g,`o)gy2hy;
r..J..T..V..K..M..Q..U..Z..i..r..z..i..d..s..|..c..i..t..w. L.!N.!W.!U
."\.&_.)l.,y.%{.1m.1v.6|.#c.%i.'y.$u.0e.0~.1u..|.$l.&y.4y.G~.@z.......
...............%..5..'..%.. ..*..8..2..8..9..$..<..................
.............................'..)..(..'..7..8..6..;..'..&..*..7..9..6.
.9..(..(.. ..;..8..8....................)..'..*..8..8..8..=..M..B..C..
C..C..E..S..B..E..A..G..G..E..D..D..C..C..L..L..M..L..T..P..T..R..D..J
..D..Q..Q..R..X..]..a..i..a..J..U..D..C..C..M..K..K..M..F..M..C..C..C.
.L..K..L..L..S..Q..R..R..Y..Y..Z..Z..Q..T..U..Z..X..T..T..R..T..[..[..
]..Z..E..K..J..S..[..]..a..d..c..h..b..b..b..c..k..n..k..k..q..u..b..i
..y.................,...............H.......S......#J..p..../Z.(0.G..;
......o..} .R.../.As....q.p......q......&6...-d...8.A........X....n...
]..M....ihmM.....ghc=[./.X|..i...V.g.g...k.0m.m.T........:.*..B.2 ..y.
...<_.............i.....<.....=.2ll.oh3...V..qd.U;#w..&J./)Sf...
d.*)2^...a.......RsK.......3f..y.O.|2....O?...K...]q.Ib`$.8..$u...#.B.
...6b!$.....s.1..v..H#..Ha#s..!.rph...ZX..0.hb..2...<..G.<.!$.8.
...G..D.@....@ .D.NHa..R..D.K !.._~!..Kpd.A&....l......t.P-.3.4v...7..
v..6..([email protected]..:.<%Nc`...Y....6....Zl..X[....
.]b.e.5....-....8...).O)4N8..FYe.]..n...Y..tCZj.%....(..l..&.g....L...
L0.T..$........ %...-3....o..'.y...^{..g.w.u....$.Lz......e,....W.$..(
.$. ..#(?...3Zh..-......Xa..~...4....$.\[email protected]$.T..C
<<< skipped >>>

GET /vip/baoming2.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:34 GMT
Content-Length: 1064
Content-Type: image/gif
Last-Modified: Tue, 07 Sep 2010 16:05:49 GMT
Accept-Ranges: bytes
ETag: "806c9589a64ecb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a2.......o..p..r..t..v..x..{..|..~...............................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........,....2..........H......*\.......*.H.....3j...... C..I.$..(.
.\.....-.....A......93...:...I..P.?..U*4...H.&..4.....f..ukV.3.v.*S.U.
]..X.vA..l.....n..q......].pe.....N....XL`.b...3vL..L..#7...)...7C..:.
e....^.`@...e..M.....k..-.w........x.....?..yp...7GZ.zu..y........g...
@......._.> .;....


GET /uploadfile/news/uploadfile/201404/20140423091537911.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:34 GMT
Content-Length: 22386
Content-Type: image/jpeg
Last-Modified: Wed, 23 Apr 2014 01:15:37 GMT
Accept-Ranges: bytes
ETag: "a0d3f688915ecf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....d.d......Ducky.......2......Adobe.d....................
.......................................#"""#''''''''''................
..................................!! !!''''''''''........|..".........
......................................................................
.....!..1AQ"..aq2.....B#..Rb..r........3$..C..4D%..S5c..EU............
.........!.1AQ.aq..."B...2..R3....#..br.C...S$4............?...u....an
.y....R....6.....h...M....(.B...w~.Wc.~...B. .B}...7O.7....'.q.....qo.
T.&.kV..g.R..wz..j.I;,..VPL.....r.a.E.c0..~.i.!....`...-..-.#..q.^...$
......\.;.*#...........;..jy...(S)..GQ1=6.....O9..h.~...hS._ ....2&...
m.../N..h...9..O...f...T.y.>....i?...Nw.&0N>j....<.._.V..NMb.
ir6B...4........c.(.p."..>*R..-.Z#. .B.....y...:iJr.."a.O.1....w.*.
3.s .c..'.L..C.7Qs.....!........\..]..E....D..8.K.x)...1.>i..~:..&T
.....v...]..{Oe..N\H...1.&.g....8.....^ .....eg6O4..Lw..w.^.....'...Lx
...>..6. .. .....5.WTZB.]z!>...j\x.N..E..J.......nC.Y....,x.....
u..M.7...........V..V.{.T. .sB....q........do`...Ad"..'...'..z...y....
......:.S0O<..)..~..8..........J........".q.%o0...........J/.5H..Db
.....{..:|..e*.Y.a...i.9"E.....K*.....NN..%..A......].C....a.!...=....
mL..VF....._.o.".\1....{..77?Mt....V../]S9D.......[..PEuYI...Z.l...^..
q.q\HF.sMd.a..L.......D..S.E ..]..Z.<....XSi99$`..M....M...\.......
,._.....c9..m.n./.......8...`M.^..../4....T^.[v.>(J..I...f.... .g.H
....=.E....=Wq......../.B.b.VO.....,.>."F_..}G..*.F..@..,.....YI,..
.]...w...|)<.....R?...D...FP. .>..O.Iz.[....Q.)........?..;|
<<< skipped >>>

GET /images/jian.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:36 GMT
Content-Length: 818
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 14:47:26 GMT
Accept-Ranges: bytes
ETag: "0134af1513dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,...............H.......L...;....


GET /uploadfile/news/uploadfile/201403/20140331042935872.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:36 GMT
Content-Length: 215329
Content-Type: image/jpeg
Last-Modified: Mon, 31 Mar 2014 08:29:35 GMT
Accept-Ranges: bytes
ETag: "54844f59bb4ccf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
.PNG........IHDR...............X.....gAMA......a.....sRGB........ cHRM
..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...H.
..H.F.k>....IDATx...u|\W.5..33....'.3N.. ...BKffF.-.bf....L&......]
..Il.T.V..[G.........>..iPK..W.*KcY..ZCy.5W.RCe1.....W..ycU....6U..
.{j.N[.m.,.ZcE....m....lu............m.....T...T..3}.......b.k..s5eV.w
~...t.J.|m.\.]l(g .K.jU.....*....t....4T...*>Vv...j...lW..v...j....
.......\.]m..kg..jC.]..h..5....6...&.l.t...].k....t.........3.k...p.W.
J.......g.u.....ZM4}...M.4s3....C.7...-Ds..%lW6oG.X......=4k{7...6M..F
on.E......M.vu..-...O..........E..y..II..5.tR.1.......^.nJ?...z.2N...t
SF....NJ=.C.O.z...wQ6__x..B..S..[B.^.I9...o.....vRV...vPz..%].......2.
..k...)..%..&....(..hy...........\...K.. ...x]...........W ,..........
e..j~.<>^..Y...5....5...f.....Tt.s.W..R|....*.....X&.\....u..~.E
.|??7...<......|%.......V.r....u./.t7-8.N)G..;_pR}.8N..|a........L.
=,.c...w.]..W/..$.....N.%.w...8....k.{(!.[l.....H9Db.......{zc....m.i.
.N...KX....,.[.....i..;...q..N...]..5}...6{w.M..f..~.Y{....s$...D.[.{.
K~.y...s.9.E..ou.a.........?S*.......u>.<~.X.^...w.K...w...S..^J
..d.....y.........^..X...Y..p......8.jP1_.=f.. p...z<.........28h{.
.g?.<l.....a0.g..a......UZ..B}.[....{..g........L4 ]....".>... .
.$.c.....[..J}.]e.bc.......>...P.?[[email protected]...^_...
L._........s=..F.g..`...`..Sl7l..C.....:i......d..O6.w.X..>..6..$0@
$.?.l...@.....?..b!.....p...s...G.L.;..C.Iv....g18d.?.,.."......hQ..N.
e.....s..u8..B..*%Z..0..[....<>_. ...............R>......
<<< skipped >>>


GET /api.php?mod=js&bid=72 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:24 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=72";</script>........
....H................



GET /api.php?mod=js&bid=68 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:20 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=68";</script>........
....H................



GET /api.php?mod=js&bid=69 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:21 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=69";</script>........
........6.......y{...



GET /bcv1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/topbanner.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Mon, 28 Apr 2014 10:36:30 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 44495
Accept-Ranges: bytes
ETag: "331B39748EB0537051D860EB6BA89751"
Last-Modified: Tue, 12 Mar 2013 08:40:58 GMT
x-oss-request-id: 5352B0472E960A4B0FA63FE9
Expires: Mon, 28 Apr 2014 20:28:00 GMT
Cache-Control: max-age=86400
Age: 63536
Via: http/1.1 l2hk1 (ATS [cRs f ]), http/1.1 de1 (ATS [cRs f ])
Connection: keep-alive
CWS..`..x....`.Gu(<.>..veK~H.%[~.._....X~..l.....8.DYIky....].25
[email protected].(..B.<.MK.-.>.>h.CR.....q..<f......Bo...!..
..9s......3...._....X`.....u.....Y.Z..=......b$S..dKgr.Y!*.se.z.N.-L4\
.....Lq(S.}."BdF./...FF.....HY.!.........]O..."D....q.C.ZIdp.X8.......
(W..e.HY..e.Y1.)...|..li.r...'*.3.LyK.X.|.p..-.2cb...9....e**....2t4Wx
P.O.;*&.c.3..B.!9.'J.*..ln.tE~.....I1...8Z....$.8......9........b@....
LzQ2..R...DN....S.........`. .J# ...u...?..........A...2X*. .*....euCM
..1P......../..;.....Q..c`.4.......o.}..g.?..3.........._K.....m'.:..N
.)...e....&{N......S..Z. ..y.{ ........x{..h.?o........\....u....E.O.V
..`a.Xl/Q_.I{<.......e.r.ZA_7I......$.W...>.]M.7....~.]...{...A.
O....b........9..(t....t.T*..5H07.N<....Pfd...l."SJ.#:...9.x.W..2.b
..*p*@5.t..Bwv....V.4Z.s....X..T....A|L.,.n.....J-5.z),Bv..0.X<..q.
..........~&.$......X..W......c.4.#....C ..x...I.....C")...t.....?..d.
3x&W...!....d*....c.3..O..X.V...a%U.....4....7..A........C.3...l.*..Y.
W..Z....{...RB.....A... U....!...F...1.P=} !D........Z*.F!fh.~...KY...
.. .....r.".]....@m....]"?|..9..N.F...J.0...I.....S..JX...............
.s>.......D.x&{..,...\..d.#.;46Q..~O.S8*.SD.,.b.J..91>...\.2....
.,W....r......F. ..8.y>5..gr.1... ....}%.K,.K...P.\.......m..F..!H.
~c\.....V.j>......<5[.....q..jl...*/@..`...f......yT\......l>
..C.)...w5...H.P N.p>.q...<*q"...J..4.tK..48K$N\.4xp.v.7...[#...
B..:'bgE.....=,.........5.nb.^.......|.8.'3.D.&H$l...I........#V$....R
H..Pb..aL.B$*....b..{..u.L9;.)._....gP!......hE5-.....K..j..R.q...
<<< skipped >>>

GET /materials/original/2008-12-06/ac4f3526441feb390f07012b7867f7a7cc4f8fd6.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 29 Apr 2014 03:22:16 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 286
Accept-Ranges: bytes
ETag: "21CC0725AC426E4DA0975A779744DA5F"
Last-Modified: Wed, 30 Jan 2013 03:06:21 GMT
x-oss-request-id: 5357181D11670A32086E62CD
Expires: Tue, 29 Apr 2014 03:53:34 GMT
Cache-Control: max-age=7200
Age: 5832
Via: http/1.1 l2hk1 (ATS [cRs f ]), http/1.1 de1 (ATS [cSsNfU])
Connection: keep-alive
CWS.....x..`.:.........E................!.*-..sG.&. ._.?.6....L.B..L*k
...V3.x^da.....0...j.....&.......20\.ad.x.....#..N..-g.Us(3....`..>
..Q....AT0.q$U.y:.*.<.H.c....i...fP.W... ^... . U.y~.:.......R'CXS.
.3..cH.ct.b.C..U......PVT.Bc.~....J.1J<../.Qd.C.......A.of...(Sm`hc
cc.VC.........[....


GET /swf/2010-07-23/10-05/0f1fcc8116f02f3798b2c29eafec71cd.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 22 Apr 2014 13:27:24 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 1677
Accept-Ranges: bytes
ETag: "6E5053BB18290D95B489F24DAF1E6255"
Last-Modified: Mon, 11 Mar 2013 03:35:49 GMT
x-oss-request-id: 532EC19160ACD7AA7A3B8A95
Expires: Sun, 11 May 2014 06:21:28 GMT
Cache-Control: max-age=2592000
Age: 1877878
Via: http/1.1 l2hk1 (ATS [cRs f ]), http/1.1 de1 (ATS [cRs f ])
Connection: keep-alive
FWS.....h...........C....?................................R...C.......
.....-f..vm...)<..*...C.^..7.H.3...,..\.Y.....T!......&|}..?.|7%<
;[email protected]....}...~.Kn.6.wu%..........f......... [..is...n.F..
......yX......r..V..W%..W<.'......-CU{...'l..2.....W..j..Pj..B..../
..=.B....?..|.;...`.!;.........r..K...!5....apC..x...j....../n.......6
!.....f..]...S...-;v.x .U......I9.M....-aV.w...?}.....Y(.;..`..qI...o.
..,o.l&.n(9Z.....4...L$`.M..NbC...?o5..z...f.I..)(.:d..$....C._I.....-
k.}x.h..71F..)[email protected]%...!.rq.{.!l....?.\....MbC....k&
[email protected]).:...%..M.C.c9.....-fN.w....aC..p_.1<.{nC.....qS.!.b?.
I.Vm.x..;1...n.*B..?...'.nc..o....jN...i..i?$`....M^CX...o5..zN....I..
9).:d..e....C.cI.....-O...C........2w.Nd.....v.;.^8[M..[..1..\2f....=.
....0[.`.>.......\8.*..T}n...;b.......{.r.PR...g........ .b.]...>
;..bd......l.r ..N...-e....R[...6...V.ln....Kb.x....v..e..m.k..uW./.s.
9%~.....G.....ZugpR.2.|5... ..p..`]w!....7...=...4...y.....KwY....7..[
......x.9.....r...`.N..U......]....`.....|.....X7...-N.V.W._....E...3.
..................................W....h......DDD..........l........."
....ti_0.?.A........_root...........text_count......O..........text_si
ze......O.......Version....@.....&.......mc_0.....W...(X......DDD.....
..........."....ti_1.@.....&........mc_1.....W....X......DDD..........
......"....ti_2.@.....&.......`mc_2.....W...h.......DDD...............
."....ti_3.@.....&.......`mc_3.....W...H`......DDD................"...
.ti_4.@.....&........mc_4.....W...H`......DDD................"....
<<< skipped >>>

GET /swf/2010-07-23/10-10/c6c15df4b23dc29d42af976e735ef9d2.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 22 Apr 2014 13:27:24 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 3643
Accept-Ranges: bytes
ETag: "488677116843723F02FB743710F67433"
Last-Modified: Mon, 11 Mar 2013 03:36:18 GMT
x-oss-request-id: 532EC1932E960AE44E3B9995
Expires: Thu, 22 May 2014 12:38:58 GMT
Cache-Control: max-age=2592000
Age: 1835202
Via: http/1.1 l2hk1 (ATS [cHs f ]), http/1.1 de1 (ATS [cRs f ])
Connection: keep-alive
FWS.;...p...........C....?..............................(.P.....\.....
-...$.............z./......-h.......ra.RP.N.....%]...P ..P [email protected].
.vm...)<..*...C.^..7.H.3...,..\.Y.....T!......&|}..?.|7%<[email protected].
.c4.)....c&....>F..=$.....o...2<.@ vWG.).Z5nQ.Y.............N...
m.l`...7W......r^.T...w$S}K........Cx..o.q..N...oP..-M$...nY6.-.V8..6.
.oz...f.qO......z...W......./.Y.............%....[.S....Y-.g..n.Z..-M.
G..pS.2..Wnk_.a...d....T....kns_$y...\wk.........mK.AD.\.U............
...-O....TnU......ry..w......a...Ol..-|.......`...F..`..nL.W.K..r..AZ.
.-d..wk....VC.......ot.yo..Gf.q.......z..IM..'........pQ..wz......-G..
.R...V.fy....}...~.Kn.6.wu%..........f......... [..is...n.F........yX.
.....r..V..W%..W<.'......-i*.c4Q)..][email protected].!-%/.......l..,AJDI.m
.,.a6..gw..,{.;r.5 ....m..\.~.6. *f..D-...\<.Q.4. a.Ore...gn.A[...s
.9/N.."K.jc,.V.....=.5. UygyJ.....PnW..-n'.....T.W...I....8.^)...?....
l\..l#...Tj..o5b.).].,m.x.....O.}......H..=... .W.v[.\../5m... eT....,
.4...|..Io...k9.........-h*.x..V)..nk....wn_9W6....0...W..<.H......
--.....)vh..[ ..0P\[email protected].....'?.h..-kN.x.-f.....a.xa.....
.n.....f.....?..wq......|S.&...~.........\7$....v....Y..>lX......-&
gt;..l.n"6d..[-..pPj...Y.....7.D..n..k...n.w?.d..-i.Jvd7....bo^...]..&
..n.....qo..w%`..S]..*..o>p_...a.h....oJ.*P...f....a..(u....H|(../.
$..Fl...2E.1y.\.d....Ei6J...(....= .:..@'2...}$_E...-f..w..U7j.^.f..w*
[......k..=.}.%..z.rS...m....z....s.\..e....q.....[..=.-......Sq...D..
F.S...MPQ.5..x........$8h.D...o..x).V.|&..q..^....-c>.u_l=o.#7.
<<< skipped >>>

GET /materials/original/2009-07-01/c92a22fae515eb6aac02112ae7b01585a15de84b.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 29 Apr 2014 03:22:16 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 898
Accept-Ranges: bytes
ETag: "BE109E5397784C00727497E3F14D7AAF"
Last-Modified: Wed, 30 Jan 2013 03:06:04 GMT
x-oss-request-id: 535A296D4C1BFA4626873429
Expires: Tue, 29 Apr 2014 05:13:53 GMT
Cache-Control: max-age=7200
Age: 1289
Via: http/1.1 l2hk1 (ATS [cHs f ]), http/1.1 de1 (ATS [cRs f ])
Connection: keep-alive
CWS.b...x.M..P.q....6....OB'.DC...g.bR~u..h.:.8.....]..G..........v.&l
t;k....!..u..*..P.z.............|............i..O.p.fQ...B.'...n#.B...
....j......@[email protected]../ ..gP..!....^.c....1...)-...8.......f._........
.G....M..g .....l.u..;._.[{[email protected]...
.Ak.....u.:......B:..Z.(\2z....T...S.....S.g8.^wT...b5 >........z._
CT..S.'.R...........1..,.B..S.f8..l..h0....~......_X..q_...>'.Ig...
 ....'n.A...<(..............pS..[...!E..G....%.....(....ns...9.....
.E.V..809<.......g......;...f.wI...[T!B...<...m3.y"...3O......;Q
.B#hy..W..c....K...}...O...S....[.x...............Jr.q...q^...7.]i.lx.
.g.h...j7.5....a....q#.d.pH....q....g....4.-.=!t...2LL.......?/XJ..Y.o
.$..C5_ZTJ.......$.^.V........s..........w...m.Y..^O..-...^N..o?...yR.
.......j..T...2..'.g.O..U.n.....3.r.:......{v......Y.z..Ru..O'..2.....
VK....A.u.1t./qs...l......X....K.'zGntY........)..-a.L...?...BQ6..)w..
.o...1....


GET /swf/2010-07-23/10-52/1fd62ab0397e4cc2d3af35700a98982c.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Mon, 21 Apr 2014 16:38:48 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 5402
Accept-Ranges: bytes
ETag: "64E1B537E0F64171A3601BDCDAEDE220"
Last-Modified: Mon, 11 Mar 2013 03:41:22 GMT
x-oss-request-id: 53554998C2DBB3F97CD3A784
Expires: Wed, 21 May 2014 16:38:48 GMT
Cache-Control: max-age=2592000
Age: 643408
Via: http/1.1 l2hk1 (ATS [cHs f ]), http/1.1 de1 (ATS [cRs f ])
Connection: keep-alive
FWS.....h...........C....?..........STXingkai....C.....`.....Z........
..-......>p.....eAt......._BIt#.NJ...h.P.._..-g..e\.Y.U.8.S........
NMr.V..*4(.........i...J...*.]f.........lYY...V4..$.fyV.'.B.`....%@4..
@!..KK.)}...E.0..4...|....nL..X.U.W`P...`.e....*.=..y.......KX.,.]%...
.@^..Q^[email protected][...H.rp.9?..(..[.t...u.Mn.i.\.......0..d........R.I.QJb
.......z...4..^$/...$!..2.9.&.*..Eb#.8..3....(.. / .^|..c....$D.....c.
.(.9.^`'.. .$.........-i..eHd.YO%`.V....d.tbGY...K.%..>.do..Jq.)rb.
.ZQ.m..%.\......Cg. 7e)....%.W....z@<g9L.KnbM..9.h....:.....9...m..
@,.....".(..%...iY.Q._6.]..w.rZ.._........h.J`..r.h.H..q.H\.l..$..JXP$
..z.q........|.Q.S.C......t]... J..32.2.lj..#.,............2.:.L..>
j.7.`H...........=!K`.A..!\Yu..RZ.v....NQ [email protected]..<...e.?.I.p.
$ rL...." .<.L<`.....*9.Y*-.6......p...3Tv17..?b.$P.D.~...4..r.)
5x..4..6. n$...l..A...\.4JSD.).....:....].....o.."\.-.....#.;[email protected]
.`V@5G..>..%=...mx..Hm....rP......>..w.....>..../c'X....dpb..
..zF.Ai.X.c......;............-ij.eY....@..%X..H..*;.@......%..D....^.
^.G.....K......,j.. ...J...R..gK.m..x...K....T.9I.P.$.M..G.rgP.....s..
.uI..] ..L.Rg....j.7.7PI...$.Z..#x.\..Gk.2....5......G...2.i..........
.......Kh].R.'P..b...[.....e..'.f..@l...@,H..m.*x.......o\.5&....M...y
 ..T.T(...LfJ. .!t..(. .F.... -....C*.NmK..(......^P......tg.........Q
 .f.........9Lg=FS.......@ .H.9.H...u...Q......*.R.*I...$.D......el.[h
. ....!.........?.r.|.d.M..t...Z........0......0......-k#e.<.g..~..
....Q.?...E/;5.N_.._. .q.s...#.ER.T.T....%.Q\.\F..6*5`..c...X.].-.
<<< skipped >>>

GET /materials/original/2009-06-28/3975a6d5f4815aa87e6a87b6c5fcfecc9946843d.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 29 Apr 2014 03:20:46 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 1466
Accept-Ranges: bytes
ETag: "A3AE69C55296983A69C605C90C587536"
Last-Modified: Wed, 30 Jan 2013 03:06:14 GMT
x-oss-request-id: 535CCA4311670A32081C2D23
Expires: Tue, 29 Apr 2014 05:18:40 GMT
Cache-Control: max-age=7200
Age: 5703
Via: http/1.1 l2hk1 (ATS [cHs f ]), http/1.1 de1 (ATS [cRs f ])
Connection: keep-alive
CWS.8...x.m.yP.G.........CBQ*.rE..B...#.RD.#.([email protected].@n.
.i.2........&A#.....?.;.........}......6`[email protected]"....L...CeB^Y..%.l
z%.....M.T?`.Cs.G.i.hh.......$J,h..\....).........T..PT..i..bI..t^...u
2.1..^O4..'].fY..o{(..,.ht..{...R......}.....a=..L.a. .:.X..dt>w.Y.
J;F%.q.vS7?m..gN.....(f.~...O..g<.8..5TA}...b..> ....... P....Ey
..%.c.O`..;.kxv.....c...\.ht.z.....\WK....1%}..x....'Q|..]|E..q.Cl.%? 
......4...e.@O*...]>.~...........s.y:....l..w*.A.._U..w7.].;.....Qs
z"x...oS [email protected]..)m.....PF.....|0..j [email protected]]...c.
.3.z...uNV..B.PB....vL..Z.s....T.2...h.1.m..`^k.3?..p8.p.._8eka...J.e.
<..p..........7.N....{..b..*...w9io..DL.>s.hD...X...Dm.`........
..7B.i.wC.|n......n[u...#.S#8.8G'%.I......y.C.Jb9...p.E4.B.0.B8.......
p.e.D..8...X...r.l.:/hF...hFFo......?4.......$*.`9fV..q3...h!`.G.U....
V.~.q..@ ..aUN3?.t..L.*....vU`... ....>.......BT...7.....a;..G..!6.
V.....v..49hB.!.....f.BV..v....M....).m...m..!.../...w.....6..MSC..Z8.
...b..Sg..z.h.-.....k.v.......:....w&\F..<'...r....Bd..FR.....(.o.h
.P.N..m..Z..."o...l........M..2.o|..3]R~r...d...^OTJ..(%..".n...Odm ..
.>i..UPe.n.."]...h..'y.....K.c.z...J.......Q.... =..W..T......t.W[.
0.:..@bd .0..N?~.Y....r.".....@B..,...M. q.f......4.-..:..d.^....c.e..
...A.....lQ~..x_..KT....k.`.....h.M.-...eO.U. e...$.,...J.....0...s.K.
[...o..w:....IY7.......U...:.....*..U.l..Kyg.>.pD...H......2.l... n
jpq..O.k..........&^]B...K[...'[email protected]......$
.....<U8T<..o.!4..w...... ..
<<< skipped >>>


GET /api.php?mod=js&bid=70 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:22 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=70";</script>........
........6.......y{...



GET /api.php?mod=js&bid=71 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:23 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=71";</script>........
....H................



GET /qqav/news.htm HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Tue, 29 Apr 2014 03:22:09 GMT
Content-Length: 1308
Content-Type: text/html
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><
<<< skipped >>>


GET /h.js?aa34293d67c95b9ea9e7201a9150b74a HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Etag: 8159837d8b3f17cd00e36ee5817d98f5
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Type: application/javascript
Connection: Keep-Alive
Content-Length: 6002
Date: Tue, 29 Apr 2014 03:22:28 GMT
Server: apache
...............(function(){var c={id:"aa34293d67c95b9ea9e7201a9150b74a
",dm:["hackbase.com"],etrk:[],js:"tongji.baidu.com/hm-web/js/",icon:'&
#32593;站统计|txt|0|0',br:false,ctrk:false,align:-1,
nv:-1,vdur:1800000,age:31536000000,rec:0,rp:0,rs:0,trust:0,vcard:0,.;k
{..... .6.Kf-.v..y...I.&i.&.i.&yV..2B.......g.".....cV{.....n3.......a
[email protected],2......(.xBi8.CA.a .:.)......xF.....sz...%....wL..I
2....s@[. .&,........."[e.,...}3.S=....w.N..)=..abP...t...%.^.=...i..9
..... C..d.@#.3.%?.%.%..8-...f.....=.3cu...t2.B..=E.3.p....U...4K<.
"..?*AI.".6,X&3.{I....*OY .........Et..CA._9.....*..k.....EN.D.@C.....
.\...S*.)7....%...).r.. ...f.......................1..#....iz.J.1..kw.
.Z..[4f.,.....eg......$..;[email protected]#..k{......
......n8.<;..,.k........$..s.v.....Z....#g.%Ijy.......<.~Z.....l
..m....4x.....x.....z.......F..vG.<...=B.U..96c...9...6S.L..=:.WW..
:.d'..5.....}.-...Y.r*.A.:|..........HG...q..x6.Dj.ka.*..\...>|`w.2
...dw....=.%I$x\....=......L..c.f.....0.r..x..i......#=..c.8........N.
..n.Z..|....[.`..0.SM...J..C=.=..q..O/.|..|G...........n........f.O../
.u...!.z.\.<.v)E.3.. ..?`k,.A.H..d..$.G........]..._..g..S....(.V.'
.'q {asw...#}I.1 .R..~....;.4....3...E.1....K..Qd.tl.z.........].w....
.....Q...MG..cu...m...uI.QI...T......S...].p...1|y;...eU_]]uW?....Alf.
......V}.....R..-....~'..?/..L..^j...k......j^5....F.A7m..{....9.....:
1.......H..uy.o.H..E.....D....<I.g.y...9....\L.../........b.v....&l
t;4....L9..h../....[2P..A%J....$...A9.@. .g......q(.o..L........qk
<<< skipped >>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=633043539&si=aa34293d67c95b9ea9e7201a9150b74a&st=1&v=1.0.57&lv=1&tt=黑基网 - 中国领先的IT安全技术门户 软件•人才•社区 [9:43] HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Pragma: no-cache
Content-Type: image/gif
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 43
Date: Tue, 29 Apr 2014 03:22:28 GMT
Server: apache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Pragma: no-cache..Content-Type: ima
ge/gif..X-Content-Type-Options: nosniff..Connection: Keep-Alive..Conte
nt-Length: 43..Date: Tue, 29 Apr 2014 03:22:28 GMT..Server: apache..GI
F89a.............!.......,...........L..;..



GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:08 GMT
Content-Type: text/html
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
<script language="javascript">document.cookie = "weidunkey=28f8b
9101c8aa86b17e0e70689a80d19";window.location = "/index.html";</scri
pt>._1.html";</script>.&commenHTTP/1.1 500 Internal Server Er
ror..Connection: close..Date: Tue, 29 Apr 2014 03:22:08 GMT..Content-L
ength: 73..Content-Type: text/html..X-Powered-By: ASP.NET..Firewall: w
ww.weidun.com.cn..Server: WeiDun IIS Firewall..<html><head>
;<title>Error</title></head><body>............
..</body></html>..



GET /materials/original/2009-07-01/c92a22fae515eb6aac02112ae7b01585a15de84b.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 29 Apr 2014 03:22:16 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 898
Accept-Ranges: bytes
ETag: "BE109E5397784C00727497E3F14D7AAF"
Last-Modified: Wed, 30 Jan 2013 03:06:04 GMT
x-oss-request-id: 535A296D4C1BFA4626873429
Expires: Tue, 29 Apr 2014 05:13:53 GMT
Cache-Control: max-age=7200
Age: 1289
Via: http/1.1 l2hk1 (ATS [cHs f ]), http/1.1 de1 (ATS [cSsNfU])
Connection: keep-alive
CWS.b...x.M..P.q....6....OB'.DC...g.bR~u..h.:.8.....]..G..........v.&l
t;k....!..u..*..P.z.............|............i..O.p.fQ...B.'...n#.B...
....j......@[email protected]../ ..gP..!....^.c....1...)-...8.......f._........
.G....M..g .....l.u..;._.[{[email protected]...
.Ak.....u.:......B:..Z.(\2z....T...S.....S.g8.^wT...b5 >........z._
CT..S.'.R...........1..,.B..S.f8..l..h0....~......_X..q_...>'.Ig...
 ....'n.A...<(..............pS..[...!E..G....%.....(....ns...9.....
.E.V..809<.......g......;...f.wI...[T!B...<...m3.y"...3O......;Q
.B#hy..W..c....K...}...O...S....[.x...............Jr.q...q^...7.]i.lx.
.g.h...j7.5....a....q#.d.pH....q....g....4.-.=!t...2LL.......?/XJ..Y.o
.$..C5_ZTJ.......$.^.V........s..........w...m.Y..^O..-...^N..o?...yR.
.......j..T...2..'.g.O..U.n.....3.r.:......{v......Y.z..Ru..O'..2.....
VK....A.u.1t./qs...l......X....K.'zGntY........)..-a.L...?...BQ6..)w..
.o...1....


GET /materials/original/2009-06-28/a68216ea44e13fd1c5c948384e7bb1b74279bfe5.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://img.uu1001.cn/bcv1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.uu1001.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ATS/3.2.0
Date: Tue, 29 Apr 2014 03:22:16 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 1492
Accept-Ranges: bytes
ETag: "FB30988FF5D98791DBD948285196FB6E"
Last-Modified: Wed, 30 Jan 2013 03:06:13 GMT
x-oss-request-id: 535986564C1BFA4626F853EE
Expires: Tue, 29 Apr 2014 05:02:32 GMT
Cache-Control: max-age=7200
Age: 1
Via: http/1.1 l2hk1 (ATS [cRs f ]), http/1.1 de1 (ATS [cSsNfU])
Connection: keep-alive
CWS. ...x.E.{4.i...!.dv.F...a1j.Kd...C..$.....RrKGYbs"r.F...&.dU......
Dr.e.....~;...}.x..y.s..y..!....W........A.d*.$pa..Ca.....D%...R....7.
...H.....S..=......;.{..4..)i.Y..f..0Q.!su*}.t.`.....|...!......rCD.C.
..H...^.(.X....w.j.J<...[h.......E?ab..y=.X..A.%..Rg.......O.7.e.5.
.}r......*.....f..y..........2...ggg.XZZB.....4.............J...CW..).
..|tN......._.I..1.!W.SN&...hL...i.$].j..V k]M.0,.J...5T:6W'....._..@.
....H$.....>.{.{....,......{.........U.l..\..z..g.[.5_........@}}..
.~~~..^....../T!022.A!!!..A..Y.......=u....[`r..V.l.).F...?...>....
Kh......C^ls..p.....P.7o.6.A......W...~i5$..3..m.....WC..k...1...Z...m
.(.1....8...'_.X.(7f$.X.&........N..Pu..*5.0..7.l..#...U..<........
.....nd.........:}......$....}hX6...e[...Mf.j... .V...........yC...4..
.....mf....y.d.....D./ .=..E.\..N.p..c./)b.O.Pe.P;'...'..!c.sZ.h....nZ
g.C..g....(..J.........\...Z..F....S..q....Bk.Z....UB...e.X.ohM.Ii&bD.
......Q.......4q._.Q..h....v......o>...X/.V.....![......I.z..g.CmS.
6{........!h.3.z..H.. .`.aN.\\.......iH..w....].%z8.......QV>.....q
$'.......v.`R..!.Xj..D.[.>.5Ij..}~.....y..5>.t......X...Bqt.Iwq.
[email protected]...;...K9*.3..u..|....y.I=...S!.{|?.H.Z.>yR~.
|vhojh.A_uk..'...N.\OZkAdZN.............W..^...r.....1K.N.....?.h!....
..2j].jr.....7 .BYa.&.4...4....E.....|(.........P...fmW...........=..8
`....X.6..>ni.].E....X..c......h`..Iw]f....:..n#.v...G.Yq.O....w.u.
.d.`Y^...../.H.?....>.L....1.m.B>.H....RXN..~.........q.........
..HxWF............?.F.8`*,$... }.....3].(.(.......?...l..x..
<<< skipped >>>


GET /api.php?mod=js&bid=75 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bbs.hackbase.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:27 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html
<script language="javascript">document.cookie = "hkbscid=4292651
76";window.location = "/api.php?mod=js&bid=75";</script>........
....H................



GET /index.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:09 GMT
Content-Length: 126530
Content-Type: text/html
Last-Modified: Tue, 29 Apr 2014 01:43:28 GMT
Accept-Ranges: bytes
ETag: "5ab54a6b4c63cf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<!-- Las
tUpdate: 2014-04-29 09:43:27 -->..<html xmlns="hXXp://VVV.w3.org
/1999/xhtml" lang="zh-CN">..<head>..<meta http-equiv="Cont
ent-Type" content="text/html; charset=gb2312" />..<title>....
.. - ..........IT............ ....•....•.... [9:43]</ti
tle>..<meta content="all" name="robots" />..<meta name="Co
pyright" content="..........,........" />..<meta name="keywords"
 content=".... hackbase ...... heiji heike IT.... ........ ........ ..
...... ........ ........ ........ ...... ........ ........ ........"&g
t;..<meta name="description" content="....................IT.......
.............................................................IT.......
....... - hackbase heiji..">..<link href="/favicon.ico" rel="sho
rtcut icon">..<link rel="stylesheet" href="/style/css.css" type=
"text/css" media="all"/>..<link rel="stylesheet" href="/style/in
dex.css" type="text/css" media="all"/>..<script language="javasc
ript" src="/data/js/config.js"></script>..<script language
="javascript" src="/include/js/common.js"></script>..<scri
pt language="javascript" src="/include/js/prototype.js"></script
>..<base target="_blank">..</head>..<BODY>....<
;div id="main">..<div id="top">..<span class="f_l">..&l
t;!-- <script language="javascript" src="/member/login.php?acti
<<< skipped >>>

GET /vip/topbanner.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/topbanner.html
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:18 GMT
Content-Length: 2995
Content-Type: application/x-shockwave-flash
Last-Modified: Fri, 23 Jul 2010 10:44:10 GMT
Accept-Ranges: bytes
ETag: "16fb2fb532acb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
FWS.....x............C..............?.z........bc._root.....*.......Sy
stem......security.N....allowDomain.R...........bannerXML..<?xml ve
rsion="1.0" encoding="utf-8"?><banner bg="," link="http://
vip.hackbase.com" size="710x67" version="1.0" border="30000,0,3,0,
50" dataSource="1," bmds="" bmdschanged="0" sds=""><frame edata=
"" data="1,5000"><e type="img" data="1,materials/original/2008-1
2-06/ac4f3526441feb390f07012b7867f7a7cc4f8fd6.swf,1323.6,120,0,651,42,
100,100,100,,0,8,,,2" edata="5000," /><e type="sTxt" data="2,é
»‘基国际认证中心,
凌心体.ttf,444444,24,no_effect,swf/2010-07-23/1
0-05/0f1fcc8116f02f3798b2c29eafec71cd.swf,206.3755,20.349,0,133,25,100
,100,100,0xFEF93D,10,http://vip.hackbase.com,201007231011408
93977,2" edata="5000," /><e type="txt" data="3,ä¿¡æ%A
F            专家,黑ä%B
D“,444444,14,1,0,0,2,118,24,0,638,29,100,0xFCFCFC,5,," edata="5000,"
 /><e type="img" data="4,materials/original/2009-07-01/c92a22fae
515eb6aac02112ae7b01585a15de84b.swf,84,75.32,-13,34,25,100,100,100,0x0
00000,0,8,,,2" edata="5000," /><e type="txt" data="5,安%E
5…¨,黑体,444444,23,1,0,0,1,235,35,0,729,28,100,0xFFD
85C,5,," edata="5000," /><e type="img" data="6,materials/origina
l/2009-06-28/a68216ea44e13fd1c5c948384e7bb1b74279bfe5.swf,136.7695,112
.056,-87,656,30,100,100,100,,0,8,http://vip.hackbase.com
<<< skipped >>>

GET /images/focus.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/index.html
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:18 GMT
Content-Length: 9472
Content-Type: application/x-shockwave-flash
Last-Modified: Fri, 21 Dec 2007 04:04:52 GMT
Accept-Ranges: bytes
ETag: "0ca8a38643c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
CWS.4...x..].t..y.3.;;.j...-....l...6.m...c... .6b%...W.BZY6I.I..&....
.......CL)....C...7I...i8!4..$.4&.I(...s.....-...2.............i.E..r.
.R...fujj.FChN...t.i.....N......'.?.b...U.h....*h..=..^..........A...K
A;...).3..%..Rs..L......z..M.. B..G4M............1?@*r..h2.........:P.
@.i|$...AS...B=h.......iM...t.p...b.....@..[.A..|NyN...:......]w....:Q
....j....p....v..Q..Q ..RT......../.Ot..../..?sO...Nl.....aig.-.....~&
lt;....._......q...O..<....;..G.5.......w........;'..............X.
..'_.....?:..u.$4J.E......!tf.........._..M..zD.............o.........
H.Ol.?...?.._........C(..........qu_){.=....z....>.y..p...5.v<T.
...........;.^....OL..............u......._).<..Db...q...DK.A..'...
o`.p.............RN....6...;..s......?......|..5.eh9Z.V.U .5h-.9......
.d.~.........w6f...4.V.....[^i-x....<.FL/:...h...h/[email protected]
=.K...&... W,...G m.....)/ ..x........../.bu.a4.........C.S.|....Z.M_.
..J.!......J..(4V..`"z(......{.QG.......W.....aH.G./.N]...:...I...I...
N.F.....F`.........U.......=..........Mx"@.....R....-....Bj........?q.
.nl.].Q..O.I"...2..!R\t.i..n .9..3w.kr..$...][email protected]
w._?...E8..i..2.BG[[email protected]....=...q....2`..\U.
.tT.T`G.Z{.V..N.*~....5.?N..D......Q.H:.J6.)..(....V."*....<......l
Y..R(J.".6.N,....C.v......".|...E`wb......y.....#Tb..n."..d.6d.,.B&.eL
TA.*U.....*."*....xf.R3...*..).O..r.DVE....=..s..1,.b...f...3....j9.U.
..^6DU.ET.........,.....*.RgQ..".2..s......TT...w.. .*.....U.........%
...C^UY.......L^ngy....VyU...w.,...PyU...A^..q..[3.`hZ..f.Z.dU.e..
<<< skipped >>>

GET /style/images/search.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:19 GMT
Content-Length: 1210
Content-Type: image/gif
Last-Modified: Tue, 20 Jul 2010 09:27:35 GMT
Accept-Ranges: bytes
ETag: "a0c96cc9ed27cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.........Q..D..Cv.2r.,..?..]..Q..Dv.2..H`. s.,..J}.9..^L..f.-e. 
..Fx.<X. ..>r. q. ..D.....Fr. .....d..D9U.f.'S.'{z|y.6...`_`T...
..k.2w.3..C..C.........4j...P...u.1..K.....@.._..^...^.&\.!6n.c.4..Jlo
hCV0a. ..b..N0:%..GV....w...z.9.....@]........W.#...c.$u.1X....aX.-M..
5k......D..VU~.Z."-4&h.IR..;\.O..Q....=v.1l..Lc7|z}..Qh.*..~..Q.....LD
`).....R..I..JIs....p.*..ET."..y...e.&v.5M....Mx.3p.3y.2d.$...U{2x.>
;}.9_........a.2........At.7q.[..F.....|o.*F....@|z|5j....M........TST
=[...a..[..m...|.8{z{u.1..I...d.%.....}Y.07j...].....N................
......................................................................
......................................................................
......................................................................
....................!.......,............_..H.....4q..C....#>......
D.(aS.... C.B..I"[email protected].&...w.e......P..8.A 
.O.......W...Q. ....8..Z.....m....'[email protected]...|....a.!.a0H.5......Cn&
lt;......\`@......z......u..<.H.....$x= . ..i..3#.@#.....j.q...#w@.
...K(...wm.......G ..Y..........Y.7?>..F.u4h@.~}....'...."...C.C.b.
..&.`.4.". }.q....0!..b.!.kh!G.....'..b..(.x...L..@]......h..8....Ax!.
.@l1E*D.i..EV!.#?....gT"..TVi..#4..!....;....


GET /uploadfile/200806/20080602030123852.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:19 GMT
Content-Length: 21362
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:11:07 GMT
Accept-Ranges: bytes
ETag: "80df9a25d3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a,.......<~"Q:.Rx.vT.bh7[I/kM5.ZLr_.=..F. M.!M.&S..[.*W./Y.2].
*X.*g..u.3m.:c.;o.;g.Dj.Gt.Am.Lq.Kw.Ux.]~.Q}...5.....&..C8.c>.p...D
.eC.kL.sT.kX.rZ.yJ.|f.xz.ou.|9..8..I..\..\..N..X..k..d..j..p..s..t..x.
.e..e..k..u..~..{..g..Z..g..i..t..|..I..K..N..V..P..[..T..P..T..[..[..
^..^..e..g..b..`..m..u..v..e..g..z..t..w..}..b..i..n..u..y..|...V<.
oN.8'................*..,%.9-.<4.  .0..?=.J<.XI.qX.ve.NJ.b\.{y..
[..p.._..v..j..U..b..L..H..v..D.......................................
......................................................................
......................................................................
......................................................................
......................................................................
..........................!.......,....,..........H._A|.............G.
....'....a......GO........2^;......N]:..r.,..g.........7o..:c...2f..".
.lX.aX...*...__.........z.Z..U,Wp...;W...xQ..K.._.kH..LxM.....F...c4g.
..L...3.3k.l....T.P.M...)...^[email protected]|..6E...m.=..G..]........a..YS..r
.z..*n(...."U.......&.......`..=.^-..n...K_.*.wQ....oa.i.!...5..c.Q..e
......~&.gWPq....VZj....k....l.ed....F.B"[email protected],...r5...N...S8.Tg.v
G).....7.x..w.Wa.WV{i...[..B.}..e.^..rJ)....`..aX..2..d.-x.fs..Yg\\aE.
......r.!k....B$.....I..o"..cI..Dcr7....<J..PB.e.vKu..x.!sU.OF)e{fU
..^.r....y...^d......f....).....F..A...V\....v6Z...6..S81.j..&.C....D.
]..=.Pt..,.&iI.Vzi.0i..s;y....a..5.....S.C.1...*Y..j%..m..]...f_c.._`.
.A.b.!f...ff.fV`1....va..v...Qx(.>..1.=..!......nx...mz..N..p..
<<< skipped >>>

GET /images/flashclick.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/vip/topbanner.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:21 GMT
Content-Length: 1160
Content-Type: image/gif
Last-Modified: Mon, 30 Aug 2010 12:02:14 GMT
Accept-Ranges: bytes
ETag: "067f2f3b48cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..C.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,......C........H......*\......#J.H.....3j...... C.
.I....(S.\[email protected].*].....P.J.J....X.j......`
...K....h..].....p...K....x............L...... ^......#K.L.....3k.....
..C..M.....S.^......c..M.....s...........N...... _.......K.N......k...
......e.O......._.........O...............(....h...&....6....F(...Vh..
.f....v... .(..$.h..(....,....0.(..$...;....


GET /images/titlebg.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:21 GMT
Content-Length: 677
Content-Type: image/jpeg
Last-Modified: Mon, 26 Jul 2010 15:49:39 GMT
Accept-Ranges: bytes
ETag: "80eba727da2ccb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....`.`......Exif..II*..............C......................
............. $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222
222222222222222222222222222222222222222222222...........".............
...............................................}........!1A..Qa."q.2..
..#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...
......................................................................
.....................................................w.......!1..AQ.aq
."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuv
wxyz..................................................................
..................?..<...........O.........lp.F.......


GET /vip/chaxun.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:22 GMT
Content-Length: 1394
Content-Type: image/gif
Last-Modified: Sun, 26 Sep 2010 10:02:18 GMT
Accept-Ranges: bytes
ETag: "03110e7615dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.......................  .%%.((.<<.@@.QQ.cc.tt............
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.................,...............H......*\......#J.80....3j...... C..I
....&S.4.a...-1p.p....8O........2Hp@.....'.0`...................%...,.
.P!.A.I.f........ ..`,...,JP.`...`.z..u...-'Dp.R.P.}.;..T.......8W.R..
...9xtN.4/*[email protected]....../F......@O.:..a
.m?..t ..J......v..... Ek.....0.%[email protected].^q....h....lz...u.)p.g..
u.[.<eQ~..._..)..z&..Z.{Q.Vk.....t....".Eb.#..#Ic.....B...:.h..L:E.
.....|..xb.V.4...A...!. c.[.gWFA.)f.Yv.c.......u9.\.A'Avb.fTQ.Y...r.V.
.pr....z..s.....}..T..f..fQ=..^...h..$0jG.....i.e.Q.fW.._.y.A...).....
kOw.&......E.4....6....F ....K...R0...v.....k....:.E............ .....
..;....
<<< skipped >>>

GET /uploadfile/201311/20131126084733851.jpg HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:22 GMT
Content-Length: 40926
Content-Type: image/jpeg
Last-Modified: Tue, 26 Nov 2013 12:47:33 GMT
Accept-Ranges: bytes
ETag: "d077ffaca5eace1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
.... .Exif..MM.*.............................b...........j.(..........
.1..... ...r.2...........i....................'.......'.Adobe Photosho
p CS6 (Macintosh).2013:11:26 07:45:04.................................
.......6..............................."...........*.(................
.....2...................H.......H..........Adobe_CM......Adobe.d.....
......................................................................
......................................................................
..|.."................?...............................................
...........................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S..
.cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw......
..................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5
..D.T..dEU6te......u..F...............Vfv........'7GWgw...............
..?..T.I%)$.IJLJu....v>..k.o".4...cM.6....}..7........H............
6VH{hix..I..~.............q.1..........c~...-...Y.V8.... ......i....W.
.1..}L..6.....3.E....88...n..^.M.pk..........S.....e.z...u.<@]....?
....I......n..H...>..5*2.rAv=.......?.%e.t.Ln...m.:.s.`.sm/x.u~....
k......}K=?...=3.'.e.67.X.......m.;..H.V.F..,..nC]~.K.[1.-..s..n..5..U
._U...l.?.....HXA]$.EJI$.S...T...VUx....9.2......*...;..........!.....
 /..u...T...1K....o.~FC}......m...r4.S.w4..gaP...]N#v...0t.....0s\$...
.y..Xz...c..FX.......6....w.v...}.W... .......W..E....^.M...]....^.z.y
>..Y.._...q.1.p.|4X3.....K.S..W~0......8.x.Wm%...T.zn..M.)......X..
K.^..ls..m..Q.... .)..,..JgJ...52.5...n...{.....V...._...W........
<<< skipped >>>

GET /uploadfile/news/uploadfile/201311/20131126102515224.jpg HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:24 GMT
Content-Length: 19360
Content-Type: image/jpeg
Last-Modified: Tue, 26 Nov 2013 02:25:15 GMT
Accept-Ranges: bytes
ETag: "92badcbd4eeace1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....d.d......Ducky.............!Adobe.d.................. N
..K...........................................#%'%#.//33//@@@@@@@@@@@@
@@@......................&.....&0#....#0 .'''. 550055@@?@@@@@@@@@@@@..
......M.."............................................................
.........................!. [email protected].."#P`B$%&....................
...!1..A.Qaq".....2.s.0..Br#.t @.Rb..3.4....C...Sc..5..`.$d.Uu........
[email protected] p."`.BRr......................................
............X.......3.X...9.e".......bW._\...d...u..............O.....
.^Ft<v..p.....<__Qo..{>W.%.W..l1....<...q.k..,...s........
.......I.Y..f.\.q&C..|..?.^k.:..g....|......eH.x|..B.y~..9z@ .........
.......8..W..a.......X.>....du......'...^k..@...=?7..c.....}.......
.........<..=_:...;....d?O........#..|..MVw..9gY..i.....=/..G...y..
......... .^.BX.U..I.>y.^..C..d.....n{y<.....4:.w=./....o.//....
#..w........./H...t.X......a.7.... &.F..eux..}.L..M.h.'.3.SY.......=./
...Y......3..c......E.Z.. Z........w..."<._o..1..p...h`......$.=.#.
...%...q.&Y..|.Z.V.u...U.O|.%......k. ..>w.#W....~g..........5.'..i
.5~e..d...^....y.vM3.s...cU..xm.&7~U..>mn....>AV....AA..k....e..
....t...."<._o..1..q~.......^.y..$.U.......^..VW3g.>......A..8-.
....K...]..N...s(.;.....%..Sj...L=*..z.."..}c.S...'.kW9.~n.a.........C
.ZG.V..b$.....^...\.=.....W^.g..2$.T.U...CP...............5...1_wM.X/Q
....ZEB.........dy.....|....... ............nG....../M..mV...I....^...
6..h..L.?P<...QX...,....0...7.W..{.`w..........np..)o..S...J9..
<<< skipped >>>

GET /uploadfile/news/uploadfile/201311/20131126115121831.jpg HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/images/focus.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:27 GMT
Content-Length: 46166
Content-Type: image/jpeg
Last-Modified: Tue, 26 Nov 2013 03:51:21 GMT
Accept-Ranges: bytes
ETag: "ee5e64c55aeace1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 95....C.......................................................
.............C........................................................
.................&..".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?...O.*.}.U.h>L
...>..5.QZ.....N.._..[..z}.KH.tR..3.... C0.*:t_~....QE.q3..?.Zb}.N.
=.k.9.E.U...QEhb....Sh...~..6....um.).N..#..O..a..QA.QE.Q..~......U...
.D.|.....M'....2k.....</.-..A.O.Xh..&./. ...?.n.....W.......|..8x..
/...-4=.I6%.....G......._...-.T.p..<y.....8..o.]..........!........
...g?..._..q.....r.......|$..N......}...M.y?..{... .O.&........gM..]..
v.....q..O...9.I...}.#......'.O.~$.\.O..Y...H...m..........uQ.Nc.)..1.
SCq..F*.2W...F..(G.?n..Z..."-.-.c.[...~....?sr.......[I<...~>.*t
.j..*T.....QNN...:.(..P.. ......(...k..)....V.6.w..M....~4......Se...(
....QET@l..'.....D..x.....Y..*J......:...t.c.?..._.O..i...S...QA.[a.."
}......W.Q...............1....S.....WTI..?.Z...tV.2....7..)....@.(....
....{Si._.\H..)...V.C...ZD....0.. C0.'_..NN..m...QM.C.NN.DHk..)... A..
.......3..1...M-#.sZ..l........<.%S.....?O..\}.p2.. ...$.\.5.K.
<<< skipped >>>

GET /2010/vip222.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:30 GMT
Content-Length: 5302
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:18:45 GMT
Accept-Ranges: bytes
ETag: "803864f93145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f.......%%%<<<"7zQQQcccjj~sst.8..A..B..J..R..T..\..e.
#O.0C.2T.1b..\..d..k..p..l..v..x..f..y..x..u.$}.U\.E^.Sj.\f.ab.gg.|{.u
u.kn.hw.~|.M}......./..)..G.._.cR..c..u.&........................*..3.
.>[email protected]..[..I..K..N..Z..\..\..
i..m..}..q..c..i..l..h..s..x..u..{..o......HH.ss.tt..*........4..g..J.
.w..F..S..b..j........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................,......f........H......*\......#J.H.....3j.....
. C..I....(S.\[email protected].*].....P.J.J....X.j...
...`...)..T....}.....K...K..\.Ck..#.(-1.z...W.a..j..[..^.C....s...?...
.....e....Y...?O..,.rP.b~...{....c.....d{...&..._....T...N..m7..[....u
fg..r.../....3w.....d......a..Cx.u..wn.}.;..A.g.rDq'.`..e.^..c.e..g.ev
.$...H.Sh....N.......U.o.5.`.."W]r....G....:...N;5...<.6..|.....=q.
..=.......Wv....r...Q;.d"I.u.q..yH../....9.....G.......X.F...bs..a}..g
..#j4.0y.`G"....*..r.). b. .p..:....Ap..^c....s.....}....U..u.<..@.
%.p#. ..b.)`....`.2H&..C.8. T..q.c.b..f.N....cL.. ctN..v.Rv.&'.!.8... 
._|...Y.[/.\taH&..#.5.......V.aX..]O..G.....a_.Q.pv.#W.;t...........[.
.(7.r.RP.E".h3.4..5p........R\...Ln.....j.......C.. ....'....X/...
<<< skipped >>>

GET /2010/vip222.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:31 GMT
Content-Length: 5302
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:18:45 GMT
Accept-Ranges: bytes
ETag: "803864f93145cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f.......%%%<<<"7zQQQcccjj~sst.8..A..B..J..R..T..\..e.
#O.0C.2T.1b..\..d..k..p..l..v..x..f..y..x..u.$}.U\.E^.Sj.\f.ab.gg.|{.u
u.kn.hw.~|.M}......./..)..G.._.cR..c..u.&........................*..3.
.>[email protected]..[..I..K..N..Z..\..\..
i..m..}..q..c..i..l..h..s..x..u..{..o......HH.ss.tt..*........4..g..J.
.w..F..S..b..j........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......................,......f........H......*\......#J.H.....3j.....
. C..I....(S.\[email protected].*].....P.J.J....X.j...
...`...)..T....}.....K...K..\.Ck..#.(-1.z...W.a..j..[..^.C....s...?...
.....e....Y...?O..,.rP.b~...{....c.....d{...&..._....T...N..m7..[....u
fg..r.../....3w.....d......a..Cx.u..wn.}.;..A.g.rDq'.`..e.^..c.e..g.ev
.$...H.Sh....N.......U.o.5.`.."W]r....G....:...N;5...<.6..|.....=q.
..=.......Wv....r...Q;.d"I.u.q..yH../....9.....G.......X.F...bs..a}..g
..#j4.0y.`G"....*..r.). b. .p..:....Ap..^c....s.....}....U..u.<..@.
%.p#. ..b.)`....`.2H&..C.8. T..q.c.b..f.N....cL.. ctN..v.Rv.&'.!.8... 
._|...Y.[/.\taH&..#.5.......V.aX..]O..G.....a_.Q.pv.#W.;t...........[.
.(7.r.RP.E".h3.4..5p........R\...Ln.....j.......C.. ....'....X/...
<<< skipped >>>

GET /2010/vip333.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:31 GMT
Content-Length: 6272
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:19:03 GMT
Accept-Ranges: bytes
ETag: "80cd1e43245cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........///.3x%/j%1k%7u58l1<s._..p.,x.6r3-A}5C{-aYA>p
QQQCHxDuHjjj.7..<.!>..F..O..a..`..e.'E.&J.-P.(S.5I.>S.7W.&Y.%
].4].8`.,e.&h.)p.:f.7k.9v..\..k.%i.&x.%{.9w.=..GM.JS.FY.VX.V\.Gc.^b.Vd
.Hi.Kv.Gz.Yk.Uw.X}.a^.gk.jk.is.mt.po....vw.ht.b{.y{.B{.P|.7..G..T.)V..
Y."k..i.-Y.Uj.Wq.it.N}.my........)..)..:..6..;..,..&..4..7.....8..?..I
..G..^..T..z..u..J..C..F..V..Q..Y..W..G..T..[[email protected].
.d..i..e..s..|..h..e..|..w..e..a..h..e..q..u..x..[..e..f..j..z......%%
.<<.QQ.cc.tt.....U..w.....*../..1..R............................
......................................................................
......................................................................
......................................................................
................................!.......,......f........H......*\.....
.#J.H.....3j...... C..I....(S.\[email protected].*]...
..P.J.J....X.j......`...Y.lEz.....I..k.4i.tM..M.*^..I..v..m..P....2.cG
o-.l..j.K9..z.0a.../&v..5f.Ms.......Ip.......8...o.....3g...;n.Is..s.f
..9.mm....].xj...K~.]z....o..60...r......&...........3 ...>fl.)$.kn
ub`'ii..t...I6....'..F.m.a.I;..........$...Er...\..U._....b.pB.&..S\e.
abcB.l..|....A...\..]..fs.s.f...b<W....\b..;.T.dg..T.x.]S..>.v.a
.-..&.h..dHb..io.U....).\.m.f....N8....,....0..S.....aD.qB....F.'~....
..)$zL>$.q|..)...iba=.`rM6....b...e<..rJ.M.../.."L....J*...... .
Pi...c..\.Yzd...p..*....HaAve.c....Y.>.. EXjY./J(..3..cM5.0.L2.,..2
..".*..c....#.BO..]&...fA.. ..M..cb....q..EP...,j=..w.5...Il.]Y.*E
<<< skipped >>>

GET /2010/vip333.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:32 GMT
Content-Length: 6272
Content-Type: image/gif
Last-Modified: Thu, 26 Aug 2010 15:19:03 GMT
Accept-Ranges: bytes
ETag: "80cd1e43245cb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..........///.3x%/j%1k%7u58l1<s._..p.,x.6r3-A}5C{-aYA>p
QQQCHxDuHjjj.7..<.!>..F..O..a..`..e.'E.&J.-P.(S.5I.>S.7W.&Y.%
].4].8`.,e.&h.)p.:f.7k.9v..\..k.%i.&x.%{.9w.=..GM.JS.FY.VX.V\.Gc.^b.Vd
.Hi.Kv.Gz.Yk.Uw.X}.a^.gk.jk.is.mt.po....vw.ht.b{.y{.B{.P|.7..G..T.)V..
Y."k..i.-Y.Uj.Wq.it.N}.my........)..)..:..6..;..,..&..4..7.....8..?..I
..G..^..T..z..u..J..C..F..V..Q..Y..W..G..T..[[email protected].
.d..i..e..s..|..h..e..|..w..e..a..h..e..q..u..x..[..e..f..j..z......%%
.<<.QQ.cc.tt.....U..w.....*../..1..R............................
......................................................................
......................................................................
......................................................................
................................!.......,......f........H......*\.....
.#J.H.....3j...... C..I....(S.\[email protected].*]...
..P.J.J....X.j......`...Y.lEz.....I..k.4i.tM..M.*^..I..v..m..P....2.cG
o-.l..j.K9..z.0a.../&v..5f.Ms.......Ip.......8...o.....3g...;n.Is..s.f
..9.mm....].xj...K~.]z....o..60...r......&...........3 ...>fl.)$.kn
ub`'ii..t...I6....'..F.m.a.I;..........$...Er...\..U._....b.pB.&..S\e.
abcB.l..|....A...\..]..fs.s.f...b<W....\b..;.T.dg..T.x.]S..>.v.a
.-..&.h..dHb..io.U....).\.m.f....N8....,....0..S.....aD.qB....F.'~....
..)$zL>$.q|..)...iba=.`rM6....b...e<..rJ.M.../.."L....J*...... .
Pi...c..\.Yzd...p..*....HaAve.c....Y.>.. EXjY./J(..3..cM5.0.L2.,..2
..".*..c....#.BO..]&...fA.. ..M..cb....q..EP...,j=..w.5...Il.]Y.*E
<<< skipped >>>

GET /2010/vip444.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:32 GMT
Content-Length: 4768
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:02:56 GMT
Accept-Ranges: bytes
ETag: "038617d5c3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..............................#..$.#..((-..%..(..'..7..7..8..
!.$9.'! .*$.4%.83.%%%'(5/> *354 )7,095*;;<.3K1E:.\[.Yj.`t(FF$DY(
W_:AF0\e%ozK..L).L9.Y!.L$$J:'D?<V, V>4m..d.$p%.h'#NC/KB5YG ZG3\S
*XQ:fS.dJ8iV fT:xZ;.m=DFGKRJJQTUJEWFP\TGQQQY]c]eeiYHb[[nbJi`[xhHwdVccc
jktlpofz{ttt....7..x.#r.x{.>..). ...q.|.........6..!...............
..;.."..U..{..E......"../4....'[email protected]
T.{w.VB.zU...."..66..................."..0=.%%.2&.;;.J4.QQ.cc.tt.}...M
..Y..h..Z..e..v..k..t..h..y..i..r..v..W..d..s..i..X..n..v..c..z..l..{.
.k..{..b..j..u..k..x..................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*].....P.J.J....-Uj
......`...K.........l..H..6SGQmAj..U...._......,..I.......%F.&M..,!.I.
.J.W..<j...K.nZ%F...nfW.4..-...w.....1R.nR$..#....up..."&.y..K..N.$
.x.yo!k....@..*....Y.....:....4K.%...{.b..~.....%.....C..g....f.].5c.4
.\RI%.Ps.i.\..o...^z.!..%.5#_A..5!A....#......9g.#......I..<..V[r..
..5.8..}..(Wh.].`h.]r.g0.d.@/R..y..G.B..9.\.....@.'.j....x.iG..$.C.3..
..1....0..sQ...f.....Xm.UB.bW.g.$l".L%....oW...l..v.~.Y....J..~.u.....
.j........HD.{8.vIl.=.......`....xHj...q...4.Pc.....Z{s.)\a.nd.......T
t.......yx...ioR..%....t..V.B.i.L..z7....J$..uF..q}../.f..D....x....@.
U..e...,.....<.U..A.q..5..3....gi. eP ...j .....c..5..h.%......
<<< skipped >>>

GET /2010/vip444.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:33 GMT
Content-Length: 4768
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:02:56 GMT
Accept-Ranges: bytes
ETag: "038617d5c3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..............................#..$.#..((-..%..(..'..7..7..8..
!.$9.'! .*$.4%.83.%%%'(5/> *354 )7,095*;;<.3K1E:.\[.Yj.`t(FF$DY(
W_:AF0\e%ozK..L).L9.Y!.L$$J:'D?<V, V>4m..d.$p%.h'#NC/KB5YG ZG3\S
*XQ:fS.dJ8iV fT:xZ;.m=DFGKRJJQTUJEWFP\TGQQQY]c]eeiYHb[[nbJi`[xhHwdVccc
jktlpofz{ttt....7..x.#r.x{.>..). ...q.|.........6..!...............
..;.."..U..{..E......"../4....'[email protected]
T.{w.VB.zU...."..66..................."..0=.%%.2&.;;.J4.QQ.cc.tt.}...M
..Y..h..Z..e..v..k..t..h..y..i..r..v..W..d..s..i..X..n..v..c..z..l..{.
.k..{..b..j..u..k..x..................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*].....P.J.J....-Uj
......`...K.........l..H..6SGQmAj..U...._......,..I.......%F.&M..,!.I.
.J.W..<j...K.nZ%F...nfW.4..-...w.....1R.nR$..#....up..."&.y..K..N.$
.x.yo!k....@..*....Y.....:....4K.%...{.b..~.....%.....C..g....f.].5c.4
.\RI%.Ps.i.\..o...^z.!..%.5#_A..5!A....#......9g.#......I..<..V[r..
..5.8..}..(Wh.].`h.]r.g0.d.@/R..y..G.B..9.\.....@.'.j....x.iG..$.C.3..
..1....0..sQ...f.....Xm.UB.bW.g.$l".L%....oW...l..v.~.Y....J..~.u.....
.j........HD.{8.vIl.=.......`....xHj...q...4.Pc.....Z{s.)\a.nd.......T
t.......yx...ioR..%....t..V.B.i.L..z7....J$..uF..q}../.f..D....x....@.
U..e...,.....<.U..A.q..5..3....gi. eP ...j .....c..5..h.%......
<<< skipped >>>

GET /2010/vip444.gif HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.hackbase.com/vip/3dboard.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:33 GMT
Content-Length: 4768
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 16:02:56 GMT
Accept-Ranges: bytes
ETag: "038617d5c3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..f..............................#..$.#..((-..%..(..'..7..7..8..
!.$9.'! .*$.4%.83.%%%'(5/> *354 )7,095*;;<.3K1E:.\[.Yj.`t(FF$DY(
W_:AF0\e%ozK..L).L9.Y!.L$$J:'D?<V, V>4m..d.$p%.h'#NC/KB5YG ZG3\S
*XQ:fS.dJ8iV fT:xZ;.m=DFGKRJJQTUJEWFP\TGQQQY]c]eeiYHb[[nbJi`[xhHwdVccc
jktlpofz{ttt....7..x.#r.x{.>..). ...q.|.........6..!...............
..;.."..U..{..E......"../4....'[email protected]
T.{w.VB.zU...."..66..................."..0=.%%.2&.;;.J4.QQ.cc.tt.}...M
..Y..h..Z..e..v..k..t..h..y..i..r..v..W..d..s..i..X..n..v..c..z..l..{.
.k..{..b..j..u..k..x..................................................
......................................................................
......................................................................
..........................,......f........H......*\......#J.H.....3j..
.... C..I....([email protected].*].....P.J.J....-Uj
......`...K.........l..H..6SGQmAj..U...._......,..I.......%F.&M..,!.I.
.J.W..<j...K.nZ%F...nfW.4..-...w.....1R.nR$..#....up..."&.y..K..N.$
.x.yo!k....@..*....Y.....:....4K.%...{.b..~.....%.....C..g....f.].5c.4
.\RI%.Ps.i.\..o...^z.!..%.5#_A..5!A....#......9g.#......I..<..V[r..
..5.8..}..(Wh.].`h.]r.g0.d.@/R..y..G.B..9.\.....@.'.j....x.iG..$.C.3..
..1....0..sQ...f.....Xm.UB.bW.g.$l".L%....oW...l..v.~.Y....J..~.u.....
.j........HD.{8.vIl.=.......`....xHj...q...4.Pc.....Z{s.)\a.nd.......T
t.......yx...ioR..%....t..V.B.i.L..z7....J$..uF..q}../.f..D....x....@.
U..e...,.....<.U..A.q..5..3....gi. eP ...j .....c..5..h.%......
<<< skipped >>>

GET /vip/off.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:34 GMT
Content-Length: 1905
Content-Type: image/gif
Last-Modified: Sun, 26 Sep 2010 12:58:10 GMT
Accept-Ranges: bytes
ETag: "09d8b787a5dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89aB...............................................................
.........   """'''***   ,,,---000111222333444666777:::===BBBCCCEEEGGGH
HHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^__
_```aaabbbcccdddeeehhhiiissstttwwwxxxyyy..............................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........,....B..........hd.....%Cv...a.v...K.-[.x....W-Y.^..u...[.^
."...&M.>[email protected].@ b...........U.V..E...\(a..95..Y O..D)
..G.,q.e...T.H."E....%(X..............Q.F.J.jV-Z.X.b)..*V.O.....!C..9.
[email protected].....[.P.z.B.'Q...JU..&.0.."e..%G4l..~...J.8
...d)F.H.(]......^*0.q ..`.t.J..S..1..B..."J'.D2...X..'.d"..7.!G.:..]#
[email protected]. ..2.$A......A........p.h"[email protected][email protected]\r.$.....h..CP.@2.$
[email protected].....\.......%..i.".`..(.X.."..p. .4".$.....=....
k.p.!.>.b.6.y....D..P.P..9.... h..-.....5....4....%.$2..9... .5R..:
.0..@|...8..H#.$BH {....{.....Da../..B.*[email protected].'2....u.....8"i.8.....
.P.!.....^`q..c.1....Bo.:....y(.@[email protected]@A..z8.D...r..7..G.sh..".....=
....y.!. [email protected][email protected]....|2...?...Z.
<<< skipped >>>

GET /vip/baoming1.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:34 GMT
Content-Length: 1041
Content-Type: image/gif
Last-Modified: Tue, 07 Sep 2010 16:05:33 GMT
Accept-Ranges: bytes
ETag: "804c80a64ecb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a0.......o..p..r..t..v..x..{..|..~...............................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........,....0..........H......*\.......*.H.....3j...... C..I.#...R
.\......]..y`...8o..Y.'..;{.4.Sg..E..L.T.....J] ..U.T.j.J5...U..X0..Y.
e..-.6-..n..%.....p..%.W.Z....^ ..a...#.<..b....&,9.....G.\x....C..
,.s...S..L.5h.....-;6m..g.....m..}.............9C...K.N........;>....


GET /uploadfile/news/uploadfile/201404/20140424102228681.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:34 GMT
Content-Length: 15512
Content-Type: image/jpeg
Last-Modified: Thu, 24 Apr 2014 02:22:28 GMT
Accept-Ranges: bytes
ETag: "7afd20a645fcf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:D06ED0BACB4011E381369A329FA27010" xmpMM:DocumentI
D="xmp.did:D06ED0BBCB4011E381369A329FA27010"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:D06ED0B8CB4011E381369A329FA27010" stRef:doc
umentID="xmp.did:D06ED0B9CB4011E381369A329FA27010"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
....................|.................................................
.........................................!1..AQ..a..q.."2...#....B..bR
C..r..3$.ScD.......................!1..AQ..a..q.."2.B...#............?
...;....d.<.c..cTE'~H)8..S?..8......@.......(.4...".".0. E...!Jb.&l
t;[email protected]...@..|.0.T~J............AR.... .....
..7...Nh.n((.TE3..P$.<.B..!S....G.>*....(....O4C..h.B....H.Ob...
....F%D.<...)...S.....G?...! h...RD<.P...PJ.&.?.....<....
<<< skipped >>>

GET /uploadfile/news/uploadfile/201403/20140331044409662.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:35 GMT
Content-Length: 23096
Content-Type: image/jpeg
Last-Modified: Mon, 31 Mar 2014 08:44:08 GMT
Accept-Ranges: bytes
ETag: "5896c061bd4ccf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....`.`.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((......~.~.."........................................
F.........................!1.AQ..."aq2.#BRT.....3...$b.4CDS....%r..c..
.............................%......................!.1.Q."Aa.2.q.....
.......?...........S}......O......~....../*X?..I.PJ.c.:[........}.....
p...X......,(.T.u..ad.A...~......~...."..uM.../....<./...._..0.....
..~.....i~....".u./...i~.....i~.... ..Ck.....~@.....~@./...Uv...>..
..<.'...XW....D...........m ....z.Y`...T...ra.'].D....V...........&
lt;.........:.]{.Tf...x-...^[email protected]^...a.....fa. 5]..Q.l4.......i
...O....y....W.R..U...................~@...'BuW....x.|,Ti.....T.z..C.U
E....x..6W.,.krR.A.1.f.|..7.b....G..r.,.x.....N.{.I.c......j "...y.J.K
p...i...\^.l.i.t.qk...eE.Z..O../..W!m;K.P.T\).X:..3.e.....dn....).1..q
~Ue.5\...V..U.|.;N.slL..b.......W.4_."?..k..<..[.^l.s6.Z]c}6l...<
;?.dF.S.<..j.,yo}:.......K.o....5?...c.w.5?..D*..... ........n..NT.
..........-c1..,B.e|w.pVi....B...$..)...t...".....-.i.Z........t...O..
..A...4....L...).......M.X? Y6S..QGO.X? U..c........uA..)......i.....(
)...........>......,,....aCK.X? S.i~....&...V7......)...u..ad\%.c..
O..........,,...c..O....x.O........1..'.`.XO.I.Z.....D..&.......,'....
..."..t......~@......,,.....K.h?.........B.PY.t.v.........@...........
@....D_. .z(.UM.R..FdB.d...S..2.(.......Fb......*.1...DM.YBYS..UfE,.K.
T...E....\.K...$)...~.uQz,.R......D.5QK)Q....Ih;...%.t..X.g4~..L&g
<<< skipped >>>

GET /uploadfile/news/uploadfile/201403/20140310094959731.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:37 GMT
Content-Length: 16347
Content-Type: image/jpeg
Last-Modified: Mon, 10 Mar 2014 13:49:59 GMT
Accept-Ranges: bytes
ETag: "36326a1673ccf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....`.`.....C..............................................
......................C...............................................
............................."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?..I.....
...ey....y......k.h...^..oR.P.k.L;.: ...?.C.Kh...(...6.9>.\...!..0.
... K....q...HQ.....A...z.R..A..57W.X.9..}i.`.Fm.t.J7....tC.@>P77\g
.L.2...$w....f..f.v.<....E..<..7...............VV....XL.[.:..V,E
...>.}#TU .&.[.....W.G'..>..e&.".R2Xt...\.W......T..e0..*.... ..
.Y3d..,....:..Zv.\..B..A.P....r.O.....P..F...RH.)Z......`zqRN...z.d.4.
.Dc.30>.T.(2........;..$....c.g..........a.pz.V....-...H<.E.,6.W
.h.9$...[&...s. ..l...2-....u.xW..'^j.....Z...7-..l....._J.E.w..0x.x'.
...{...M..B.......Z..~o'x.d\(.l.U5.A.f.s...$..h[x.S.D.k...g8'._F...C..
ub.4.g.H...d..n.....W.o.4....3[.'...=....fM.&t:.].};..L....g.H[.Oj...(
 ..N2.=.........)?0.q.Wg..U..4O32F1.......5.g..y.i..]......%H...JT m..
...Uv.cd...s..2....bQ..J..p.H...p..Ro..q.4.V$...-.v sQ3e....y.0..JO9.4
.".W'.........-.3..'...&....P.L;O;..EtX.$...Zinz....z|..L.!.0u.=..T8.N
i...A^X..$......A8.f.D...Q..i...<'..V..ZlhD]X..Py?.|.o.C ..c..A
<<< skipped >>>

GET /images/top.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:38 GMT
Content-Length: 1970
Content-Type: image/gif
Last-Modified: Tue, 26 Nov 2013 16:47:24 GMT
Accept-Ranges: bytes
ETag: "86ed72ec7eace1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.............T..................................................
.................. .."..%..&../..3..3..:..<..@[email protected]..\..g..k
..k..v..z.............................................................
..............f..x ...................................................
......................................................................
..................................................!.....H.,...........
.C.....G................C.B..GC.................B.....................
CE................E.B...E.......................CF............F......!
\xP......"2Q...B.f.......;r$.Q.H..=z..R...!...).....s..)....@}.2...PAF
...I.)S.>.D.)......f...k..U.b..TlTYT.rM..-.Bn....K.n..]..-..oS.|.f.
.W..ym..~ku...f...../........s1.PA.m...Y.z..F...a.d!.-.....q3........r
/....O.B..."$Ge.>[email protected]?........D.<}e..5..=$....7W
.?:2{!.%..v.M.....w.u...].. ....&....^..|..&.|J.'..#.G_. ~.^r.........
...g....'`.........b...Y.}$&.....-0.e,.....$f....0..Bj5..68i.O,|`..c.I
.....f.g.....t...R.p.{[email protected].}J.j.hC....EA.....p..?.....}.f.#...O.x.
&Pc..Y...I.i...T...z...n..o....f...(_.D...%[email protected]...~j
.....m..!.....`....Z$a.......: .?.{..U..T.W^7'....S...:*..Li*.A... .".
...H.X...r.C.{....Cz.....w"q...B.%.0oY..T..Q......`/....B....Z......6&
lt;....|p.....mx.{. .G.J........- ..,.m.u#8.f....B.,0.Y......6X.t.....
.z...e.o.q....5...........,.P,i.....y..3...`.......#.....e.0n..K...vkC
. .Yk.!...........N/.>.]..........p...I..>]...d.^:./.f.........E
,..../.......y.k.V1.].....s.)...D..)..uuj..\.:.0 v9....w...-r.*...
<<< skipped >>>

GET /uploadfile/picture/uploadfile/201404/20140428022323350.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:38 GMT
Content-Length: 7722
Content-Type: image/jpeg
Last-Modified: Mon, 28 Apr 2014 06:23:23 GMT
Accept-Ranges: bytes
ETag: "825f485baa62cf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((......x....".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?.../.]..bB7upX...
.k..tM[[email protected]%..p.. ..M...F!.f...3.I.sJX9..i...L.....CG.9.
kC....E.[s.a..5(..9.....zT.v}...hvG.<.2>......}..\...6..\..1Hca!
..g.:S<Q.$ZT......w.h.%q.....J.,.........[.eV.`..<....,.b..$....
..F......xa.N.m..h...a. ....rm.='.G].6|.O.`....k..>.u..R.K.........
..I.Y.q.W.c.|sd-|Kz.......A.y....g..Q..*..dpOlW.z.....K}.......?,.[h.X
.1......K.(.V2..X\.R..\.........L..5.!...7&.H....:WU....:..}.f.a......
.~u...;......<.B.!..A..F.Y4e...ga..........N?...3-.....o...G..41.34
n..'...".<Q.Kmw...!K...T.,.........u.Z......F.;;G4...A.G.Z..u..S...
.a..A-.!...z...r.*%I=S64.$})ALH9I........-g..'..4.(!....W..Z....[..{..
.g?A..f........r..31..x.0u....O..,..Wco.hL...'..Q..#.8..Z...Z_.~.{jf.m
...p.@<~u...'}K.W..6.-.d&)....O.x.-........>Y71<[email protected]
..-e.(.'.c...l.r.R.a.Fy...eq\.=_F......o..6.|O..I.{u.?.p..z...2.Z.
<<< skipped >>>

GET /uploadfile/picture/uploadfile/201403/20140318015153597.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:39 GMT
Content-Length: 5443
Content-Type: image/jpeg
Last-Modified: Tue, 18 Mar 2014 05:51:53 GMT
Accept-Ranges: bytes
ETag: "e4ecec296e42cf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((...........".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?...'.d....?...C.%
...Q.o..r.7..tZ}....Mxu].....,..#.....l...R8.Pj..U..C....[........n...
mb*...5*..$7p.s.....Lc.....'q.^.|H.Hm.....H?".O...9...1....J.......Q..
..r..........q.0s.....hN6..e.g.|......{..........VF..*.....u..=...Fk.g
1.....N..Z6.X.. ......H#.%...w...$..m.T1..Q...v..~..n..5..b=... ..V...
Z3....K...K2....z.j.O...}.V.>=eP..a...E.]..~....b..q.3E..X..(.z....
..f2N8.V).k.<....j....Y.{TK..4..\.h....<...z..-.F........tc....r
*m/G.lcX.....R.zE..b....sQf>u..t.L.4.9s.};WQf...`.eXF..} r$.S....5.
.]......."..!....G0..1.....K3..&.eM....r...4....\....#......3.=...Z.(.
t.{..V.U.\......A$..S^M....~..h-I.@~g...Q....^.......X.E..I.9...Mt...l
Qdl........\^.5g.. ....~...-;R...Y[.....b`.z.S\.jw............?..u...E
..k-./.$JYO....q]m....,....i..s....V...-.3.JO].9.....[5..;..|...c...o.
..;J....8<..=...B..3..W.I....y.g..f...ky.!.......u.w.{I...,....
<<< skipped >>>

GET /uploadfile/picture/uploadfile/201403/20140310103055867.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:39 GMT
Content-Length: 30070
Content-Type: image/jpeg
Last-Modified: Mon, 10 Mar 2014 14:30:55 GMT
Accept-Ranges: bytes
ETag: "c8564596d3ccf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....`.`.....C..............................................
......................C...............................................
..........................q.."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?.....a..
...*.S....m|./X............S.*......D..~9.q.......PF~e.0.X.;yR20...v..
.;p$_...y..u....%s..'.js.M./%.....i.Pf....|O........GY.....yn......n..
\..Jq...F...?w.o.O.45{....Q.@....'..s..9...6.kk..^......r..F....:2....
.#2.~A...f.....G.D...>.y....2g?F.......*.9.....&..g...?..i.,!>K|
..n...[...3O p6..V..8.<s......).......x...~..-....X.........[....G.
..`.l.?..J....JA?.....u5/..1.w..2..3...[P)3......A."..#?:...... n(q;..
...#YW...p[.mc..A..............J.....g....E.....Q?..1.Vi..&...>q...
.....Z(.....o..U.....q\5.Q.u..... R...v.-.yYH........._.sM..M..w..D.R8
..*b1..m..Pz."......\..#....8S...*..K...I..o...(.q.*?..._.L.=lT.~....&
[email protected]('....7z......?j:.=..>..Dy..#.....v.....
....y..z.....L.#... ....V.])71.....).";~..'...ZH..8.3.....2....k.>.
xrG.([email protected]'..)....{T....b..)...i.9..UV....
(....kZ8?.f=.....0n......50.i\Mi..j0(h=GR>.RhP.C.1........H. p0
<<< skipped >>>

GET /uploadfile/picture/uploadfile/201403/20140310102756390.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:41 GMT
Content-Length: 39292
Content-Type: image/jpeg
Last-Modified: Mon, 10 Mar 2014 14:27:56 GMT
Accept-Ranges: bytes
ETag: "4a94dded6c3ccf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.....`.`.....C..............................................
......................C...............................................
........................r...."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?..t.....
Y..'.....x...8.F.m.......q_:DX(.....U..G.W6.......04..rM.vS.)...a.OxN.
A..l....lQ.^q...t.,.{..wf?.*..c......R-.b..A..Uj.u"T..G.jz<.|a.?SY,
....^....&. ..^z....F....4....~t.s.....9.`i.8_z...5.x^..T...9.i6..7:..
..........O.N..$.gx.....-Vm/ST.)..\[email protected]......
I.<...W.Q.fxm..w.F....y9M.....~...2.C....;{H.....=.B...U..q\..K&. .
kR..a.[.^..8.1..-.....j.e.p...f....nb3..4k.....W....B..Ax.*.j.uI.....j
.........:.K..2..Y5r.9.zg.eo.v.a...G.."..,..gE;..........d..T8..r..>
;c.9.6..1...jx!.#q...;.n...&..=._...V|.B.;.u.l........./.!.X..-.... [.
M..B.-a.H.D#..Z/...eR...\n........^......a...l.d..s...nx6..Y...o".`.uV
...........{c..V...*..1'..W....6...H.\.....T..M .w.J.3..../..am.JOq...
>.x.U..N..y...o......i..i......[Gn.DX........>|{g.....z.._G..i..
[email protected]._......../.qFN...8...
.'..HY..8.=..T#..S.....:0......~...g.E..6..*g....4V..|........6...
<<< skipped >>>

GET /uploadfile/picture/uploadfile/201403/20140310102126290.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:43 GMT
Content-Length: 3706
Content-Type: image/jpeg
Last-Modified: Mon, 10 Mar 2014 14:21:26 GMT
Accept-Ranges: bytes
ETag: "ea38d956c3ccf1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((......w....".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?.....}G..B....`..
.)..|'.........xX.._n.l.../....*.=.|wO......?.._.^...B...g..a^..(.....
.'......kw=.............R...O......?....J...?.._...........?......?..?
.{G..B...g..a^.h.........0..n..................^...........W...?.p....
....w=.............R..............;4f..\..~/...........?.^o.....(.....
.........xnii.b.......?.V.{../h...^o.....(....................b.......
.].....^...B...g..aG./T...}../........b........]......^...B...g..aEx..
..\.../...........H.S.M.'$.N.%.rG.'j1..Fq..k...R......H...?Jg.r..b...U
"..oS...F.U.0.;[email protected].>.}.H.......
....S...o.?.$R..\[email protected]{...9...R....NH.HH.....i!.....2.&
gt;..........%....{S......0.S....:.].E.bps..5V2..K.V9....=.R..f..1....
I}.h..r..Z0.......u.b...1.....\[email protected]..^n#..5;.z..s....6
..v....0i....9..`.....H.R..].0_..^..X..\.OZ..X....[.{......Z....8T
<<< skipped >>>

GET /images/jian1.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:44 GMT
Content-Length: 820
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 15:07:54 GMT
Accept-Ranges: bytes
ETag: "013ccd543dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,...............H. .....\.._@.;....


GET /style/images/point.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:44 GMT
Content-Length: 43
Content-Type: image/gif
Last-Modified: Sun, 06 Jan 2008 06:38:08 GMT
Accept-Ranges: bytes
ETag: "08e3b22e50c81:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a.............!.......,...........DR.;....


GET /vip/bbsvip2.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:44 GMT
Content-Length: 1650
Content-Type: image/gif
Last-Modified: Sat, 25 Sep 2010 07:50:06 GMT
Accept-Ranges: bytes
ETag: "04bcf44865ccb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89aq.#.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........,....q.#........H......*\......#J.H.....3j...... C..I....(S
.\[email protected].*].....P.J.J..U.V......Q...*. .lB.
..jD[.#Z./..]...].&........u...(7.\..."&.8p....'.lPr^...F..x.......)..
.....V...X......Y.....3.\..m.jy.f......O....._..}.M................G..
.6...../G...z...[.my....A...\.......t.U..{..E.k...]..=X.^[email protected]
....(Xd..E......l.......H.o.1..u....s3..a................L..Zu...a.0..
cX..) .A.x.O.......X$..mY%.jF.....G.{M.g.tD....|...g....x.Q...D......I
Y...h...%...v.y.r.I.'...Yi.7q.cq.r....FX`l$r......)).Zfj...FJ.....'...
hf.BBwl.... ..e....R...;b:.p.....v...j.. ..e...L?.G..X......v..j......
z...j......(..%...8.K................i.f.%.....z.:......ond.\..,M'....
.h..a...R..r...k..$.....#.).'.....Nh.....og.W....v.&.T....^.g.....
<<< skipped >>>

GET /images/union.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:45 GMT
Content-Length: 9080
Content-Type: image/gif
Last-Modified: Mon, 16 Aug 2010 15:57:51 GMT
Accept-Ranges: bytes
ETag: "80e995c75b3dcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a..'.....{.1}.4..9..;..>..=..>[email protected][email protected]..
D..D..H..E..I..L..G..H..J..M..O..O..T..P..[..P..R..Q..Q..T..T..U..V..X
..]..X..X..\..Z..]..\..^..b..`..l..b..d..a..`..a..a..d..d..f..i..j..l.
.h..i..h..j..k..n..n..m..o..t..r..r..u..u..x..w.....~..i..j..l..l..l..
s..p..p..t..q..r..s..u..w..t..v..u..v..w..z..x..x..x..x..y..|..}.....|
..x..z..z..}..}..|..~.....|..}..~.....................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.................,......'........H......*\......#J.H.....3j...... C..I
....(S.D.O..t.....n&:.8........;...'.(:.H.*].....P......6mX.f....6h`..
.Kv...h.^].v...W....l...x.....V-[...Rej.(P.4iJ...!<t..Ic.L.0]....e.
.,[...B..g1...A.&..7v.)j....N.M.6.*.......N...... _.......K.N......k..
..........m^.w..F[..........M.{.....__.}...(....h.~..8......4......R..
....!..h..-..rK.$.h.4..8a..~..0..r.`....`....-....n..r.'.l.X!..1G.g.A.
.b.A..TVI..WN1..Uf.e...&..j.....5.H#..F.%....'t.i..x....|......*....j.
..&....6....F*...v..).tC.6....^..*....j......-2.."....*...\Xk........j
b.... .,f.b............D..*..x...^.b.... .!... ...#`A...(B...(....(...
.(....bH&.G.p.1...MI%..K.%.STa..UZ.Z..E..k..q.l..9.".(.....l..(....,..
..0.,..4.l..8....<[email protected][email protected]...\M..Zw}K-_
<<< skipped >>>

GET /uploadfile/icp/hd315.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19; Hm_lvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752; Hm_lpvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:45 GMT
Content-Length: 541
Content-Type: image/gif
Last-Modified: Sat, 24 Jul 2010 15:33:29 GMT
Accept-Ranges: bytes
ETag: "802aaa90452bcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a#.,............8..e..........S..".....5..o.............!.......,
....#.,......I..8....Zh.Bg&. j....s.F.. .... [email protected]&l.......$~...X
k.0..v.<$..B..E(...........c8...T.a..M4XR..C...[.h....M.......CLB..
6...M..N..A.]&N.Z.x..M6....lM.....Nt.C..6.d..;k..p.......t.........b..
....cnoc...a..]w.....1A...7e [email protected]....... [email protected]
.....>z..:...F.m..)..h..i.. ...#D.n.9.QA.:D.C.....L....Zte..q6r9...
...f.D)...'..x.....Eby...X...{"m...%.I...i..E....g...Fi.Q9:.~6...0:...
..W.......!j..[I.~.&l...f[(A...).uO......6N.=...........;....


GET /uploadfile/icp/netchina.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19; Hm_lvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752; Hm_lpvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:46 GMT
Content-Length: 1596
Content-Type: image/gif
Last-Modified: Sat, 24 Jul 2010 15:33:29 GMT
Accept-Ranges: bytes
ETag: "802aaa90452bcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a(.,..............zzmk.......lo...........54.dc............)'....
........................vw.......(&....~}..........[\.....;;..........
...........HF..mn...u~...........NN....wy.......IJ.......@A..........i
h........................9:..........................^]..........EE...
..........XY..........&&.............VV.)*....~~.rr.............QR.uv.
...qp....... !.lk................po......A?.....78."%.................
....................|{..................}.........\[..................
.>?......................01.0-.............................. ......
...st..........{}......pp......................PQ.UY.YW...............
.......................HF...................... -...__.hi.............
...................ssfd.....((..............................20..FC96.8
8.......zu....!.......,....(.,........H......*\......#J.H........cC..z
%.e$8(@.f.Z.ab...B#.....N.y.....KM.A........1.p.,.......!....(H#...3m.
.]!.f.8....g8..5v....0.B`.[[..da.a.O.,w.&......<...5....K4-j..Q.$Kb
%. ........Z...M0b... ...d.e<....'0....M....-.J.%.;h..-..bDV_):....
... ...'..!...u.AA,E.w..}ptcO.N....S...F.X9.....;2.0.-u`.D|..".6..2.;.
L...[......X..5.0IC...AA..A.5r.q. G.q...`.C.. h.!g`[email protected]
..c.....2..#.0.5..7;P...y.u...00..n.p.*`t..B.T....u..>...H&.@!.#q`2
E.n.p...4.L...4H5f...A.x..7 d..:.....5.Q..=.r.7..c.:.....!|..5.....:..
AB/_(b....P....zJ;t4a...d.......0..I..J\.O1.f3...... =,..... . T K...:
.............k<..%.m.......5..!..p.A.0380C.6.....x..1.|.I&.d...s...
.l.|0.......Hbc"..rA......aD(.....L...b. *;.......#....1.d...C... 
<<< skipped >>>

GET /uploadfile/icp/bjjubao.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19; Hm_lvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752; Hm_lpvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:46 GMT
Content-Length: 2017
Content-Type: image/gif
Last-Modified: Sat, 24 Jul 2010 15:33:27 GMT
Accept-Ranges: bytes
ETag: "80fd788f452bcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a#.,....._..H..8o....V..T....Er.............q......^.h...M....Zz.
.X.Vv.d...I.3[.....E.9^.....Q........5q.:q)R./[.....E..>.v...\..R..
J.$T..N.......%[.;c..Z..N..F..A.....9yEf.<_.^........Bn..V..T.$R.)X
..=}.........~...B..[..Y.....<z....E..U.<f.Kk....Uz....5e..P....
....T.....L.^..|...X..@|.F..N..P.0V..R..G..\..F."M.....S.....G..G.....
H..`.4^.a...P.....C..O..?}.J.Dk..Q.Ei..F.)^..^....,a.%L|.N....4Y..D..]
.k...:w.Az.O..W..;}-W..A..U..?..=x.J.9\..5x.B}.J..E}....=..7r.N..L....
.Q..H.2`..V.....I.....D..H|.K..E..D.!V..T..D..H..Q..Y..W.....B..Q..R..
........j...F....|...Dzo..,`.?`.`}..]..^..........f...L.....F..X.j..'P
.o..e........5`.[[email protected].
.E..H.....S...........S........K..L..?r.U..V..Y..C.w.....'Y.&^.=n....V
t..*k...}..x...`.......!.......,....#.,........H......*\..............
.3V.......A..x.#I..`l.p....&..D...D.L..q`....k..p.../..lNt.....V.e.G`.
0.X.l#0... '..%.`..=L.$....8yX..Z.B_.....b.k..A'..%....L..6........,Y.
...#F}..u...w}..@geW...`....O.tK4.......cn....K%.#.X!.C..VF. .....7...
"[email protected]`h.......a,...|;.#..d.f......dje.. tR..(.....0...;K...5.$....l.
..<L2.'.LrH..e....r..4f.....L.J.&...;.N....x....l...K ..VHp..$.`%..
...b a..B'.t..'..Yd....O..x2...Tr.....J ....2.........'ar...Dp..#p.S.,
..y''?\c%VD......a.6W...>1<..,]t.G..d.H......;b...}2...M.`."....
).....,.....|`.../8..b".Qk.p..I"..#..P`..#.......3.....J>.`.L...q..
X.....`e... .....aM....H..XB...T..(...K,.........  ....3(...I.iI..|'A.
lL..*.t3........C G.qh.J.bH.O..D....4.B#.Z.D'O(...SX...QP.J.,..E..
<<< skipped >>>

GET /uploadfile/icp/net110.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19; Hm_lvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752; Hm_lpvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:47 GMT
Content-Length: 1841
Content-Type: image/gif
Last-Modified: Sat, 24 Jul 2010 15:33:35 GMT
Accept-Ranges: bytes
ETag: "80b13d94452bcb1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89a#.,......7wr........YYbcf.................................\.....
...............YT....ok.S.h...... "&................{.................
..3v..........a].......*#x?9..}.NH....hc.zvv............ .yJIJ........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,....#.,[email protected][email protected]@|8.D...3.
@......6........xd..c..."x0..!A...4...B....\(=`A...<T...`....D.....
[email protected]........|= ..... .......$....c....R.Pa..........B...LD..
[email protected]......([email protected]@....0...1b...)50p. ....~.
8Q.`..-@............. ....*4.:B......'0^......Z.?....)54...t..l.. .~..
.R.7.........<,..Q...A... !.*.....e .......5..a..u'.. ...x-.(.....C
.6.0C.....m>.I..,..Bx .T...N.A.2.e.."9... ....)...^.}YT.5.(....P...
..A...j$B..i...-...&,....8.........!j....p.s.\%....PB..(...v..Dc...`..
.&..D............8P.<..$..L.....0.......,(0..#[email protected]....$.
........,[email protected]~^...0X..b"..o.1\..^<4...#:z..7t..
.&. .b....k..&....{C..LJ[..|p.h.80.qq...\1.............@...(......
<<< skipped >>>

GET /images/yewu.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19; Hm_lvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752; Hm_lpvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:47 GMT
Content-Length: 2356
Content-Type: image/gif
Last-Modified: Fri, 23 Aug 2013 08:48:58 GMT
Accept-Ranges: bytes
ETag: "0f9279bdd9fce1:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
GIF89av......dfdnpnxzx................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........,....v.......!..H......*\......#J.H.....3j...... C..I....(S
.\.......6.p`.M... ........$(.@ ...c.Tj..O.L!D]..fB.0..0.@ ...$.$...U.
..@u9.`..N...Ps...a.>@0......NmX....g............. .....4. [email protected].
..t.................0....<0P......8`[email protected]. ...z........m!..:...
.....<...g....m..}A.S...Z..S...B [email protected][email protected].
.pM....!.S....X.Y..!..P._].ex!\...U.. ........H.6V...`....e...$.PO:=p.
o..I".....L....n>.....>P.........%...~. .1~.\...)..l...V.LV.....
V..%'.x-euZ..A..h..V.i.Q..}.1...jU..L.R.Yf3%``[email protected][email protected]..
&.[`-....T.S....)M..@..... ..}[email protected]}..\..V.@......,`.\..5P..=7...T...}.
......[.}...y..ZV.....l.(.........0.......[5..@NfB. c...UA... w.5.^{.Y
z.B.........~.A.........B.....*...n.._.%W.L..f...)0.X3...QF.W.T.r.
<<< skipped >>>

GET /include/js/Std_StranJF.Js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.hackbase.com/index.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hackbase.com
Connection: Keep-Alive
Cookie: weidunkey=28f8b9101c8aa86b17e0e70689a80d19; Hm_lvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752; Hm_lpvt_aa34293d67c95b9ea9e7201a9150b74a=1398741752


HTTP/1.1 200 OK
Date: Tue, 29 Apr 2014 03:22:48 GMT
Content-Length: 8641
Content-Type: application/x-javascript
Last-Modified: Sat, 29 Nov 2008 10:35:42 GMT
Accept-Ranges: bytes
ETag: "0d36c3ae52c91:1377"
X-Powered-By: ASP.NET
Firewall: VVV.weidun.com.cn
Server: WeiDun IIS Firewall
//..................................//Edited by Stardy --2005-04-16 , 
Web :hXXp://VVV.stardy.com , QQ:2885465..var Default_isFT = 0..//.....
.........0-......1-......var StranIt_Delay = 50 //....................
..................................//..................................
..............//..........function StranText(txt,toFT,chgTxt)..{...if(
txt==""||txt==null)return ""...toFT=toFT==null?BodyIsFt:toFT...if(chgT
xt)txt=txt.replace((toFT?"..":".."),(toFT?"..":".."))...if(toFT){retur
n Traditionalized(txt)}...else {return Simplized(txt)}..}..//.........
.........................function StranBody(fobj)..{...if(typeof(fobj)
=="object"){var obj=fobj.childNodes}...else ...{....var tmptxt=StranLi
nk_Obj.innerHTML.toString()....if(tmptxt.indexOf("..")<0)....{.....
BodyIsFt=1.....StranLink_Obj.innerHTML=StranText(tmptxt,0,1).....Stran
Link.title=StranText(StranLink.title,0,1)....}....else....{.....BodyIs
Ft=0.....StranLink_Obj.innerHTML=StranText(tmptxt,1,1).....StranLink.t
itle=StranText(StranLink.title,1,1)....}....setCookie(JF_cn,BodyIsFt,7
)....var obj=document.body.childNodes...}...for(var i=0;i<obj.lengt
h;i  )...{....var OO=obj.item(i)....if("||BR|HR|TEXTAREA|".indexOf("|"
 OO.tagName "|")>0||OO==StranLink_Obj)continue;....if(OO.title!=""&
&OO.title!=null)OO.title=StranText(OO.title);....if(OO.alt!=""&&OO.alt
!=null)OO.alt=StranText(OO.alt);....if(OO.tagName=="INPUT"&&OO.value!=
""&&OO.type!="text"&&OO.type!="hidden")OO.value=StranText(OO.value);..
..if(OO.nodeType==3){OO.data=StranText(OO.data)}....else StranBody
<<< skipped >>>
%original file name%.exe_1076:

.rsrc
.data
.adata
TCppShellUIHelper
TCppShellWindows
TCppInternetExplorer0
TCppWebBrowser
TCppWebBrowser_V1
strUrl
TCppShellUIHelper *
TCppShellWindows *
TCppInternetExplorer *
TCppWebBrowser *
TCppWebBrowser_V1 *
IShellWindowsPtr *
IWebBrowser2Ptr *
IWebBrowser2Disp *
TAutoDriver *
TCOMIWebBrowser *
TComInterface *
TComInterface
Shdocvw_tlb::TCOMIWebBrowserT
TAutoDriver
Shdocvw_tlb::IWebBrowser2DispT
TComInterface
TComInterface
Shdocvw_tlb::TCppWebBrowser_V1
Shdocvw_tlb::TCppWebBrowser
Shdocvw_tlb::TCppInternetExplorer
Shdocvw_tlb::TCppShellWindows
Shdocvw_tlb::TCppShellUIHelper
OnKeyDown
OnKeyPress
OnKeyUp
OnKeyUpdxG
OnKeyUpX
PasswordChar
TsuiURLLabel
TsuiURLLabel`xB
SUIURLLabel
http://www.sunisoft.com
%Program Files%\Borland\CBuilder5\vcl\SUIPack\SUIImagePanel.pas
OnKeyPressH
UrlMon
olepro32.dll
ssHorizontal
hcMD
windows
AutoHotkeys
:].tJ
EInvalidGridOperation
goAlwaysShowEditor
Uh.tE
EInvalidGraphicOperation
KeyPreview8
WindowState
ssHotTrack
TWindowState
poProportional
TWMKey
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
TDragOperation
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
IMM32.DLL
iaLeftP
vsReport
comctl32.dll
EInvalidOperation
%s[%d]
%s_%d
.Owner
USER32.DLL
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
ISupportErrorInfo<
ole32.dll
kernel32.dll
Portions Copyright (c) 1983,99 Borland
Eh.eN
%u8F3
Windows Resources Exhausted
TExecState
Windows %s %d.%.2d.%.3d %s
"# !!##!
  ""  " "
^4:4:4:^
^^^::^^^
SMSS.EXE CSRSS.EXE WINLOGON.EXE SERVICES.EXE LSASS.EXE SVCHOST.EXE SPOOLSV.EXE EXPLORER.EXE CTFMON.EXE INETINFO.EXE SRVANY.EXE CONIME.EXE
EXPLORER.EXE INTERNAT.EXE KERNEL32.DLL MDM.EXE MMTASK MPREXE.EXE MSGSRV32 MSTASK.EXE RPCSS.EXE SYSTRAY.EXE TASKMON.EXE WINOLDAP WMIEXE.EXE
msg.lib
site.lib
PSAPI.DLL
KERNEL32.DLL
AUTOEXEC.BAT
REM %s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
http://www.hackbase.com
http://www.hackbase.com
\qqav.ico
Software\Microsoft\Internet Explorer\Extensions\{06926B30-424E-4f1c-8EE3-543CD96573DC}
{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}
http://www.hackbase.com/
\QQAV2004.lnk
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Explorer.exe
\win.ini
\system.ini
\winstart.bat
\wininit.ini
c:\explorer.exe
desktop.ini
index.dat
http://www.janker.org
LOVE.EXE
INTRENAT.EXE
WINHELP.EXE
WINHELP32.EXE
DIRECTX.EXE
SYSTEM.EXE
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunServices
MMQM.EXE
MSUNIT.EXE
REPLER.EXE
SYSTORY.EXE
MSINTOR.EXE
ADTEST.EXE
SCRIDOWS.EXE
INTNETS.EXE
SYSINFER.EXE
MSFILES.EXE
SCRIERS.EXE
HINETS.EXE
SYSDLLS.EXE
MSFILTS.EXE
KTV530.EXE
MSATER.EXE
RESTORY.EXE
SYSFILER.EXE
UNICALL.EXE
UPDATES.EXE
QQ886.EXE
QQ68.EXE
OO163.EXE
88MUSIC.EXE
QQ250.EXE
5A.EXE
NTVDM.EXE
WIN.EXE
SENDMESS.EXE
QQMESS.DLL
SENDMESS.DLL
QQ32.INI
WINDOWSUPDATENOIE.EXE
INTERNET.EXE
TEST.EXE
WINUP.EXE
HEIBAI.EXE
EXEHEIBAI.EXE
QUPDATE.EXE
HEIBAI.exe
SCANREGW.EXE
MISSIN.EXE
REBLOG.EXE
SYTIPLE.EXE
LACIAL.EXE
DIRECT.EXE
IEXPLORE .EXE
QTAPP.EXE
EXPLORER.EXE
MSPBHOOK.DLL
QTAPPH.DLL
QTAPPS.DLL
QQTail.EXE
1.EXE
1.DLL
Windows Media SP.2.7.7
GMPBV.EXE
SYSTRAYS.EXE
NET.EXE
net.exe
c:\system.exe
c:\autorun.inf
CMD.EXE
RUNDLL32.EXE
TMP1281535.EXE
RUNDLL.EXE
WINSOCKS.DLL
SMALL.EXE
QQYZ.EXE
EXPL0RER.EXE
SYSMODULE64.DLL
SERVICES.EXE
QQMEWF.EXE
QQMEWF.DLL
MSBLAST.EXE
windows auto update
FTPS.EXE
TELNETS.EXE
SYCHOST.EXE
windows update
UDDATER.EXE
SSTTARE.EXE
SESNOT.EXE
MOEIA.EXE
moeia.exe
qqav.ini
FilterMsg
http://www.hackbase.com/qqav/warning.htm
Software\Microsoft\Internet Explorer\TypedUrls
Software\Microsoft\Internet Explorer\TypedURLs
Software\Microsoft\Windows\CurrentVersion\Policies\System
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
mailto:[email protected]?subject=
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Software\Microsoft\Windows\CurrentVersion\Winlogon
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU
Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU
Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ComputerNameMRU
Machine%d
Service%d
TermType%d
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
s %s (%s)
edtAddMsg$
lstUserMsgFilter(
btnDelMsg,
btnAddMsg0
suiURLLabel3@
suiURLLabel4H
CppWebBrowser1X
chkFilterMsgt
lstMsgFilter|
edtExeFile
btnDeleteUrlAddr
cobUrlAddr
btnShowUrlAddr
VirusReport
suiURLLabel2
suiURLLabel1
suiURLLabel64
suiURLLabel5<
btnExportProc
btnAddMsgClick
btnDelMsgClick
edtAddMsgKeyPress
chkFilterMsgClick
btnShowUrlAddrClick
btnDeleteUrlAddrClick
VirusReportClick
lstUserMsgFilterClick
btnExportProcClick
TCppInternetExplorer
SHDocVw_OCX.cpp
d:\typelib\include\vcl\utilcls.h
%s @ %s/%d
%s failed - %s/%d
'%s': %s @ %s/%d
(%s) Error: %lX (%ld) @ %s/%d
this->QueryStatusWB(cmdID, (Shdocvw_tlb::OLECMDF*)&pcmdf)
xxtype.cpp
derv->tpClass.tpcFlags & CF_HAS_BASES
Inappropriate I/O control operation
Broken pipe
Operation not permitted
%H:%M:%S
%m/%d/%y
%A, %B %d, %Y
d/d/d d:d:d.d
xx.cpp
varType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpClass.tpcDtorAddr
(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags
memType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR
dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR
IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)
elemType->tpClass.tpcFlags & CF_HAS_DTOR
_noParam.vt == VT_ERROR
VARIANT.CPP
_empty.vt == VT_EMPTY
vt == rhs.vt
d:\bcb\emuvcl\utilcls.h
Inv(%d) %s, 0x%lX, retVT(0x%X), ErrArg(%d)
Parms.vt == (VT_ARRAY|VT_VARIANT)
ParmTypes.vt == (VT_ARRAY|VT_I4)
qqav.exe
@$xp$18Rxshell@TExecState
@$xp$24Suiurllabel@TsuiURLLabel
@$xp$26Shdocvw_tlb@TCppWebBrowser
@$xp$28Shdocvw_tlb@TCppShellWindows
@$xp$29Shdocvw_tlb@TCppShellUIHelper
@$xp$29Shdocvw_tlb@TCppWebBrowser_V1
@$xp$32Shdocvw_tlb@TCppInternetExplorer
@Anifile@TAnimatedCursorImage@Draw$qqrp16Graphics@TCanvasrx13Windows@TRect
@Anifile@TAnimatedCursorImage@ReadCreateIcon$qqrp15Classes@TStreamir14Windows@TPointro
@Rxgif@TGIFFrame@Draw$qqrp16Graphics@TCanvasrx13Windows@TRecto
@Rxgif@TGIFFrame@SetTopLeft$qqrrx14Windows@TPoint
@Rxgif@TGIFImage@Draw$qqrp16Graphics@TCanvasrx13Windows@TRect
@Rxgraph@TRxGradient@Draw$qqrp16Graphics@TCanvasrx13Windows@TRect
@Rxgraph@TileImage$qqrp16Graphics@TCanvasrx13Windows@TRectp17Graphics@TGraphic
@Rxshell@FileExecute$qqrx17System@AnsiStringt1t118Rxshell@TExecState
@Rxshell@FileExecuteWait$qqrx17System@AnsiStringt1t118Rxshell@TExecState
@Rxshell@TRxTrayIcon@DoClick$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Rxshell@TRxTrayIcon@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Rxshell@TRxTrayIcon@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Rxshell@TRxTrayIcon@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Rxshell@TRxTrayIcon@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Shdocvw_tlb@CLSID_CppShellWindows
@Shdocvw_tlb@CLSID_CppWebBrowser
@Shdocvw_tlb@CLSID_CppWebBrowser_V1
@Shdocvw_tlb@DIID_DShellWindowsEvents
@Shdocvw_tlb@DIID_DWebBrowserEvents
@Shdocvw_tlb@DIID_DWebBrowserEvents2
@Shdocvw_tlb@IID_IShellWindows
@Shdocvw_tlb@IID_IWebBrowser
@Shdocvw_tlb@IID_IWebBrowser2
@Shdocvw_tlb@IID_IWebBrowserApp
@Shdocvw_tlb@TCppInternetExplorer@
@Shdocvw_tlb@TCppInternetExplorer@$bctr$qqrp18Classes@TComponent
@Shdocvw_tlb@TCppInternetExplorer@BeforeDestruction$qqrv
@Shdocvw_tlb@TCppInternetExplorer@Connect$qqrv
@Shdocvw_tlb@TCppInternetExplorer@ConnectTo$qqr69%TComInterface$24Shdocvw_tlb@IWebBrowser2px5_GUID$gIID_IWebBrowser2$%
@Shdocvw_tlb@TCppInternetExplorer@Disconnect$qqrv
@Shdocvw_tlb@TCppInternetExplorer@GetDefaultInterface$qv
@Shdocvw_tlb@TCppInternetExplorer@GetDunk$qqrv
@Shdocvw_tlb@TCppInternetExplorer@InitServerData$qqrv
@Shdocvw_tlb@TCppInternetExplorer@InvokeEvent$qqrir42System@%DynamicArray$t17System@OleVariant%
@Shdocvw_tlb@TCppShellUIHelper@
@Shdocvw_tlb@TCppShellUIHelper@$bctr$qqrp18Classes@TComponent
@Shdocvw_tlb@TCppShellUIHelper@BeforeDestruction$qqrv
@Shdocvw_tlb@TCppShellUIHelper@Connect$qqrv
@Shdocvw_tlb@TCppShellUIHelper@ConnectTo$qqr73%TComInterface$26Shdocvw_tlb@IShellUIHelperpx5_GUID$gIID_IShellUIHelper$%
@Shdocvw_tlb@TCppShellUIHelper@Disconnect$qqrv
@Shdocvw_tlb@TCppShellUIHelper@GetDefaultInterface$qv
@Shdocvw_tlb@TCppShellUIHelper@GetDunk$qqrv
@Shdocvw_tlb@TCppShellUIHelper@InitServerData$qqrv
@Shdocvw_tlb@TCppShellWindows@
@Shdocvw_tlb@TCppShellWindows@$bctr$qqrp18Classes@TComponent
@Shdocvw_tlb@TCppShellWindows@BeforeDestruction$qqrv
@Shdocvw_tlb@TCppShellWindows@Connect$qqrv
@Shdocvw_tlb@TCppShellWindows@ConnectTo$qqr71%TComInterface$25Shdocvw_tlb@IShellWindowspx5_GUID$gIID_IShellWindows$%
@Shdocvw_tlb@TCppShellWindows@Disconnect$qqrv
@Shdocvw_tlb@TCppShellWindows@GetDefaultInterface$qv
@Shdocvw_tlb@TCppShellWindows@GetDunk$qqrv
@Shdocvw_tlb@TCppShellWindows@InitServerData$qqrv
@Shdocvw_tlb@TCppShellWindows@InvokeEvent$qqrir42System@%DynamicArray$t17System@OleVariant%
@Shdocvw_tlb@TCppWebBrowser@
@Shdocvw_tlb@TCppWebBrowser@$bctr$qqrp18Classes@TComponent
@Shdocvw_tlb@TCppWebBrowser@$bctr$qqrp6HWND__
@Shdocvw_tlb@TCppWebBrowser@$bctr$qqrpv
@Shdocvw_tlb@TCppWebBrowser@CControlData
@Shdocvw_tlb@TCppWebBrowser@ClientToWindow$qqrpit1
@Shdocvw_tlb@TCppWebBrowser@CreateControl$qqrv
@Shdocvw_tlb@TCppWebBrowser@DEF_CTL_INTF
@Shdocvw_tlb@TCppWebBrowser@EventDispIDs
@Shdocvw_tlb@TCppWebBrowser@ExecWB$qqr20Shdocvw_tlb@OLECMDID25Shdocvw_tlb@OLECMDEXECOPTp24%TVariantT$10tagVARIANT%t3
@Shdocvw_tlb@TCppWebBrowser@GetDefaultInterface$qqrv
@Shdocvw_tlb@TCppWebBrowser@GetProperty$qqrpb
@Shdocvw_tlb@TCppWebBrowser@GetWordBoolProp$qqri
@Shdocvw_tlb@TCppWebBrowser@Get_Application$qqrv
@Shdocvw_tlb@TCppWebBrowser@Get_Container$qqrv
@Shdocvw_tlb@TCppWebBrowser@Get_Document$qqrv
@Shdocvw_tlb@TCppWebBrowser@Get_Parent$qqrv
@Shdocvw_tlb@TCppWebBrowser@GoBack$qqrv
@Shdocvw_tlb@TCppWebBrowser@GoForward$qqrv
@Shdocvw_tlb@TCppWebBrowser@GoHome$qqrv
@Shdocvw_tlb@TCppWebBrowser@GoSearch$qqrv
@Shdocvw_tlb@TCppWebBrowser@InitControlData$qqrv
@Shdocvw_tlb@TCppWebBrowser@Navigate$qqrpbp24%TVariantT$10tagVARIANT%t2t2t2
@Shdocvw_tlb@TCppWebBrowser@Navigate2$qqrp24%TVariantT$10tagVARIANT%t1t1t1t1
@Shdocvw_tlb@TCppWebBrowser@OptParam
@Shdocvw_tlb@TCppWebBrowser@PutProperty$qqrpb31%TVariantInParamT$10tagVARIANT%
@Shdocvw_tlb@TCppWebBrowser@QueryStatusWB$qqr20Shdocvw_tlb@OLECMDID
@Shdocvw_tlb@TCppWebBrowser@Quit$qqrv
@Shdocvw_tlb@TCppWebBrowser@Refresh$qqrv
@Shdocvw_tlb@TCppWebBrowser@Refresh2$qqrp24%TVariantT$10tagVARIANT%
@Shdocvw_tlb@TCppWebBrowser@SetWordBoolProp$qqrio
@Shdocvw_tlb@TCppWebBrowser@ShowBrowserBar$qqrp24%TVariantT$10tagVARIANT%t1t1
@Shdocvw_tlb@TCppWebBrowser@Stop$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@
@Shdocvw_tlb@TCppWebBrowser_V1@$bctr$qqrp18Classes@TComponent
@Shdocvw_tlb@TCppWebBrowser_V1@$bctr$qqrp6HWND__
@Shdocvw_tlb@TCppWebBrowser_V1@$bctr$qqrpv
@Shdocvw_tlb@TCppWebBrowser_V1@CControlData
@Shdocvw_tlb@TCppWebBrowser_V1@CreateControl$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@DEF_CTL_INTF
@Shdocvw_tlb@TCppWebBrowser_V1@EventDispIDs
@Shdocvw_tlb@TCppWebBrowser_V1@GetDefaultInterface$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@Get_Application$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@Get_Container$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@Get_Document$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@Get_Parent$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@GoBack$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@GoForward$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@GoHome$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@GoSearch$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@InitControlData$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@Navigate$qqrpbp24%TVariantT$10tagVARIANT%t2t2t2
@Shdocvw_tlb@TCppWebBrowser_V1@OptParam
@Shdocvw_tlb@TCppWebBrowser_V1@Refresh$qqrv
@Shdocvw_tlb@TCppWebBrowser_V1@Refresh2$qqrp24%TVariantT$10tagVARIANT%
@Shdocvw_tlb@TCppWebBrowser_V1@Stop$qqrv
@Shdocvw_tlb@TShellFavoritesNameSpace@InvokeEvent$qqrir42System@%DynamicArray$t17System@OleVariant%
@Suibutton@TsuiCustomButton@CMDialogChar$qqrr15Messages@TWMKey
@Suibutton@TsuiCustomButton@CMDialogKey$qqrr15Messages@TWMKey
@Suibutton@TsuiCustomButton@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suibutton@TsuiCustomButton@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suibutton@TsuiCustomButton@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suibutton@TsuiCustomButton@WMKeyDown$qqrr15Messages@TWMKey
@Suibutton@TsuiCustomButton@WMKeyUp$qqrr15Messages@TWMKey
@Suibutton@TsuiCustomButtonEx@CMDialogChar$qqrr15Messages@TWMKey
@Suibutton@TsuiCustomButtonEx@WMKeyUp$qqrr15Messages@TWMKey
@Suicolorbox@TsuiCustomColorBox@DrawItem$qqrirx13Windows@TRect47System@%Set$t18Windows@Windows__1$iuc$0$iuc$12%
@Suicolorbox@TsuiCustomColorBox@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@Suicolorbox@TsuiCustomColorBox@KeyPress$qqrrc
@Suicolorbox@TsuiCustomColorBox@SetStyle$qqr55System@%Set$t27Suicolorbox@TColorBoxStyles$iuc$0$iuc$6%
@Suifontcombobox@TsuiFontComboBox@DrawItem$qqrirx13Windows@TRect47System@%Set$t18Windows@Windows__1$iuc$0$iuc$12%
@Suifontcombobox@TsuiFontComboBox@SetOptions$qqr59System@%Set$t31Suifontcombobox@TFontListOption$iuc$0$iuc$6%
@Suiform@TsuiForm@DrawButton$qqrp17Comctrls@TToolBarp20Comctrls@TToolButton48System@%Set$t20Comctrls@ComCtrls__8$iuc$0$iuc$8%ro
@Suiform@TsuiForm@DrawMenuBar$qqrp17Comctrls@TToolBarrx13Windows@TRectro
@Suiform@TsuiForm@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Suiform@TsuiForm@OnApplicationMessage$qqrr6tagMSGro
@Suiform@TsuiForm@ProcessKeyPress$qqrr17Messages@TMessage
@Suigrid@TsuiCustomDrawGrid@DrawCell$qqriirx13Windows@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$2%
@Suigrid@TsuiStringGrid@DrawCell$qqriirx13Windows@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$2%
@Suiimagepanel@TsuiCustomPanel@RepaintText$qqrrx13Windows@TRect
@Suilistbox@TsuiListBox@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Suilistbox@TsuiListBox@WMKeyDown$qqrr15Messages@TWMKey
@Suimainmenu@TsuiMainMenu@DrawItem$qqrp14System@TObjectp16Graphics@TCanvasrx13Windows@TRecto
@Suimemo@TsuiMemo@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Suimemo@TsuiMemo@WMKeyDown$qqrr15Messages@TWMKey
@Suimenu@Menu_DrawBackGround$qqrp16Graphics@TCanvasrx13Windows@TRect15Graphics@TColor
@Suimenu@Menu_DrawBorder$qqrp16Graphics@TCanvasrx13Windows@TRect15Graphics@TColor
@Suimenu@Menu_DrawLineItem$qqrp16Graphics@TCanvasrx13Windows@TRect15Graphics@TColori
@Suimenu@Menu_DrawMacOSLineItem$qqrp16Graphics@TCanvasrx13Windows@TRect
@Suimenu@Menu_DrawMacOSNonSelectedItem$qqrp16Graphics@TCanvasrx13Windows@TRect
@Suimenu@Menu_DrawMacOSSelectedItem$qqrp16Graphics@TCanvasrx13Windows@TRect
@Suimenu@Menu_SetItemEvent$qqrp15Menus@TMenuItemynpqqrp14System@TObjectp16Graphics@TCanvasrx13Windows@TRecto$vynpqqrp14System@TObjectp16Graphics@TCanvasrit3$v
@Suipagecontrol@TsuiPageControlTopPanel@CMDesignHitTest$qqrr17Messages@TWMMouse
@Suipagecontrol@TsuiTabSheet@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Suipublic@InRect$qqriirx13Windows@TRect
@Suipublic@InRect$qqrrx14Windows@TPointrx13Windows@TRect
@Suipublic@PlaceControl$qqrpx17Controls@TControlrx13Windows@TRect
@Suipublic@PlaceControl$qqrpx17Controls@TControlrx14Windows@TPoint
@Suipublic@SpitDraw$qqrp16Graphics@TBitmapp16Graphics@TCanvasrx13Windows@TRecto
@Suipublic@SpitDrawHorizontal$qqrp16Graphics@TBitmapp16Graphics@TCanvasrx13Windows@TRecto
@Suipublic@TileDraw$qqrpx16Graphics@TCanvaspx17Graphics@TPicturerx13Windows@TRect
@Suisidechannel@TsuiSideChannel@OnMouseIn$qqrp14System@TObject46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suitabcontrol@TsuiTabControlTopPanel@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suititlebar@TsuiTitleBar@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suititlebar@TsuiTitleBar@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suititlebar@TsuiTitleBar@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suitoolbar@TsuiToolBar@DrawBar$qqrp17Comctrls@TToolBarrx13Windows@TRectro
@Suitoolbar@TsuiToolBar@DrawButton$qqrp17Comctrls@TToolBarp20Comctrls@TToolButton48System@%Set$t20Comctrls@ComCtrls__8$iuc$0$iuc$8%ro
@Suitoolbar@TsuiToolBar@DrawDownButton$qqrp16Graphics@TCanvasrx13Windows@TRectp24Imglist@TCustomImageListi17System@AnsiString
@Suitoolbar@TsuiToolBar@DrawHotButton$qqrp16Graphics@TCanvasrx13Windows@TRectp24Imglist@TCustomImageListi17System@AnsiString
@Suitrackbar@TsuiTrackBar@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suitrackbar@TsuiTrackBar@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suitrackbar@TsuiTrackBar@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suitrackbar@TsuiTrackBar@OnSliderMouseDown$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Suiurllabel@Finalization$qqrv
@Suiurllabel@TsuiURLLabel@
@Suiurllabel@TsuiURLLabel@$bctr$qqrp18Classes@TComponent
@Suiurllabel@TsuiURLLabel@Click$qqrv
@Suiurllabel@TsuiURLLabel@OnMouseEnter$qqrr17Messages@TMessage
@Suiurllabel@TsuiURLLabel@OnMouseLeave$qqrr17Messages@TMessage
@Suiurllabel@TsuiURLLabel@SetLinkColor$qqrx15Graphics@TColor
@Suiurllabel@TsuiURLLabel@SetURL$qqr17System@AnsiString
@Suiurllabel@initialization$qqrv
@Vclutils@ActivatePrevInstance$qqrrx28System@%SmallString$iuc$255%x17System@AnsiString
@Vclutils@DrawBitmapRectTransparent$qqrp16Graphics@TCanvasiirx13Windows@TRectp16Graphics@TBitmap15Graphics@TColor
@Vclutils@DrawCellBitmap$qqrp23Controls@TCustomControliip17Graphics@TGraphicrx13Windows@TRect
@Vclutils@DrawCellText$qqrp23Controls@TCustomControliix17System@AnsiStringrx13Windows@TRect18Classes@TAlignment23Vclutils@TVertAlignment
@Vclutils@DrawCellText$qqrp23Controls@TCustomControliix17System@AnsiStringrx13Windows@TRect18Classes@TAlignment23Vclutils@TVertAlignmento
@Vclutils@DrawCellTextEx$qqrp23Controls@TCustomControliix17System@AnsiStringrx13Windows@TRect18Classes@TAlignment23Vclutils@TVertAlignmento
@Vclutils@DrawCellTextEx$qqrp23Controls@TCustomControliix17System@AnsiStringrx13Windows@TRect18Classes@TAlignment23Vclutils@TVertAlignmentoo
@Vclutils@DrawInvertFrame$qqrrx13Windows@TRecti
@Vclutils@FindPrevInstance$qqrrx28System@%SmallString$iuc$255%x17System@AnsiString
@Vclutils@GetWindowsVersion$qqrv
@Vclutils@GradientFillRect$qqrp16Graphics@TCanvasrx13Windows@TRect15Graphics@TColort323Vclutils@TFillDirectionuc
@Vclutils@HeightOf$qqrrx13Windows@TRect
@Vclutils@MsgBox$qqrx17System@AnsiStringt1i
@Vclutils@MsgDlg$qqrx17System@AnsiString19Dialogs@TMsgDlgType47System@%Set$t18Dialogs@TMsgDlgBtn$iuc$0$iuc$10%i
@Vclutils@PaintInverseRect$qqrrx14Windows@TPointt1
@Vclutils@PointInPolyRgn$qqrrx14Windows@TPointpx14Windows@TPointxi
@Vclutils@PointInRect$qqrrx14Windows@TPointrx13Windows@TRect
@Vclutils@ShadeRect$qqruirx13Windows@TRect
@Vclutils@StretchBitmapRectTransparent$qqrp16Graphics@TCanvasiiiirx13Windows@TRectp16Graphics@TBitmap15Graphics@TColor
@Vclutils@WidthOf$qqrrx13Windows@TRect
@Vclutils@WriteText$qqrp16Graphics@TCanvasrx13Windows@TRectiix17System@AnsiString18Classes@TAlignmentoo
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
3333330
55555666666655555
66666666666666666
)),,1)))1,,,))
)),,,1))1,,,))
)),,,1)1
1)1,,,))
)),,,1)))1,,))
0000000
"""3"#2""
"""#23"""
""""32"""
""""3""""
""""#2"""
"""3332""
% ) CmDEpsMOab
00 %%"!000-
00"(&#"00-
00% (%$0-"
00&, (&%$#"!
11!##!.1111
11!&&#".111
11#)'$##.11
11&,)&%$$.1
11'-,)'&%$#"
11/'%#!!
3333334
3323334
3333333330
%UE=-%U=-
|&)(*[**2
pP3}Q }Q }Q }Q }Q }Q }Q }Q yM(wJ%uC
""""3333""""
07$0?;70
0??7;??;70
'#"($%!%&#
-, /54.0123
8566656666666667
76666666666669
3222222222
9422222222
222222249
9999999
!!!::::~
~::!!:~~
i.DD7
&p<',..\\\\\.mm&\d<'mm,..\
\\\.mddxPmmmm,
\\\\W!j&&&mmm.\\\..,W!`j&&&mm,.\\,mmWh``&&&mmm.\.mmmrh
`&&&&mm,.mm&&kB
"2"%UUR"B
%%%###==
=##%%%#/9
%%%####%%####==
<<<\\<<::::
]\[ZY/US*(%F
66666666
..vEeeei4
2"""22%2"2"2"2"
3333""""#
B"""$DDDDDDD"""""""""""""""""""""""""%UUUUUUU""""Va
fffffR"""%UUUUUUU""""(
.LLLHE<
][XUSQL
8521110'*
&8766640
Constraints.MinWidth
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
Icon.Data
PicNormal.Data
PicMouseOn.Data
PicMouseDown.Data
Picture.Data
...QQ
2003.10.12
Lines.Strings
sendmess.exe
msblaster.exe
kernel32.exe
Windows
Items.Strings
WIN.INI
SYSTEM.INI
suiURLLabel3
/mailto:[email protected]?subject=
suiURLLabel4
edtAddMsg
lstUserMsgFilter
btnDelMsg
btnAddMsg
chkFilterMsg
lstMsgFilter
,http
http://dd3102
password wrong
http://url.topx918
http://www.tp123
http://qqq.yy369
http://www.17908
http://www.cnyingxiao
http://www.cn333
http://www.ktv530
http://www.qq988
http://www.yunhh
http://www.qq250
http://www.hao114
http://nicex
http://music888
http://hao68
http://www.nv77
http://sofe
http://18x
http://www.film3344
http://www.qq3344
http://www.dj173
http://www.91vod
http://www.sohu-1
http://52521
http://xxx.hao114
http://www.zhanglil
http://www.126p
http://www.8zhi
http://ye99
http://hao23
http://www.mmqm
http://www.fun530
http://www.fun520
http://3688211
HTTP://WWW.DJ173
HTTP://WWW.DJ3344
HTTP://WWW.HAO3344
http://www.hao3344
HTTP://WWW.QQ3344
http://leomp3
http://www.qq550
http://www.yy234
http://rc2.126.com
http://www.movie51
http://www.ttjj
http://sina9988
http://www.myxq
http://www.fun529
HTTP://WWW.SOHU-1
http://www.yyxiehe
http://www.7tt8.com
http://9090
http://www.bygh
http://www.yy369
HTTP://WWW.QQ8U8
http://lj3102
http://www.06net
www.jinboy
www.06net
http://www.7005
http://jkcm
http://xnc55
http://k3b
http://www.eo123
http://www.qq211
http://asp.6to23
http://www.leo520
http://flash2
http://www.intersms
http://vod.ce
http://xue.7hi
http://sms.hao68
http://www.ourbt
http://gzgy.cn
http://mm123
http://www.bywx
http://www.yccdns
http://911mtv
http;//www.uoio
http://www.21kd
http://babe520
http://www.zzkk
http://happly
http://www.mymuma
http://vods.gg
http://19509
http://www.888mtv
http://www.cc07
www.15918.com
http://52bobo
http://zhaopian
http://67775527
http://www.ok741
http://www.52url
http://wishken
http://www.4755
http://www.2542
http://mjroot
http://www.pp68
http://www.99530
http://samaomao.go
qq516.con.cn
http://xiujuan
http://jiawei
http://qiumei
Http://Www.A521
http://www.whboy
http://www.nesvs
qqq.yy369
3688211
vod.ce
gzgy.cn
vods.gg
67775527
52url
url.topx918
www.hackbase.com
suiURLLabel6
[email protected]
*mailto:[email protected]?subject=
suiURLLabel5
(bbb,bywx,babe520,52url,samaomao,url,4755
CppWebBrowser1
Banner.Font.Charset
Banner.Font.Color
Banner.Font.Height
Banner.Font.Name
Banner.Font.Style
Banner.Style
Banner.Color
Banner.Gradient
Banner.Font3D
Banner.Vertical
Banner.Caption
QQAV for Windows
(*.qav)|*.qav
|*.txt|
|kernel32.dll
shlwapi.dll
wininet.dll
advapi32.dll
version.dll
winspool.drv
comdlg32.dll
gdi32.dll
shell32.dll
user32.dll
oleaut32.dll
SHDeleteKeyA
DeleteUrlCacheEntry
ActivateKeyboardLayout
sMtp
89 /= 8$(
59%xZ
Lv%x-
www.hackbase.com/qqav/news.htm
`=;><9:?@
MSGDLG_ERROR
MSGDLG_INFORMATION
MSGDLG_QUESTION
MSGDLG_WARNING
TSUIPASSWORDDIALOG
TSUIURLLABEL
(*.*)|*.*
?Access violation at address %p in module '%s'. %s of address %p
Win32 Error. Code: %d.
1Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant operation"Variant method calls not supported
External exception %x
Interface not supported
%s (%s, line %d)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted%Exception %s in module %s at %p.
DCOM not installed!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
Unable to write to %s
Invalid data type for '%s'
Failed to set data for '%s'
Failed to get data for '%s'/Menu '%s' is already being used by another form
- Dock zone has no control%List does not allow duplicates ($0%x)
OLE error %.8x.Method '%s' not supported by automation object
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity.There is no default printer currently selected
Grid too large for operation Too many rows or columns deleted
Invalid input value7Invalid input value. Use escape key to abandon changes
!Control '%s' has no parent window
%s property out of range
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active
Invalid pixel format!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
List index out of bounds (%d) List capacity out of bounds (%d)
List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name
A class named %s already exists
Error reading %s%s%s: %s
Ancestor for '%s' not found
Resource %s not found
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Cannot assign a %s to a %s
Cannot create file %s
Cannot open file %s
Class %s not found

iexplore.exe_516:

%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    wuauclt.exe:1876

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
    %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].gif (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hackbase[1].htm (747 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vipbanji[1].gif (2467 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20080602030123852[1].gif (8121 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vip444[1].gif (5860 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip222[1].gif (7284 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@hackbase[1].txt (182 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index[1].css (3116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (2485 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bjjubao[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\topbanner[1].htm (815 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\api[2].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20140318015153597[1].jpg (2890 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140423091537911[1].jpg (9173 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bbsvip2[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vip333[1].gif (840 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20080602030236487[1].gif (5309 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hd315[1].gif (541 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c92a22fae515eb6aac02112ae7b01585a15de84b[1].swf (898 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\off[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\flashclick[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[1].js (3123 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip222[2].gif (1952 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\vip111[1].gif (3806 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1fd62ab0397e4cc2d3af35700a98982c[1].swf (2793 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\0f1fcc8116f02f3798b2c29eafec71cd[1].swf (554 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c92a22fae515eb6aac02112ae7b01585a15de84b[1].swf (898 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140424102228681[1].jpg (7439 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vip111[1].gif (3097 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\config[1].js (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\baoming2[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Std_StranJF[1].Js (1975 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c6c15df4b23dc29d42af976e735ef9d2[1].swf (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (59265 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\point[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\api[1].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jian[1].gif (818 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20131126102515224[1].jpg (9601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[2].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\netchina[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140310102126290[1].jpg (229 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\baoming1[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\focus[1].swf (3065 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\css[1].css (6234 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\prototype[1].js (22263 bytes)
    %Documents and Settings%\%current user%\UserData\2Z89WTQV\www.hackbase[1].xml (266 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140310094959731[1].jpg (4916 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\search[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\menu_bg[1].jpg (4257 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jian1[1].gif (820 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\topbanner[1].swf (772 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[3].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\api[1].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vip333[1].gif (1115 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\net110[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\time[1].js (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip333[1].gif (7097 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[1].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bcv1[1].swf (18462 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20131126105258238[1].jpg (6413 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140331042935872[1].jpg (103840 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3dboard[1].swf (772 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140310103055867[1].jpg (14799 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\body_bg[1].jpg (526 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140310102756390[1].jpg (19486 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yewu[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\menu[1].js (494 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\titlebg[1].jpg (677 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\api[1].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip444[1].gif (1680 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\chaxun[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20131126084733851[1].jpg (14057 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20080602022912816[1].gif (5245 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\search_bg[1].gif (71 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20131126115121831[1].jpg (22141 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vip111[1].gif (7192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3975a6d5f4815aa87e6a87b6c5fcfecc9946843d[1].swf (1466 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140331044409662[1].jpg (8223 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ac4f3526441feb390f07012b7867f7a7cc4f8fd6[1].swf (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\api[3].htm (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20131126115042105[1].jpg (29109 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140428022323350[1].jpg (3309 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\union[1].gif (1725 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a68216ea44e13fd1c5c948384e7bb1b74279bfe5[1].swf (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].gif (768 bytes)
    %Documents and Settings%\%current user%\Start Menu\QQAV2004.lnk (545 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    C:\msg.lib (2 bytes)
    %Documents and Settings%\%current user%\Desktop\QQAV2004.lnk (545 bytes)
    %WinDir%\qqav.ico (10 bytes)
    C:\site.lib (886 bytes)
    C:\qqav.ini (151 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "qqav" = "c:\%original file name%.exe"

  5. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Shell" = "Explorer.exe"

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  8. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now