Trojan.Win32.Swrort.3_cf6d664569

by malwarelabrobot on June 14th, 2014 in Malware Descriptions.

Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: cf6d664569e29b3cce4d5140169646ba
SHA1: 88809a3769fb163bc53b1b18b5e18b885158147b
SHA256: d6161dc96f6052597b4953475ac4c49b5af857fb85d8b0ac8e5c1980d3326488
SSDeep: 6144:gPlCsv0sJxXBboisxGEZd8cEH39hUrHsQReRZzNbaK1UmGEj4kLdmfhh/l0Y:gt/JLBbfC/dqCsQR0zNlTGrIM/ Y
Size: 443264 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-11-19 22:58:43
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

TPAutoConnSvc.exe:1652
65medint.exe:3812
65medint.exe:3408
65medint.exe:3432
65medint.exe:3000
65medint.exe:2408
DllHost.exe:3672
DllHost.exe:3032
DllHost.exe:3280
AppIntegrator64.exe:3920
chrome.exe:3348
chrome.exe:4052
chrome.exe:3328
chrome.exe:2560
chrome.exe:1960
chrome.exe:3684
chrome.exe:1932
chrome.exe:3132
chrome.exe:296
chrome.exe:1448
FromDocToPDFSetup.exe:3832
%original file name%.exe:1552
65brmon64.exe:4000
00000ef8T8SETUP.EXE:3872
rundll32.exe:3000
UPDATER.EXE:1888
65srchmn.exe:3928

The Trojan injects its code into the following process(es):

assist.exe:3624
CrExtP65.exe:1352
CrExtP65.exe:3852
CrExtP65.exe:2788
firefox.exe:3420
IEXPLORE.EXE:3092
IEXPLORE.EXE:556

File activity

The process 65medint.exe:3812 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\spinner.gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\css\nl.css (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\swf\UploadButton.swf (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PDFToDOC.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\DocToPDF.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\manifest.json (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\manifest.json (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\App.html:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\ArrowConverting.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\Background.html (706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\sprite.png (33 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\js\Widget.js (3249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\icon.png (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\js\Background.js (2425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\lang-en.js:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\css\App.min.css (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\fonts\cabin.eot (1137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\Background.html:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PDFToDOC.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PDFToDOC.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PageToPDF.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\logo.bmp (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\rateUISprite.png (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\css\PDFConverter.css (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PageToPDF.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\lang-en.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006CC82.zip (10160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\App.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\pdf_rate.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\App.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PageToPDF.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\lang-en.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\fonts\cabin.woff (1137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\DocToPDF.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\Background.html (706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\logo.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.uf1 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\icon.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\swf\UploadButtonIE6.swf (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\js\Review.js (2425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\DocToPDF.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\manifest.json:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.ufm (884 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\lang-en.js (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006CC82.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\App.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\Background.html (0 bytes)

The process 65medint.exe:3000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo-unbranded.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\background.html (385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddy_SpeechBubble.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\js\Background.js (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddy_SpeechBubble.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\manifest.json:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\lang-en.js (148 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\background.html:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\lang-en.js (148 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddyLogo.bmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.ufm (896 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\background.html (385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\lang-en.js:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006CFEB.zip (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo-unbranded.png (894 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\manifest.json (817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.uf1 (924 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\manifest.json (817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddyLogo.png (2 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006CFEB.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\lang-en.js (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\background.html (0 bytes)

The process 65medint.exe:2408 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\swf\UploadButtonIE6.swf (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\logo.bmp (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\pdf_rate.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\DocToPDF.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PDFToDOC.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\js\Widget.js (3249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\manifest.json:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\icon.png (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\js\Review.js (2425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PDFToDOC.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\lang-en.js:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\fonts\cabin.eot (1137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\Background.html (706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\manifest.json (854 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\App.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PDFToDOC.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PageToPDF.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\rateUISprite.png (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\ChromeReview.html (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.ufm (482 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\Background.html:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\css\nl.css (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\css\PDFConverter.css (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\ChromeReview.html:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PageToPDF.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\App.html:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\App.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\css\App.min.css (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\icon.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006C88C.zip (10160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.uf1 (478 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\js\Background.js (2425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\Background.html (706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\ChromeReview.html (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\ArrowConverting.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PageToPDF.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\lang-en.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\spinner.gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\sprite.png (33 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\swf\UploadButton.swf (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\logo.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\manifest.json (854 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\DocToPDF.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\DocToPDF.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\fonts\cabin.woff (1137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\lang-en.js (2 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\lang-en.js (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\App.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006C88C.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\Background.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\ChromeReview.html (0 bytes)

The process AppIntegrator64.exe:3920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR64.DLL (356 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL (20 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll (294 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\Hpg64.dll (442 bytes)

The process chrome.exe:3328 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\searchupdater (1388 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\T8SQL.DLL (90 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\SQLITE3.DLL (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\searchupdater (92 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\UPDATER.EXE (512 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp (0 bytes)

The process chrome.exe:1960 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_3 (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\18A2.tmp (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\3BFC.tmp (151 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal (18810 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\921B.tmp (127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6FF8.tmp (742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Shortcuts (384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx (7345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\44B3.tmp (104 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\History (8588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\9518.tmp (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\README (180 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_fromdoctopdf.dl.tb.ask.com_0.localstorage-journal (5114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\1892.tmp (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal (5077 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000006.log (612 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\65ChromePlugIn.dll (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\Cookies-journal (12786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs-journal (4533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\69E5.tmp (152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon128.png (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000004 (149 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon16.png (622 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log (152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\History-journal (23396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Current Tabs (1960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\index (368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\45CD.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Visited Links (272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon48.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\etilqs_LNZwDGmAhuv8MSF (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\manifest.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\69C5.tmp (152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Current Session (15109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9M3PV1TAC9J4O5LRPVBN.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6984.tmp (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dhhjmlmdpcpiojiffodbldlkgcnaeogp_0.localstorage (839 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6B07.tmp (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\187E.tmp (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_0 (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Favicons (2040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_2 (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log (228 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6994.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\Cookies (595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales (4 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645 (1).crx (284074 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal (17330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 (14432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 (5864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 (466240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 (154904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\187F.tmp (133 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies (298 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal (3764 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000004.dbtmp (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TQGE4QRB1YR6ZS3KBT6W.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6A19.tmp (126 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\1890.tmp (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\6AE7.tmp (127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\BC29.tmp (127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\1891.tmp (108 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000005.ldb (590 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dhhjmlmdpcpiojiffodbldlkgcnaeogp_0.localstorage-journal (9642 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1G4DF906P1N5ZI172EX.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon19on.png (702 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cookies (16231 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx (21128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_fromdoctopdf.dl.tb.ask.com_0.localstorage (226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\69F9.tmp (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal (7549 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019 (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000018 (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000013 (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\Cache\data_1 (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000017 (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000016 (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000015 (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000014 (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\69F8.tmp (56 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs (778 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_TW\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_TW (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\DECODED_MESSAGE_CATALOGS (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\7F36.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\69E7.tmp~RF769e9.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\tr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000002 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_PT\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_CN\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_TW (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_PT\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_CN\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms~RF67f3d.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_CN\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\20D1.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_BR (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_GB (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF7449d.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_PT\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\he (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\hi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\hu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\hr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_BR\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State~RF769c9.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\sl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\Y4596ZS3\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\ca (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_PT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_US\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__MACOSX (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_US (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT~RF6816e.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms~RF6f47b.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\uk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_US\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_GB\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_TW\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF7697b.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms~RF76a17.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\index (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\lt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\th (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_TW\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Protected Preferences~RF7698b.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon16.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF76a17.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_GB\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOG (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF7186f.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\fil (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\7F25.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\pt_BR (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF769e9.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_BR (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\id (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\it (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\pt_PT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\20D2.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon19on.png (0 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State~RF66ae2.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir_1960_3001 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\ro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_BR\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\ru (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_PT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity~RF67001.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\ja (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_TW (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_BR\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon128.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\da (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\de (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF7188e.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\45CD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\CURRENT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__MACOSX\_locales (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Protected Preferences~RF7187f.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_1 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_2 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\vi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\no (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\nl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_BR (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\ar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000002 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_PT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\sk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_GB (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\sr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\sv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State~RF6bc2d.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_US (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_BR (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_CN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_PT\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\bg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\en (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\el (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\es (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\MANIFEST-000002 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\zh_TW (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF66b01.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_PT (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_TW\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Protected Preferences~RF7188e.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_TW (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000003.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\DECODED_IMAGES (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\fi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\fr (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State~RF73be7.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF7187f.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF6951d.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\pl (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__MACOSX (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_CN\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State~RF69221.TMP (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_BR\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000013 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\lv (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales\ko (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon48.png (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca (0 bytes)

The process chrome.exe:1932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\Widget.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\html\movieReviews.html (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\focusManager.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\weather\css\weatherButton.css (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-parser.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\jquery-1.7.1.min.js (6984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\underscore-1.3.1.min.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\testWidget.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\extension_toolbar_api.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\common.js (251 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-widget.js (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\foreground\button.js (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\exeManager.js (789 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\js\widget.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\mutation_summary-min.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\unifiedLogging.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\list-interaction.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\images\right_arrow_white.png (962 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbarUI.js (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\weather\background\weatherButton.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\buildVars.js (55 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\tvf_icon_guide.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\background\FlareWidget.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\js\topapps-config.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestions.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\07_buttons2.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\underscore-1.3.1.min.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\images\right_arrow.png (963 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\DECODED_MESSAGE_CATALOGS (24 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\globalBlacklistManager.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\supertab.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\scriptInjector.js (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868131.png (391 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\eventListening.js (586 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widget-context-1.0.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\list-interaction.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\readLocalStorage.js (339 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbar.js (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\hiddenWidgetWindow.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\radioWrapper\radioWrapper.html (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\srchsugg.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\reservespaceifenabled.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\unifiedLogging.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\js\embedScriptUI.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\underscore-1.3.1.min.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon16.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\set.js (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\background\ApiBasedWidget.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\toolbarPreinit.js (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_restart_alert_icon.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\qunit.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\plugins\65ChromePlugIn.dll (3656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\config.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\__utm.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\weather\js\weather.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\weather\weatherButton.html (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\magnifying_glass.png (234 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\widgetFactory.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\newTabInfo.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\plugins\SearchControl.dll (59304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\js\rss-widget.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestions.css (889 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\html\innerEmbedScriptTemplate.html (996 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\contentScript.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon48.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\navRedirector.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868103.png (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\abstractbutton\background\abstractButton.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\widgetWindowManager.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon128.png (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\background\RadioWidget.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\rss\background\RssWidget.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\manifest.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\RadioPlayerSprite.png (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\reservespacefortoolbar.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\search_button.png (844 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\tb_icon_search_disappearing_ask.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\html\innerEmbedHtmlTemplate.html (420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\html\embedScriptTemplate.html (532 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\html\supertab.html (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\html\embedHtmlTemplate.html (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\exePackageManager.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\resource.xml (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\jquery.js (15336 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\IDR_WEBSTORE_ICON.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\searchContext.js (758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\mutation_summary.js (3656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\background\MovieReviewsWidget.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\js\rss-widget-custom.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\css\supertab.css (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\icons\Thumbs.db (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\js\movieReviews.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\css\toolbar-item.css (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\enableDetect.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\common.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\defaultSearchModalInjector.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868101.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\alert\background\alertButton.js (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\menuframe.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\query-string.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\background\updateSearch.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\PartnerId.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-custom.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\DECODED_IMAGES (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\tvf_logo.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\contentScript.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\superFrame.js (745 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\css\radio-widget.css (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_btn_ok.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\css\movieReviews.css (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\defaultSearchModal.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868170.png (398 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\invalid.json (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\universalConsole.js (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\radioWrapper\radioWrapper.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\radio-widget.html (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\link\background\linkButton.js (697 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\css\widget.css (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\background\updateSearchPromptBg.js (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\underscore-1.5.2.min.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\08_buttons2.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868104.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\eventListening.js (586 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\utils.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\js\rss-widget-parse.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\blacklistService.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_restart_icon.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbar.html (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon19disabled.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-widget-ui.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868129.png (375 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\js\nanigans-topapps-feed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\rssWidget.html (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\html\menuframe.html (956 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\resource.json (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\README.txt (227 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\down_arrow.png (959 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\generic\background\GenericWidget.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\testWidget.html (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\set.js (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestions.html (811 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\dynamic.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\messaging.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\arrowSprite.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\background\searchBox.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\initWidgetWindow.js (802 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\widget.html (727 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\widgetWindow.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\background\menuButton.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\IDR_PRODUCT_LOGO_16.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\unifiedLogging.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\hiddenWidgetWindow.html (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbarUI.html (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\toolbarCookieParser.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\background\embedHtmlWidget.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\options.html (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\wrench.png (398 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\rsvp-latest.js (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\URILoaderContentScript.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\icons\Icon_Flare_pink.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbarUI.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\global.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\background\embedScriptWidget.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\newtabfork.js (841 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868145.png (264 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\updateSearchPromptFg.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon19on.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868130.png (364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\css\menuframe.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\defaultSearchModalInjector.css (522 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\hiddenWidgetWindowInit.js (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\widgetWindow.html (788 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\chromeUtils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\reporting.js (55 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\paramReplacer.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\qunit.js (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\adapter\widget-adapter.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\icons\Icon_Flare_blue.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestionsInit.js (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\jquery-1.7.1.min.js (6984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\adapter\adapterUtil.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\js\embedHtmlUI.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\jquery-1.7.1.min.js (6984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\messageEventListener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\thirdparty\background\thirdPartyWidget.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\underscore-1.3.1.min.js (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\uninstall\background\uninstallButton.js (717 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_btn_ok2.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\options.js (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\background\widget-api-impl.js (776 bytes)

The process chrome.exe:296 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\Y4596ZS3\macromedia.com\support\flashplayer\sys\settings.sxx (3058 bytes)

The process assist.exe:3624 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q2J2PH9N\assist_exe[1] (752 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIKAEOYB\assist_exe[1] (673 bytes)

The process FromDocToPDFSetup.exe:3832 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00000ef8T8SETUP.EXE (216121 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00000ef8T8SETUP.EX_ (6 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00000ef8T8SETUP.EXE (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00000ef8T8SETUP.EX_ (0 bytes)

The process %original file name%.exe:1552 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISb.dll (1617 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dll (15219 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EIPlug.dll (2185 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dl_ (300 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISb.dl_ (40 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EIPlug.dl_ (45 bytes)

The Trojan deletes the following file(s):

%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dl_ (0 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISb.dl_ (0 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EIPlug.dl_ (0 bytes)

The process 65brmon64.exe:4000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brstub64.dll (77 bytes)

The process 00000ef8T8SETUP.EXE:3872 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ (192 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65datact.dll (323 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bar.dll (1744 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65mlbtn.dll (194 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML (491 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 (7936 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\Settings\s_pid.dat (34 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65barsvc.exe (178 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\EXEMANAGER.DLL (973 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (152014 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR.DLL (610 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65dlghk64.dll (119 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65hkstub.dll (59 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\FF-NativeMessagingDispatcher.dll (250 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CREXT.DLL (50 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll (422 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SrcAs.dll (139 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65dlghk.dll (203 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SrchMn.exe (112 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (97 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65auxstb64.dll (65 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brstub64.dll (74 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8HTML.DLL (380 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\APPINTEGRATORSTUB.DLL (503 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skin.dll (406 bytes)
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 (1384 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll (290 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8EXTEX.DLL (200 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65feedmg.dll (282 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\chrome\65ffxtbr.jar (3361 bytes)
C:\Windows\System32\config\SECURITY (1120 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\UNIFIEDLOGGING.DLL (635 bytes)
C:\$Directory (1072 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\install.rdf (2 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65regiet.dll (169 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CHROME.MANIFEST (1 bytes)
C:\Windows\System32\config\SYSTEM.LOG1 (4395 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brmon.exe (126 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\IE9Mesg\COMMON.T8S (446 bytes)
C:\Windows\System32\config\SECURITY.LOG1 (1048 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65medint.exe (12 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\APPINTEGRATOR.EXE (421 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\Message\COMMON.T8S (103 bytes)
C:\Windows (384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\installKeys.js (216 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65script.dll (202 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65htmlmu.dll (406 bytes)
C:\System Volume Information\Syscache.hve.LOG1 (10464 bytes)
C:\Boot\BCD (2080 bytes)
C:\Windows\System32\config\SOFTWARE (157100 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE (206 bytes)
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT (1592 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65idle.dll (126 bytes)
C:\Users\"%CurrentUserName%"\ntuser.dat.LOG1 (3904 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\VERIFY.DLL (135 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\LOGO.BMP (10 bytes)
C:\Windows\System32\config\COMPONENTS (1461 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65auxstb.dll (112 bytes)
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT (2256 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65ieovr.dll (73 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65srchmr.dll (83 bytes)
C:\System Volume Information\Syscache.hve (10886 bytes)
C:\Windows\System32\config\DEFAULT.LOG1 (7096 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe (28 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\BOOTSTRAP.JS (20 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65regfft.dll (162 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65Plugin.dll (218 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skplay.exe (55 bytes)
C:\Windows\System32\config\SYSTEM (3738 bytes)
C:\Windows\System32\config\COMPONENTS.LOG1 (2122 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\bootstrap.js (20 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\gen1\COMMON.T8S (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\chrome.manifest (1 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65reghk.dll (152 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65tpinst.dll (359 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL (15 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\TPIMANAGERCONSOLE.EXE (159 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\Hpg64.dll (438 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brstub.dll (128 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\installKeys.js (216 bytes)
C:\Boot\BCD.LOG (1768 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe (972 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8RES.DLL (396 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL (17 bytes)
C:\Windows\System32\config\DEFAULT (7944 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8EPMSUP.DLL (158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat (8992 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8EXTPEX.DLL (210 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65httpct.dll (291 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CrExtP65.exe (1 bytes)
C:\Users\"%CurrentUserName%"\NTUSER.DAT (4992 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\INSTALL.RDF (2 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR64.DLL (352 bytes)
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 (1168 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8TICKER.DLL (340 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\DPNMNGR.DLL (579 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brmon64.exe (144 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\chrome\65ffxtbr.jar (548 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bprtct.dll (233 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (0 bytes)

The process rundll32.exe:3000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC (1520 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\files.ini (2155 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_7E268BB06E85E1B6722E01F49268E12F (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1504 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\setups\FromDocToPDFSetup.exe (2969170 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_7E268BB06E85E1B6722E01F49268E12F (1520 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\000680F1.exe (662259 bytes)

The Trojan deletes the following file(s):

%Program Files% (x86)\FromDocToPDF_65EI (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr (0 bytes)
%Program Files% (x86)\FromDocToPDF_65EI\Installr\setups\FromDocToPDFSetup.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache (0 bytes)

The process firefox.exe:3420 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\_CACHE_CLEAN_ (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\storage\persistent\moz-safe-about home\idb\818200132aebmoouht.sqlite-journal (11855 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\etilqs_gd6egbKBgyti3of (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\places.sqlite-wal (25037 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_002_ (10248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\0\62\B2A53d01 (6111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple-1.cache (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\webappsstore.sqlite-wal (2668 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF\manifest.mf (1850 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-phish-shavar.pset (394 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\addons.json.tmp (24 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple.pset (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple.sbstore (464 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\cert8.db (8856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\plugins\NativeMessagingDispatcher.dll (9598 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\storage\persistent\moz-safe-about home\idb\818200132aebmoouht.sqlite (12120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple.cache (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\localstore-1.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\F\95\9139Cd01 (8137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\1\59\C3913d01 (754 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\9\37\B8611d01 (2629 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\cookies.sqlite-wal (135640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\sessionCheckpoints.json.tmp (143 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\thumbnails\b00ebab23e841db1dff7111c7248d790.png.tmp (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple-1.sbstore (436 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-phish-shavar.sbstore (13481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\compatibility.ini (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\pluginreg.dat.tmp (2272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs-1.js (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp-d1v.xpi (77660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\cookies.sqlite (12024 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-phish-shavar.cache (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\permissions.sqlite-journal (9000 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\etilqs_QbC499h9vA9Vemg (568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple.cache (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\8\E1\FD2A8d01 (953 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\install.rdf (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\chrome.manifest (664 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite (47563 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\7\09\7975Dd01 (154241 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-malware-shavar.pset (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple.sbstore (464 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-malware-shavar.sbstore (15174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite-journal (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-malware-shavar.cache (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp-xsk.xpi (164759 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_001_ (44368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\8\6D\F3711d01 (11226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\chrome\65ffxtbr.jar (3112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\permissions.sqlite (4032 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple-1.sbstore (436 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\bootstrap.js (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini.tmp (141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_MAP_ (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.rsa (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_003_ (9080 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\install_no_bootstrap.rdf (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple.pset (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\places.sqlite (10744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\sessionstore.js.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\webapps\webapps.json.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite-wal (145432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple-1.cache (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.sf (2 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite-journal (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\storage\persistent\moz-safe-about home\idb\818200132aebmoouht.sqlite-journal (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\installKeys.js (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete\test-malware-simple.sbstore (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\META-INF (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete\test-malware-simple.pset (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\plugins (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete\test-malware-simple.cache (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\chrome (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete\test-phish-simple.sbstore (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\plugins (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\bootstrap.js (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\permissions.sqlite-journal (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\chrome (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\chrome (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete\test-phish-simple.pset (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\plugins\NativeMessagingDispatcher.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\META-INF\manifest.mf (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.sf (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\install.rdf (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp-xsk.xpi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\META-INF (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.rsa (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\chrome\65ffxtbr.jar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\chrome.manifest (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\startupCache\startupCache.4.little (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\install_no_bootstrap.rdf (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp-d1v.xpi (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com\plugins (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete\test-phish-simple.cache (0 bytes)

The process UPDATER.EXE:1888 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (7904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data (1518 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\T8SQL.DLL (94 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\searchupdated (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\SQLITE3.DLL (491 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\UPDATER.EXE (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\T8SQL.DLL (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\SQLITE3.DLL (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\searchupdater (0 bytes)

The process 65srchmn.exe:3928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65srchmr.dll (86 bytes)
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65hkstub.dll (61 bytes)

Registry activity

The process TPAutoConnSvc.exe:1652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:2]
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"

[HKU\.DEFAULT\Printers\DevModes2]
"HP LaserJet Professional M1212nf MFP#:2" = "48 00 50 00 20 00 4C 00 61 00 73 00 65 00 72 00"

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:2]
"DelAfterCreate" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:2]

The process 65medint.exe:3812 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing" = "1C 00 00 00 01 00 00 00 DE 07 06 00 05 00 0D 00"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process 65medint.exe:3408 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"newTab" = "2"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

The process 65medint.exe:3432 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8}]
"DisplayName" = "Ask Web Search"
"URL" = "http://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^yyyyyy^YYA^ua&ptb=7BE109F9-E265-40DB-885D-AC3553B091B9&ind=2014061306&n=780c22fa&psa=&st=sb&searchfor={searchTerms}"
"(Default)" = "FromDocToPDF_65"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"DSS" = "{9a216821-0ec5-49a3-85ac-fb72ae79a1e8}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8}]
"ShowSearchSuggestions" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8}]
"SuggestionsURL_JSON" = "http://ssmsp.ask.com/query?li=ff&sstype=prefix&q={searchTerms}"

The process 65medint.exe:3000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing" = "1C 00 00 00 01 00 00 00 DE 07 06 00 05 00 0D 00"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process 65medint.exe:2408 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF" = "01 00 00 00 00 00 00 00 02 49 FE 47 EF 86 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing" = "1C 00 00 00 01 00 00 00 DE 07 06 00 05 00 0D 00"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process DllHost.exe:3672 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 1A 00 00 00 09 00 00 00 00 00 00 00"

The process DllHost.exe:3032 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 1C 00 00 00 09 00 00 00 00 00 00 00"

The process DllHost.exe:3280 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 1B 00 00 00 09 00 00 00 00 00 00 00"

The process AppIntegrator64.exe:3920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32]
"qagentrt.dll,-10" = "System Health Authentication"
"fveui.dll,-843" = "BitLocker Drive Encryption"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32]
"fveui.dll,-844" = "BitLocker Data Recovery Agent"

The process chrome.exe:3348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:4052 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:3328 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:2560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:1960 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B3 9E 80 5B EF 86 CF 01"
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"experiment_labels" = "CrVar1=3310648|Fri, 13 Jun 2015 10:06:57 GMT;CrVar2=3310705|Fri, 13 Jun 2015 10:06:57 GMT;CrVar3=3312169|Fri, 13 Jun 2015 10:06:57 GMT;CrVar4=3300161|Fri, 13 Jun 2015 10:06:57 GMT;CrVar5=3300154|Fri, 13 Jun 2015 10:06:57 GMT;CrVar6=3300051|Fri, 13 Jun 2015 10:06:57 GMT;CrVar7=3300125|Fri, 13 Jun 2015 10:06:57 GMT;CrVar8=3300132|Fri, 13 Jun 2015 10:06:57 GMT;CrVar9=3300100|Fri, 13 Jun 2015 10:06:57 GMT;CrVar10=3300135|Fri, 13 Jun 2015 10:06:57 GMT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\ActiveMovie\devenum]
"Version" = "7"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing" = "1C 00 00 00 01 00 00 00 DE 07 06 00 05 00 0D 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "A0 9F 01 45 EF 86 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process chrome.exe:3684 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:3132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:296 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:1448 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "1"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "1"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process assist.exe:3624 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process FromDocToPDFSetup.exe:3832 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"65SrcAs.dll" = "1"
"hpp" = "1"
"ua" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://home.tb.ask.com/index.jhtml?n=77FD35DB&p2=^Y6^yyyyyy^YYA^ua&ptb=7BE109F9-E265-40DB-885D-AC3553B091B9"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"ffTabs" = "1"
"ie9disable" = "1"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\Events\EventData]
"00000001_6" = "01 00 00 00 58 CD 9A 53 00 00 00 00 00 00 00 00"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"HomePage" = "http://home.tb.ask.com/index.jhtml?n=77FD35DB&p2=^Y6^yyyyyy^YYA^ua&ptb=7BE109F9-E265-40DB-885D-AC3553B091B9"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"nodns" = "0"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\Events\EventData]
"00000001_5" = "01 00 00 00 58 CD 9A 53 00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"ps" = "1"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\Events\EventData]
"00000000_7" = "01 00 00 00 58 CD 9A 53 00 00 00 00 00 00 00 00"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"spd"

[HKCU\Software\FromDocToPDF_65\bar\Switches]
"hpp"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"tiesd"

The process CrExtP65.exe:1352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process CrExtP65.exe:3852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process CrExtP65.exe:2788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process %original file name%.exe:1552 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
"PluginPath" = "%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\ProgID]
"(Default)" = "FromDocToPDF_65Installer.Start.1"

[HKCR\FromDocToPDF_65Installer.Start.1\CLSID]
"(Default)" = "{c39d6d30-f9e1-4290-a731-c502fe173b39}"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65Installer.Start"

[HKCR\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{c39d6d30-f9e1-4290-a731-c502fe173b39}]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65Installer.Start\CurVer]
"(Default)" = "FromDocToPDF_65Installer.Start.1"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
"CurInstall" = "1"

[HKCR\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}]
"(Default)" = "_It8InstallerStartEvents"

[HKCR\FromDocToPDF_65Installer.Start\CLSID]
"(Default)" = "{c39d6d30-f9e1-4290-a731-c502fe173b39}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
"un" = "FromDocToPDF"

[HKCR\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}\TypeLib]
"(Default)" = "{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}"

[HKCR\Wow6432Node\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}\TypeLib]
"(Default)" = "{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\MiscStatus\1]
"(Default)" = "131473"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
"sr" = "0"
"dir" = "%Program Files% (x86)\FromDocToPDF_65EI\Installr\"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}]
"(Default)" = ""

[HKCR\FromDocToPDF_65Installer.Start]
"(Default)" = ""

[HKCR\FromDocToPDF_65Installer.Start.1]
"(Default)" = ""

[HKCR\TypeLib\{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}\1.0]
"(Default)" = "Installer 1.0 Type Library"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@ei.FromDocToPDF_65.com/Plugin]
"Description" = "FromDocToPDF Plugin"
"Version" = "1.1.0.0"

[HKCR\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@ei.FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65pluginei]
"Description" = "FromDocToPDF Plugin"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dll"

[HKCR\Wow6432Node\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}]
"(Default)" = "_It8InstallerStartEvents"

[HKCR\TypeLib\{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin"

[HKCR\TypeLib\{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dll\1"

[HKCR\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}\TypeLib]
"(Default)" = "{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}"

[HKCR\Wow6432Node\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}]
"(Default)" = "It8InstallerStart"

[HKCR\Wow6432Node\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@ei.FromDocToPDF_65.com/Plugin]
"Path" = "%Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISB.dll"
"vendor" = "FULLCOMPANYNAME_DDE0BB24-8F8C-44e9-B962-8289B302DEF9"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{6543019F-C994-462D-8DFB-F9F82A1D685B}\TypeLib]
"(Default)" = "{4661CA16-9E6F-4C19-BA5D-32B5C57A8400}"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\MiscStatus]
"(Default)" = "0"

[HKCR\Interface\{9C7A8BEB-98E8-428A-A474-5E748CA93CAC}]
"(Default)" = "It8InstallerStart"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
"pl" = "9"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@ei.FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65pluginei]
"Suffixes" = "65i"

[HKCR\Wow6432Node\CLSID\{c39d6d30-f9e1-4290-a731-c502fe173b39}\TypeLib]
"(Default)" = "{4661ca16-9e6f-4c19-ba5d-32b5c57a8400}"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
"ConfigDateStamp"

The process 00000ef8T8SETUP.EXE:3872 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Wow6432Node\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}\TypeLib]
"Version" = "1.0"

[HKCR\FromDocToPDF_65.ScriptButton\CurVer]
"(Default)" = "FromDocToPDF_65.ScriptButton.1"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.PseudoTransparentPlugin"

[HKCR\Wow6432Node\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}]
"(Default)" = "IHttpControlEvents"

[HKCR\Wow6432Node\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}]
"(Default)" = "ITemplateBarMenu"

[HKCR\Wow6432Node\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}]
"(Default)" = "BARFEED_INTERFACE"

[HKCR\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\FromDocToPDF_65.HTMLPanel]
"(Default)" = "FromDocToPDF_65 HTML Panel"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"hpwl" = ".mywebsearch.com,.google.com,.yahoo.com,.bing.com,.msn.com"

[HKCR\FromDocToPDF_65.FeedManager.1\CLSID]
"(Default)" = "{cd1d181e-c654-4ca5-9d09-b3648537fd7d}"

[HKCR\FromDocToPDF_65.HTMLPanel\CLSID]
"(Default)" = "{e1c4699e-5e74-4f30-a4a2-378e45d44f07}"

[HKCR\Wow6432Node\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\ProgID]
"(Default)" = "FromDocToPDF_65.HTMLMenu.1"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"nd" = "0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"tiec" = "208976"

[HKCR\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}\1.0]
"(Default)" = "BARFEEDTYPELIB_NAME"

[HKCR\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"nk" = "0"

[HKCR\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}]
"(Default)" = "IIEInstalledToolbar"

[HKCR\Wow6432Node\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65dlghk.dll"

[HKCR\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}\1.0]
"(Default)" = "DialogHook 1.0 Type Library"

[HKCR\FromDocToPDF_65.ToolbarProtector]
"(Default)" = "ProtectorControl Class"

[HKCR\Wow6432Node\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.ScriptButton"

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\MiscStatus\1]
"(Default)" = "131473"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}]
"(Default)" = ""

[HKCR\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}]
"AppName" = "65SrchMn.exe"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin]
"Path" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll"

[HKCR\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}]
"(Default)" = "IIEInstalledToolbars"

[HKCR\Wow6432Node\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}\TypeLib]
"(Default)" = "{2c9d27d8-c81e-4968-8026-e725e01650c1}"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}]
"(Default)" = ""

[HKCR\FromDocToPDF_65.HTMLMenu.1\CLSID]
"(Default)" = "{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}"

[HKCR\Wow6432Node\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}]
"(Default)" = ""

[HKCR\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\1003"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"SettingsDir" = "%Program Files% (x86)\FromDocToPDF_65\bar\Settings\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{a235e1e3-6296-4710-af39-104a7faa6c7c}]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\ProgID]
"(Default)" = "FromDocToPDF_65.ToolbarProtector.1"

[HKCR\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"Visible" = "1"

[HKCR\Wow6432Node\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}\TypeLib]
"(Default)" = "{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}"

[HKCR\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"ua" = "0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Integrators64]
"AssistMonitor64.dll" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR64.DLL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}]
"AppPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\FromDocToPDF_65.RadioSettings\CLSID]
"(Default)" = "{504b4aa9-9952-4490-b0e1-80a5321c35f7}"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}]
"(Default)" = "_IThirdPartyInstallerEvents"

[HKCR\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\Wow6432Node\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.Radio"

[HKCR\Wow6432Node\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}\TypeLib]
"(Default)" = "{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}"

[HKCR\Wow6432Node\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{f236ca79-3123-4afb-9f74-e98117ad5625}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SrcAs.dll"

[HKCR\Wow6432Node\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Classes\Wow6432Node\CLSID\{4c60e5ab-5c68-4c59-abaa-885010b24b32}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SrcAs.dll"

[HKCR\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\Wow6432Node\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin]
"vendor" = "FromDocToPDF_65"

[HKCR\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\Wow6432Node\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}]
"(Default)" = "_IDataCtrlEvents"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll"

[HKCR\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}]
"(Default)" = "HTMLPANELEVENTS_INTERFACE"

[HKCR\Wow6432Node\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}]
"(Default)" = "IRadioSettings"

[HKCR\Wow6432Node\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}\TypeLib]
"(Default)" = "{840AE8AE-D547-433E-985C-6BF6C74F5084}"

[HKCR\Wow6432Node\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}\TypeLib]
"(Default)" = "{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}"

[HKCR\FromDocToPDF_65.Radio]
"(Default)" = ""

[HKCR\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\TypeLib]
"(Default)" = "{3bb1ba04-1b88-4690-9ad3-0d38412f5ff1}"

[HKCR\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}\TypeLib]
"(Default)" = "{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\Version]
"(Default)" = "1.0"

[HKCR\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}\1.0]
"(Default)" = "RADIOLib"

[HKCR\FromDocToPDF_65.MultipleButton]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{4ffa72ec-9fd9-4b2b-92a5-68b60885fd8a}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65httpct.dll"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\TypeLib]
"(Default)" = "{74c02d12-faee-4834-80d2-5b7d2480ad61}"

[HKCR\FromDocToPDF_65.HTMLMenu\CLSID]
"(Default)" = "{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\Version]
"(Default)" = "1.0"

[HKCR\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}]
"(Default)" = "Popup Menu Plugin"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}]
"(Default)" = "FromDocToPDF_65 HTML"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"un" = "FromDocToPDF"

[HKCR\Wow6432Node\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\ProgID]
"(Default)" = "FromDocToPDF_65.MultipleButton.1"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skin.dll"

[HKCR\FromDocToPDF_65.SettingsPlugin\CurVer]
"(Default)" = "FromDocToPDF_65.SettingsPlugin.1"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"PluginPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\"

[HKCR\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}]
"(Default)" = "ITemplateHTMLMenu"

[HKCR\FromDocToPDF_65.FeedManager\CLSID]
"(Default)" = "{cd1d181e-c654-4ca5-9d09-b3648537fd7d}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}]
"AppName" = "65medint.exe"

[HKCR\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "6C 73 CE 77 65 22 79 08 E5 F9 80 D8 5C C9 89 C8"

[HKCR\Wow6432Node\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}]
"(Default)" = "IIEInstalledToolbar"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65tpinst.dll"

[HKCR\FromDocToPDF_65.ToolbarProtector.1\CLSID]
"(Default)" = "{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}"

[HKCR\Wow6432Node\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.MultipleButton"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{f236ca79-3123-4afb-9f74-e98117ad5625}]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}\TypeLib]
"(Default)" = "{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}"

[HKCR\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}\TypeLib]
"(Default)" = "{840AE8AE-D547-433E-985C-6BF6C74F5084}"

[HKCR\Wow6432Node\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}]
"(Default)" = "SKINSETTINGS_INTERFACE"

[HKCR\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\626"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}]
"(Default)" = "IProtectorControl"

[HKCR\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\1604"

[HKCR\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\Version]
"(Default)" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{c66a678d-5e6c-4af9-8f57-c6192f42cf74}" = ""

[HKCR\Wow6432Node\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}]
"(Default)" = "IProtectorControl"

[HKCR\Wow6432Node\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}]
"(Default)" = ""

[HKCR\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Wow6432Node\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}]
"(Default)" = "IDataCtrl"

[HKCR\FromDocToPDF_65.HTMLPanel.1]
"(Default)" = "FromDocToPDF_65 HTML Panel"

[HKCR\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{4ffa72ec-9fd9-4b2b-92a5-68b60885fd8a}\TypeLib]
"(Default)" = "{840ae8ae-d547-433e-985c-6bf6c74f5084}"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Wow6432Node\Interface\{6467B28C-D408-4066-8B26-056335875D3D}]
"(Default)" = "IThirdPartyInstaller"

[HKCR\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}]
"(Default)" = "ITemplateBarSettings"

[HKCR\FromDocToPDF_65.PseudoTransparentPlugin]
"(Default)" = "Pseudo Transparent Plugin"

[HKCR\Wow6432Node\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skin.dll"

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}\TypeLib]
"(Default)" = "{840AE8AE-D547-433E-985C-6BF6C74F5084}"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Mozilla Firefox\plugins\NP65Stub.dll,"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}\TypeLib]
"(Default)" = "{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}"

[HKCR\Wow6432Node\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}]
"(Default)" = "POPUPMENU_INTERFACE"

[HKCR\Wow6432Node\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\FromDocToPDF_65.RadioSettings]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\FromDocToPDF_65.FeedManager.1]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}\TypeLib]
"(Default)" = "{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Integrators64]
"AssistMonitor64.dll" = ""

[HKCR\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}\TypeLib]
"(Default)" = "{840AE8AE-D547-433E-985C-6BF6C74F5084}"

[HKCR\FromDocToPDF_65.ScriptButton]
"(Default)" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]
"HelpLink" = "http://support.mindspark.com/"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Wow6432Node\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bprtct.dll"

[HKCR\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\905"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"RegHookPath" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65reghk"
"UninstallFFString" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe 65bar.dll,O uninstalltype=FF"

[HKCR\Wow6432Node\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}]
"(Default)" = "IIEInstalledToolbars"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}]
"AppPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}\TypeLib]
"Version" = "1.0"

[HKCR\FromDocToPDF_65.ScriptButton\CLSID]
"(Default)" = "{3700b685-d795-4e17-9b78-73bcee5d4086}"

[HKCR\FromDocToPDF_65.RadioSettings\CurVer]
"(Default)" = "FromDocToPDF_65.RadioSettings.1"

[HKCR\Wow6432Node\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}]
"(Default)" = "POPUPMENU_INTERFACE"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}]
"Policy" = "3"

[HKCR\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}]
"(Default)" = "_IDataCtrlEvents"

[HKCU\Software\Classes\Wow6432Node\CLSID\{4c60e5ab-5c68-4c59-abaa-885010b24b32}]
"(Default)" = ""

[HKCR\FromDocToPDF_65.Radio\CLSID]
"(Default)" = "{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}"

[HKCR\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}\1.0]
"(Default)" = "HttpControl 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}]
"(Default)" = ""

[HKCR\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}]
"(Default)" = "_ITemplateBarSettingsEvents"

[HKCR\Wow6432Node\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll"

[HKCR\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\FromDocToPDF_65.HTMLMenu.1]
"(Default)" = "FromDocToPDF_65 HTML Menu"

[HKCR\Wow6432Node\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]
"URLInfoAbout" = "http://support.mindspark.com/"

[HKCR\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\MiscStatus]
"(Default)" = "0"

[HKCR\FromDocToPDF_65.PseudoTransparentPlugin\CurVer]
"(Default)" = "FromDocToPDF_65.PseudoTransparentPlugin.1"

[HKCR\FromDocToPDF_65.ThirdPartyInstaller\CurVer]
"(Default)" = "FromDocToPDF_65.ThirdPartyInstaller.1"

[HKCR\Wow6432Node\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}]
"(Default)" = "IRadioSettings"

[HKCR\Wow6432Node\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}\TypeLib]
"(Default)" = "{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}"

[HKCR\Wow6432Node\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Wow6432Node\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}]
"(Default)" = "FromDocToPDF_65 HTML Menu"

[HKCR\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65.HTMLPanel\CurVer]
"(Default)" = "FromDocToPDF_65.HTMLPanel.1"

[HKCR\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\1104"

[HKCR\FromDocToPDF_65.ToolbarProtector\CurVer]
"(Default)" = "FromDocToPDF_65.ToolbarProtector.1"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}]
"AppPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\ProgID]
"(Default)" = "FromDocToPDF_65.HTMLPanel.1"

[HKCR\FromDocToPDF_65.ThirdPartyInstaller]
"(Default)" = "FromDocToPDF Third Party Installer"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65feedmg.dll"

[HKCR\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]
"UninstallString" = "rundll32 %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65Bar.dll,O mindsparktoolbarkey=FromDocToPDF_65 uninstalltype=IE"

[HKCR\FromDocToPDF_65.MultipleButton\CurVer]
"(Default)" = "FromDocToPDF_65.MultipleButton.1"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skin.dll"

[HKCR\Wow6432Node\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{6467B28C-D408-4066-8B26-056335875D3D}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"65SrcAs.dll" = "0"

[HKCR\FromDocToPDF_65.Radio\CurVer]
"(Default)" = "FromDocToPDF_65.Radio.1"

[HKCR\Wow6432Node\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.HTMLPanel"

[HKCR\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}]
"(Default)" = "ITemplatePopupMenu"

[HKCR\FromDocToPDF_65.MultipleButton.1\CLSID]
"(Default)" = "{017d68f2-19b3-41ae-9d8a-8b09dbd25479}"

[HKCR\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}\TypeLib]
"(Default)" = "{A85ACA7E-5CD2-461B-877A-994CCCCF491C}"

[HKCR\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\TypeLib]
"(Default)" = "{1747ae4d-0a83-4336-84d4-48500bf1554f}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION]
"CrExtP65.exe" = "0"

[HKCR\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}]
"(Default)" = "ITemplateBarMenu"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.ThirdPartyInstaller"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\ProgID]
"(Default)" = "FromDocToPDF_65.RadioSettings.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}]
"Policy" = "3"

[HKCR\Wow6432Node\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}\1.0]
"(Default)" = "HTML 1.0 Type Library"

[HKCR\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\1807"

[HKCR\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e1035f55-4c0c-4efc-9aae-38f421fce726}]
"AppPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"tiec" = "208976"

[HKCR\FromDocToPDF_65.ThirdPartyInstaller\CLSID]
"(Default)" = "{2bd4465d-669a-42e6-b449-636b0b10ebb8}"

[HKCR\Wow6432Node\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65plugin]
"Suffixes" = "65"

[HKCR\Wow6432Node\Interface\{6467B28C-D408-4066-8B26-056335875D3D}\TypeLib]
"(Default)" = "{A85ACA7E-5CD2-461B-877A-994CCCCF491C}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}]
"AppPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}]
"(Default)" = "_ITemplateBarSettingsEvents"

[HKCR\FromDocToPDF_65.HTMLMenu]
"(Default)" = "FromDocToPDF_65 HTML Menu"

[HKCR\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}]
"(Default)" = "ISessionData"

[HKCR\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}\1.0]
"(Default)" = "ToolbarProtector 1.0 Type Library"

[HKCR\FromDocToPDF_65.ThirdPartyInstaller.1]
"(Default)" = "FromDocToPDF Third Party Installer"

[HKCR\Wow6432Node\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\MiscStatus]
"(Default)" = "0"

[HKCR\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Wow6432Node\CLSID\{4ffa72ec-9fd9-4b2b-92a5-68b60885fd8a}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\1406"

[HKCR\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}]
"(Default)" = "BARFEED_INTERFACE"

[HKCR\Wow6432Node\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65htmlmu.dll"

[HKCR\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}\TypeLib]
"(Default)" = "{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}"

[HKCR\Wow6432Node\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}]
"(Default)" = "PSEUDOTRANSPARENT_INTERFACE"

[HKCR\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"ID" = "7BE109F9-E265-40DB-885D-AC3553B091B9"

[HKCR\Wow6432Node\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}]
"(Default)" = "ITemplatePopupMenu"

[HKCR\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}]
"(Default)" = "PSEUDOTRANSPARENT_INTERFACE"

[HKCR\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}\1.0]
"(Default)" = "DataCtrl 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{c66a678d-5e6c-4af9-8f57-c6192f42cf74}]
"(Default)" = "FromDocToPDF"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}]
"AppName" = "65SlSrch.exe"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Owner" = "20 0F 00 00 17 0A 50 42 EF 86 CF 01"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"au" = "1"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\Settings\SmileyCentralBtn]
"HTMLMenuPosDeleted" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}]
"Policy" = "3"

[HKCR\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}]
"(Default)" = "_IThirdPartyInstallerEvents"

[HKCR\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\ProgID]
"(Default)" = "FromDocToPDF_65.PseudoTransparentPlugin.1"

[HKCR\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}]
"(Default)" = "BARFEEDMANAGER_INTERFACE"

[HKCR\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}\TypeLib]
"(Default)" = "{2C9D27D8-C81E-4968-8026-E725E01650C1}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]
"DisplayName" = "FromDocToPDF Internet Explorer Toolbar"

[HKCR\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}]
"(Default)" = "IHttpControlEvents"

[HKCR\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}]
"(Default)" = "IHttpControl"

[HKCR\Wow6432Node\CLSID\{4ffa72ec-9fd9-4b2b-92a5-68b60885fd8a}]
"(Default)" = "HttpControl Class"

[HKCR\Wow6432Node\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}\TypeLib]
"(Default)" = "{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}]
"AppPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"pl" = "9"

[HKCR\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}\TypeLib]
"(Default)" = "{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}"

[HKCR\Wow6432Node\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\1506"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}]
"AppName" = "AppIntegrator64.exe"

[HKCR\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\ProgID]
"(Default)" = "FromDocToPDF_65.ScriptButton.1"

[HKCR\FromDocToPDF_65.FeedManager]
"(Default)" = ""

[HKCR\Interface\{6467B28C-D408-4066-8B26-056335875D3D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"sr" = "0"

[HKCR\Wow6432Node\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}\TypeLib]
"(Default)" = "{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}"

[HKCR\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}]
"(Default)" = "ITemplateHTMLMenu"

[HKCR\FromDocToPDF_65.HTMLMenu\CurVer]
"(Default)" = "FromDocToPDF_65.HTMLMenu.1"

[HKCR\Wow6432Node\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}\1.0]
"(Default)" = "TEMPLATEHTMLMenuLib"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65datact.dll"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"Build" = "176.38746"

[HKCR\FromDocToPDF_65.HTMLPanel.1\CLSID]
"(Default)" = "{e1c4699e-5e74-4f30-a4a2-378e45d44f07}"

[HKCR\Wow6432Node\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{6467B28C-D408-4066-8B26-056335875D3D}\TypeLib]
"(Default)" = "{A85ACA7E-5CD2-461B-877A-994CCCCF491C}"

[HKCR\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}]
"(Default)" = "ITemplateBarButtonRect"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}]
"(Default)" = "ITemplateBarControl"

[HKCR\Wow6432Node\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}\1.0]
"(Default)" = "Toolbar 1.0 Type Library"

[HKCR\Wow6432Node\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}]
"Policy" = "3"

[HKCR\Wow6432Node\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\ProgID]
"(Default)" = "FromDocToPDF_65.Radio.1"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Wow6432Node\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{c66a678d-5e6c-4af9-8f57-c6192f42cf74}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bar.dll"

[HKCR\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.RadioSettings"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"dir" = "%Program Files% (x86)\FromDocToPDF_65\bar\"

[HKCR\FromDocToPDF_65.FeedManager\CurVer]
"(Default)" = "FromDocToPDF_65.FeedManager.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}\TypeLib]
"(Default)" = "{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}"

[HKCR\Wow6432Node\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}\TypeLib]
"(Default)" = "{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}"

[HKCR\FromDocToPDF_65.RadioSettings.1]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}\TypeLib]
"(Default)" = "{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.FeedManager"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash" = "17 2C F3 B9 20 67 B0 F7 48 7A 84 7C 6F 19 7E E1"

[HKCR\Wow6432Node\CLSID\{a235e1e3-6296-4710-af39-104a7faa6c7c}]
"(Default)" = "Toolbar BHO"

[HKCR\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}]
"(Default)" = "Skin Settings"

[HKCR\FromDocToPDF_65.ThirdPartyInstaller.1\CLSID]
"(Default)" = "{2bd4465d-669a-42e6-b449-636b0b10ebb8}"

[HKCR\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{6467B28C-D408-4066-8B26-056335875D3D}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.HTMLMenu"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\MiscStatus\1]
"(Default)" = "131473"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Integrators64]
"HPG64.DLL" = ""

[HKCR\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}\TypeLib]
"(Default)" = "{2C9D27D8-C81E-4968-8026-E725E01650C1}"

[HKCR\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}\TypeLib]
"(Default)" = "{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}]
"AppName" = "65SkPlay.exe"

[HKCR\Wow6432Node\CLSID\{a235e1e3-6296-4710-af39-104a7faa6c7c}\InprocServer32]
"(Default)" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65bar.dll"

[HKCR\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}]
"(Default)" = "IDisableAddonRebuttal"

[HKCR\Wow6432Node\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65.Radio.1]
"(Default)" = ""

[HKCR\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}]
"(Default)" = "IDataCtrl"

[HKCR\FromDocToPDF_65.SettingsPlugin]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\SkinTools]
"PlayerPath" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SkPlay.exe"

[HKCR\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\625"

[HKCR\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\405"

[HKCR\FromDocToPDF_65.PseudoTransparentPlugin.1\CLSID]
"(Default)" = "{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e1035f55-4c0c-4efc-9aae-38f421fce726}]
"AppName" = "CrExtP65.exe"

[HKCR\Wow6432Node\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65script.dll"

[HKCR\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}\TypeLib]
"(Default)" = "{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}"

[HKCR\Wow6432Node\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}\TypeLib]
"(Default)" = "{bf6fdbb8-7cd5-402d-ab4f-e4f13d3490c8}"

[HKCR\Wow6432Node\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Classes\Wow6432Node\CLSID\{4c60e5ab-5c68-4c59-abaa-885010b24b32}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}\TypeLib]
"(Default)" = "{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}"

[HKCR\Wow6432Node\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}]
"(Default)" = "HTMLPANEL_INTERFACE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"lidate" = "2014-06-13T10:07:18Z"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin]
"Version" = "1.1.1.1"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bar.dll"

[HKCR\Wow6432Node\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Wow6432Node\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}\TypeLib]
"Version" = "1.0"

[HKCR\FromDocToPDF_65.PseudoTransparentPlugin\CLSID]
"(Default)" = "{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}"

[HKCR\Interface\{6467B28C-D408-4066-8B26-056335875D3D}]
"(Default)" = "IThirdPartyInstaller"

[HKCR\Wow6432Node\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\MiscStatus]
"(Default)" = "0"

[HKCR\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}\TypeLib]
"(Default)" = "{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}"

[HKCR\Wow6432Node\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65.SettingsPlugin.1\CLSID]
"(Default)" = "{bc7e25d7-4681-46a3-af5a-9a1b865783ed}"

[HKCR\FromDocToPDF_65.ScriptButton.1\CLSID]
"(Default)" = "{3700b685-d795-4e17-9b78-73bcee5d4086}"

[HKCR\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}\TypeLib]
"(Default)" = "{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}"

[HKCR\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}]
"(Default)" = "SEARCHSCOPE_INTERFACE"

[HKCR\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}\1.0]
"(Default)" = "Skin 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{a235e1e3-6296-4710-af39-104a7faa6c7c}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}]
"(Default)" = "SKINWINDOW_INTERFACE"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}]
"(Default)" = "Pseudo Transparent Plugin"

[HKCR\FromDocToPDF_65.ToolbarProtector\CLSID]
"(Default)" = "{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}"

[HKCR\Wow6432Node\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.ToolbarProtector"

[HKCR\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}]
"(Default)" = "SKINSETTINGS_INTERFACE"

[HKCR\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}\TypeLib]
"(Default)" = "{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}"

[HKCR\Wow6432Node\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\TypeLib]
"(Default)" = "{4d8aeb1d-4ed4-44ac-a039-4775b2575db0}"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\TypeLib]
"(Default)" = "{3efec319-72e8-42aa-ac38-8cf8a0661cdd}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]
"Publisher" = "Mindspark Interactive Network"

[HKCR\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}\TypeLib]
"(Default)" = "{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65plugin]
"Description" = "FromDocToPDF Plugin"

[HKCR\Interface\{87509D74-1F24-4B10-A14E-0AACF713CE14}]
"(Default)" = "HTMLPANEL_INTERFACE"

[HKCR\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}\1.0]
"(Default)" = "TYPELIB_NAME"

[HKCR\Wow6432Node\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\TypeLib]
"(Default)" = "{6191571e-f7ee-47c3-b229-2dfac70db5d2}"

[HKCR\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Wow6432Node\Interface\{777CEBBF-A763-42BE-ABBF-FF264689666B}]
"(Default)" = "HTMLPANELEVENTS_INTERFACE"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"PartnerPixelNotSet" = ""

[HKCR\Wow6432Node\Interface\{316A2A46-F832-49B3-95E0-D460BD88D6B4}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Wow6432Node\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8HTML.DLL"

[HKCR\Wow6432Node\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"od" = "1"

[HKCR\Wow6432Node\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}]
"(Default)" = "IDisableAddonRebuttal"

[HKCR\Wow6432Node\Interface\{9FD6C2C1-C847-410A-995A-AEE5F27F0674}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{E70DAE92-1A31-4AB8-9FCF-52FBDA0CC66A}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Switches]
"ok" = "1"

[HKCR\Wow6432Node\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin]
"Path" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll"

[HKCR\Interface\{FC65C7F9-115F-42A6-BC49-BF7A60A5314E}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"UninstallString" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe 65bar.dll,O uninstalltype=IE"

[HKCR\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}\TypeLib]
"(Default)" = "{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}"

[HKCR\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\t8res.dll\100"

[HKCR\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKCR\Wow6432Node\Interface\{C7879E06-4C3F-4061-B619-7CFD072E4F26}]
"(Default)" = "ITemplateBarButtonRect"

[HKCR\FromDocToPDF_65.ScriptButton.1]
"(Default)" = ""

[HKCR\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{f236ca79-3123-4afb-9f74-e98117ad5625}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65.Radio.1\CLSID]
"(Default)" = "{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\TypeLib]
"(Default)" = "{a85aca7e-5cd2-461b-877a-994ccccf491c}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"CurInstall" = "1"

[HKCR\Interface\{1EF6208B-483A-48F6-B9E5-9B6C54200F8C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{A7C6FA4E-F2A1-4D4B-90CB-2757143E7AAB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}]
"(Default)" = "SKINWINDOW_INTERFACE"

[HKCR\Interface\{CF9608AD-4ECF-4A16-B122-B374299DE7B5}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65mlbtn.dll"

[HKCR\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2bd4465d-669a-42e6-b449-636b0b10ebb8}]
"(Default)" = ""

[HKCR\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"RegisteredWithFirefox" = "1"

[HKCR\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFiles0000" = "%Program Files%\Internet Explorer\ieuser.exe"

[HKCR\FromDocToPDF_65.PseudoTransparentPlugin.1]
"(Default)" = "Pseudo Transparent Plugin"

[HKCR\Wow6432Node\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{37E2C8D2-3EF0-46D4-AD11-A8DA53942034}]
"(Default)" = "ISessionData"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}]
"(Default)" = "FromDocToPDF Third Party Installer"

[HKCR\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKCR\Wow6432Node\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}]
"(Default)" = "ITemplateBarSettings"

[HKCR\FromDocToPDF_65.SettingsPlugin\CLSID]
"(Default)" = "{bc7e25d7-4681-46a3-af5a-9a1b865783ed}"

[HKCR\FromDocToPDF_65.ToolbarProtector.1]
"(Default)" = "ProtectorControl Class"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{6467B28C-D408-4066-8B26-056335875D3D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65.MultipleButton\CLSID]
"(Default)" = "{017d68f2-19b3-41ae-9d8a-8b09dbd25479}"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\VersionIndependentProgID]
"(Default)" = "FromDocToPDF_65.SettingsPlugin"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e1035f55-4c0c-4efc-9aae-38f421fce726}]
"Policy" = "3"

[HKCR\Wow6432Node\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}]
"(Default)" = "SEARCHSCOPE_INTERFACE"

[HKCR\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\FromDocToPDF_65.MultipleButton.1]
"(Default)" = ""

[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{4c60e5ab-5c68-4c59-abaa-885010b24b32}" = ""

[HKCR\Wow6432Node\Interface\{A1F3E70D-04BA-47FB-ACCA-CC8FCFA74D41}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\ProgID]
"(Default)" = "FromDocToPDF_65.ThirdPartyInstaller.1"

[HKCR\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\FromDocToPDF_65.RadioSettings.1\CLSID]
"(Default)" = "{504b4aa9-9952-4490-b0e1-80a5321c35f7}"

[HKCR\FromDocToPDF_65.SettingsPlugin.1]
"(Default)" = ""

[HKCR\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{314D051A-F3B4-4B7A-AAB4-1122FB82A0B5}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}]
"(Default)" = "ITemplateBarControl"

[HKCR\Wow6432Node\Interface\{62D88F68-AC05-4FBF-AC16-E76B3B7B6531}]
"(Default)" = "BARFEEDMANAGER_INTERFACE"

[HKCR\Wow6432Node\Interface\{F284EDCC-94E4-4C79-8A27-D7F42BEE216C}\TypeLib]
"(Default)" = "{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\ProgID]
"(Default)" = "FromDocToPDF_65.FeedManager.1"

[HKCR\Wow6432Node\Interface\{E1DA9C58-A56C-4F9E-A9DD-32BCF8CCC98B}\TypeLib]
"(Default)" = "{A85ACA7E-5CD2-461B-877A-994CCCCF491C}"

[HKCR\Wow6432Node\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\TypeLib]
"(Default)" = "{1747ae4d-0a83-4336-84d4-48500bf1554f}"

[HKCR\Wow6432Node\Interface\{463A3C2B-3B87-4FAD-A9A6-CD1B93ED836C}\TypeLib]
"(Default)" = "{74C02D12-FAEE-4834-80D2-5B7D2480AD61}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"PID" = "^Y6^yyyyyy^YYA^ua"

[HKCR\Interface\{F39D8ED3-A6F6-427F-8AF8-BC9784FA70D8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{F05D47B2-7C9F-401D-A083-3AA4A4711F4F}\TypeLib]
"(Default)" = "{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}"

[HKCR\Wow6432Node\CLSID\{c66a678d-5e6c-4af9-8f57-c6192f42cf74}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\Interface\{DAAD8A57-6BD6-48D0-9034-093AD607C39A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Integrators]
"AssistMonitor.dll" = ""

[HKCR\Wow6432Node\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}]
"(Default)" = "Disable Addon Rebuttal Control"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}]
"Policy" = "3"

[HKCR\Wow6432Node\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}]
"(Default)" = "ProtectorControl Class"

[HKCR\Wow6432Node\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\ProgID]
"(Default)" = "FromDocToPDF_65.SettingsPlugin.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox]
"UninstallString" = "rundll32 %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65Bar.dll,O mindsparktoolbarkey=FromDocToPDF_65 uninstalltype=FF"

[HKCR\Interface\{4AD8E6E4-3DFE-458D-845D-55F516C7C3B0}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\TypeLib]
"(Default)" = "{1747ae4d-0a83-4336-84d4-48500bf1554f}"

[HKCR\Wow6432Node\CLSID\{f236ca79-3123-4afb-9f74-e98117ad5625}]
"(Default)" = "Search Assistant BHO"

[HKCR\Wow6432Node\Interface\{F4F94932-9CDB-45F4-BD4A-C77B5074D353}\TypeLib]
"(Default)" = "{1747AE4D-0A83-4336-84D4-48500BF1554F}"

[HKCR\Wow6432Node\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}]
"(Default)" = "DataCtrl Class"

[HKCR\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"Maximized" = "1"

[HKCR\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{A9141680-DC75-4DD7-B86D-9CC2A83DCB9B}]
"(Default)" = "IHttpControl"

[HKCR\Wow6432Node\Interface\{9CB19259-5D60-49A7-8AF7-2B7CAF36C124}\TypeLib]
"(Default)" = "{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}"

[HKCR\Wow6432Node\Interface\{C64B02A7-77F8-4EC9-B2C3-78EBBFFC00EE}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin]
"Description" = "FromDocToPDF Plugin"

[HKCR\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FromDocToPDF_65\bar\1.bin"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"FromDocToPDF EPM Support" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65medint.exe T8EPMSUP.DLL,S"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FromDocToPDF Home Page Guard 64 bit" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\AppIntegrator64.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"FromDocToPDF Search Scope Monitor" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65srchmn.exe /m=2 /w /h"

"FromDocToPDF_65 Browser Plugin Loader 64" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65brmon64.exe"

"FromDocToPDF_65 Browser Plugin Loader" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65brmon.exe"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\RestartManager\Session0000]
[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar\Integrators64]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin\MimeTypes]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{f236ca79-3123-4afb-9f74-e98117ad5625}]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65plugin]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@FromDocToPDF_65.com/Plugin]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash"

"Owner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"ConfigDateStamp"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"ConfigDateStamp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"un"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFiles0000"

[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65\bar]
"pid2"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FromDocToPDF Home Page Guard 64 bit"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"FromDocToPDF Search Scope Monitor"

"FromDocToPDF Plugin"

The process rundll32.exe:3000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65EI\Installer]
"CacheDir" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\"

[HKCU\Software\Classes\Local Settings\MuiCache\27\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65EI\Installer]
"CheckForConnection" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Mozilla Firefox\plugins\NP65Stub.dll, , \??\%Program Files% (x86)\Mozilla Firefox\chrome\65ffxtbr.jar, , \??\%Program Files% (x86)\Mozilla Firefox\chrome\65ffxtbr.manifest, , \??\C:\PROGRA~2\FROMDO~1\Installr\1.bin\65EIPlug.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "72 F4 78 3D EF 86 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "16 2D 3D 33 EF 86 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65EI\Installer]
[HKCU\Software\AppDataLow\Software\FromDocToPDF_65EI]
[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI\Installer]
[HKLM\SOFTWARE\Wow6432Node\FromDocToPDF_65EI]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process firefox.exe:3420 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process UPDATER.EXE:1888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Mozilla Firefox\plugins\NP65Stub.dll, , \??\%Program Files% (x86)\Mozilla Firefox\chrome\65ffxtbr.jar, , \??\%Program Files% (x86)\Mozilla Firefox\chrome\65ffxtbr.manifest, , \??\C:\PROGRA~2\FROMDO~1\Installr\1.bin\65EIPlug.dll, , \??\C:\PROGRA~2\FROMDO~1\Installr\1.bin\65EZSETP.dll, , \??\C:\PROGRA~2\FROMDO~1\Installr\1.bin\NP65EISb.dll, , \??\C:\PROGRA~2\FROMDO~1\Installr\1.bin, , \??\C:\PROGRA~2\FROMDO~1\Installr\setups, , \??\C:\PROGRA~2\FROMDO~1\Installr, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FROMDO~1\Installr\Cache\000680F1.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FROMDO~1\Installr\Cache\files.ini, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FROMDO~1\Installr\Cache, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FROMDO~1\Installr\Cache\000680F1.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FROMDO~1\Installr\Cache\files.ini, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FROMDO~1\Installr\Cache, , \??\%Program Files% (x86)\FromDocToPDF_65EI\Installr, , \??\%Program Files% (x86)\FromDocToPDF_65EI, , \??\C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPD"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"dhhjmlmdpcpiojiffodbldlkgcnaeogp Upgrader" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\UPDATER.EXE"

The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"dhhjmlmdpcpiojiffodbldlkgcnaeogp Upgrader"

The process 65srchmn.exe:3928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\FromDocToPDF_65\bar]
"sspd" = "1"

Dropped PE files

MD5 File path
1db9b1c202aedf6d27e0786345267f30 c:\Program Files (x86)\FromDocToPDF_65EI\Installr\1.bin\65EIPlug.dll
724139028dc0a2c8998c91f3e66133ab c:\Program Files (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dll
0bbbe49995a1a035902d0d7ee83a7049 c:\Program Files (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISb.dll
bf28f98daf8826b65923273d3e406930 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65Plugin.dll
31f0fd888f41c6e4b05a8a26a6257bbb c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65SrcAs.dll
466af3fbfdd028b3d90238425c367b7e c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65SrchMn.exe
bef81913920b66f99cce1b8b94d2335d c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65auxstb.dll
a842b26aee3d1312bda37096c8490b39 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65auxstb64.dll
96a060cf33a2c42617cf13224a47db07 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65bar.dll
54d6bc524f1fb026d6eb569581e38885 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65barsvc.exe
eb8ced3dac43ca1bf66d78481df2a8f1 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65bprtct.dll
2c0a45683112082493b1fb3c09c60184 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brmon.exe
4ba7d9e73d47039bd34396ceb679318f c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brmon64.exe
e46963ec2bc3d0ed27a61f0697544196 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brstub.dll
f04c0efeafa8302e5b52d13cb0916ed3 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brstub64.dll
5fea0081f2bf39ac0bef44e86b52c4dc c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65datact.dll
9c59c1140075060c08e93b39c0ed94b4 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65dlghk.dll
b8efb8d32dc96ed0d473dcd3a5e58ed8 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65dlghk64.dll
a738286620be77bec9ca13b389864d96 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65feedmg.dll
aa82a2d20c3525f0b850ec67dab2a448 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe
e0d399dfb42ca6a24c40b4d38d0db3a3 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65hkstub.dll
4c7b28b8ae8013d8359f2d0a316e5d3e c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65htmlmu.dll
ebbf5d6394bed262727f72dc321789c2 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65httpct.dll
97190b606220d99b1f2c1dc8be34ad90 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65idle.dll
aedf3f97b88562ce2d5128c9422718c1 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65ieovr.dll
bb601f008cda03b0cdc8188d084d9960 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65medint.exe
212f000542b3526744f6444cddf66c33 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65mlbtn.dll
99314afe1aa7f154766c7b10b1b7e90d c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll
05e7f2c19ae83dd990a6960a19755752 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65regfft.dll
b92c71d0ba7098f565520266e6b987d9 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65reghk.dll
b927852e2e860edbc4d2ec2b436cfaba c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65regiet.dll
74376b99e024766343eb5c18dd06040a c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65script.dll
2fd72a0a4fc75b4371f22252e443b245 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65skin.dll
f59ea63eaa060998c359fcbfdbc8c7d7 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65skplay.exe
9f1f27aaedca28c35f7ec1484c53b6e5 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65srchmr.dll
cf0646bb879911192c833e314e0afc57 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65tpinst.dll
660d435be4a48b8d941e5dcf30ac1974 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\APPINTEGRATOR.EXE
d5d454ca320d6f9128c1e8231d8118c1 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\APPINTEGRATORSTUB.DLL
e5d70d21eb26491111de57256319e340 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR.DLL
8584203f010ab90bfde264a7c0879413 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR64.DLL
f68778b356218f4cbfd5c2c19419c0a0 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe
755ef214e8e5c2b5736c2e0fac4fe561 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll
adc32dbe2fa1caae9c213bbfb6b02a9b c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\CREXT.DLL
c9fecbc3ec683b4b60cf45ebae9abfcd c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\CrExtP65.exe
5fe1c74f008496c30bbaf7689cd2fb74 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\DPNMNGR.DLL
eb09437e0e2ddd52045904fa59e2b545 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\EXEMANAGER.DLL
196a5d0149f1fb1aa393d4850d46f0c5 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\FF-NativeMessagingDispatcher.dll
629badd33fbba164acff36bc5a932460 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\Hpg64.dll
bc0c3575258a94ec02dc2923ad74fb86 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll
fd7ee723718078825bc79e360e4f04d3 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8EPMSUP.DLL
5db285aa198bf18c4974c36308cac1d4 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8EXTEX.DLL
929d9ac6f8685c3d4a7124d8ec1aa485 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8EXTPEX.DLL
edf1686c822889284c49fceaf35f55ec c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8HTML.DLL
f622ce76c0a8d6796f3be2dffb43f4a3 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8RES.DLL
888774ec0b5329e16b1d525c2a855801 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8TICKER.DLL
69a27006ffab3df37ceb31499480461b c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\TPIMANAGERCONSOLE.EXE
738237d7f25abb8874ab383e04cc8d61 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\UNIFIEDLOGGING.DLL
2cd291d761752e1abf80f05e0199a907 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\VERIFY.DLL
0e57218f3c13b9cc91a0869a064176e8 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL
c895957b79fbd05f9c580666c4def142 c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL
fe0e9832decb6f345555837972eb244b c:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE
709ee0e18f2b69c176eaeaf6ab51796c c:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\000680F1.exe
749521c1a3ea9aa6a7f86ab00695bf87 c:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\65ChromePlugIn.dll
5068bafcda666e016a2048cf202d74e1 c:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\SearchControl.dll
9accb2b96456018977c65073f0b30942 c:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\plugins\NativeMessagingDispatcher.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 25813 26112 4.49702 e6d856215317c260ad87de5c699fc4bb
.rdata 32768 12728 12800 3.4729 4c2617e1c8dc50d88e04b191e5b48679
.data 49152 6688 3072 1.78876 165998d6b08a4452ed870e47acf9a583
.rsrc 57344 387576 387584 4.81991 62f4d47468625180c9e58e89060bbb00
.reloc 446464 5872 6144 2.21367 c9236bd7e5ddd900e9763ce053c78f68

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www180.myway.com/
hxxp://googleapis.l.google.com/css?family=Shadows Into Light Two|Raleway:400,900,800,700,600,500,300,200,100
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/scott.schaffer/asset2/1389111048923.png
hxxp://a1255.g.akamai.net/images/download/ask/browsers_0927.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background/1384378062049.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset3/1395254553071.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background999/1384378039938.png
hxxp://a1255.g.akamai.net/images/download/ask/pba_0927.png
hxxp://tools.l.google.com/ga.js
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset11/1394830028148.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset10/1394830064218.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset5/1370528117612.png
hxxp://a1255.g.akamai.net/images/download/runrun/test/rebuttal/Alert.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset13/1394830290310.png
hxxp://a1255.g.akamai.net/images/anx/anemone-1.2.7.js
hxxp://a1255.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de5524d4290fb763
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEG5P+rPF5mnE0WfJkqvoWMQ=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsK8Var42Wv2Ct+B0CPyO0igBZwgQUpe8LEc7AQQOjSmWQSLIc4FctfUcCEB+8ikybeTktioIu7LY7T/Q=
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background1/1370528215804.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background2/1372348471308.png
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016034&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=FC261152-5CED-495D-A898-4A9A960C441A&anxe=backFill&anxr=1023458378
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background3/1370528131060.PNG
hxxp://a1255.g.akamai.net/images/download/runrun/test/rebuttal/WPanel_P2_01.png
hxxp://cdn.clicktale.net.cdngc.net/www06/ptc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js 151.249.90.198
hxxp://cdn.clicktale.net.cdngc.net/www06/pcc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js?DeploymentConfigName=Release_29012014&Version=3 151.249.90.198
hxxp://cdn.clicktale.net.cdngc.net/www/tc/WRe12.js 151.249.90.198
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016364&anxsq=4&cookiesEnabled=1&anxe=SplashLanding&anxr=2043420352
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016053&anxsq=3&present=false&anxe=ToolbarDetect&anxr=1389726331
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFt3WcYXhOFexyfAMpUpKGs=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRFp9TUB3UaX73tHhkdSo3sUtJBVQQU/IpQup65JVp7VYVPlQBjj+lYa0MCEFUtiDipO/Hsoj7MGX5O054=
hxxp://www180.myway.com/splashPixels.jhtml
hxxp://www180.myway.com/favicon.ico
hxxp://dart.l.doubleclick.net/activity;src=3962930;type=invmedia;cat=rwavulrf;ord=715925385974.9415?
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/button1/1384361682725.png
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654021561&anxsq=5&anxe=SplashLandingClicked&anxr=1414323696
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654024251&anxsq=6&anxe=InstallerInvoked&anxr=1993629022
hxxp://www187.mindspark.com/tr.gif?anxa=IE9 Messages&anxe=Run Overlay - View&anxt=&anxtv=&anxp=^Y6^yyyyyy^YYA^ua&anxsi=&anxr=1402654027483&anxv=1.0&anxd=2011-04-01
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654024281&anxsq=7&optIn=true&searchAssistantOptionIE=true&searchAssistantOptInIE=true&homePageOptionIE=true&homePageOptInIE=true&anxe=InstallerHostAccepted&anxr=1797796994
hxxp://a1255.g.akamai.net/images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/FromDocToPDFSetup.exe
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654025397&anxsq=8&optIn=true&searchAssistantOptionIE=true&searchAssistantOptInIE=true&homePageOptionIE=true&homePageOptInIE=true&searchAssistantOptionFF=true&searchAssistantOptInFF=true&homePageOptionFF=true&homePageOptInFF=true&browserInstallOptionIE=false&browserInstallOptInIE=false&browserInstallOptionFF=true&browserInstallOptInFF=true&anxe=InstallerAccepted&anxr=1388818192
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654026458&anxsq=9&optIn=true&searchAssistantOptionFF=true&searchAssistantOptInFF=true&homePageOptionFF=true&homePageOptInFF=true&anxe=InstallerSecondaryAccepted&anxr=679204151
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEAmEF/fqZAbsezIFkOF6Zbc=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f+tw/GciJ7fvbA4gIz7D4CEH6T6/t8xk5Z6kuad9QG/Ds=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMzHSa1N197z/b7EyALt0CEA7P9DjI/r81bgTYapgbGlA=
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654026464&anxsq=10&searchAssistantOptIn=true&homePageOptIn=true&tbUID=7BE109F9-E265-40DB-885D-AC3553B091B9&tbVer=2.5.14.85&anxe=InstallerFinished&anxr=1803291899
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654036891&anxsq=11&popStyle=up&url=http://www.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml&anxe=PostInstallPop&anxr=869555314
hxxp://www180.myway.com/ieEnable.jhtml?successurl=installComplete.jhtml
hxxp://www180.myway.com/installComplete.jhtml?close=true
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/202980021/background1/1360876073072.png
hxxp://cdn.clicktale.net.cdngc.net/www06/phc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js 151.249.90.198
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/207743773/asset1/1395069229875.png
hxxp://a1255.g.akamai.net/images/download/IE9EnableButton_US.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/207743773/background999/1372459906306.png
hxxp://a1255.g.akamai.net/images/installer/enable/content_area.png
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://www.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654042240&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=SuccessPopDisplayButton&anxr=468097023
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://www.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654043715&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&anxe=installCompleteLanding&anxr=1945279672
hxxp://www186.mywebsearch.com/cfg.jhtml?p2=^Y6^yyyyyy^YYA^ua&s=t207743773&tv=2.5.14.85&v=2.5.14.85&e=68a5&r=0&l=9&c=01&f=002021a1&a=7BE109F9-E265-40DB-885D-AC3553B091B9&lidate=2014-06-13T10:07:18Z
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=&anxu=http://www.fromdoctopdf.com/ieEnable.jhtml&anxl=en-US&anxlv=1402654041710&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=ieEnableLanding&anxr=548041706
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=&anxu=http://www.fromdoctopdf.com/ieEnable.jhtml&anxl=en-US&anxlv=1402654043722&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&url=installComplete.jhtml&anxe=PageRedirect&anxr=770063518
hxxp://www186.mywebsearch.com/cfg.jhtml?p2=^Y6^yyyyyy^YYA^ua&s=t207743773&tv=2.5.14.85&v=2.5.14.85&e=68a5&r=4686&l=9&c=01&f=002021a1&a=7BE109F9-E265-40DB-885D-AC3553B091B9&n=2014061306&lidate=2014-06-13T10:07:18Z&cv=3
hxxp://a1255.g.akamai.net/images/toolbar/btn2/test_03_icon_edit.bmp
hxxp://a1255.g.akamai.net/images/vicinio/100000487/SearchButton_65x24_02_1327418199715.bmp
hxxp://www180.myway.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
hxxp://a1255.g.akamai.net/images/vicinio/100000486/AskToolbarIcon_1354224599535.bmp
hxxp://a1255.g.akamai.net/images/vicinio/207743773/Logo1_1335461569136.bmp
hxxp://a1255.g.akamai.net/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-20131210101753/images/DocToPDF.bmp
hxxp://www180.myway.com/installComplete.jhtml
hxxp://a1255.g.akamai.net/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-20131210101753.1386688673767.cab
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe11.df.jabodo.com&anxu=http://www.fromdoctopdf.com/install_pixels.jhtml&anxl=en-US&anxlv=1402654046646&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&tbUID=7BE109F9-E265-40DB-885D-AC3553B091B9&tbVer=2.5.14.85&anxe=PixelFrameTB&anxr=763999164
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/207743773/asset1/1395069199615.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/100000459/background/1365611127529.jpg
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/211634648/background999/1372437932631.png
hxxp://g.brothersoft.com/?act=statistics&i=7e737kewZYa8pDw+Duoh4MEjmLz/noHd3vtbIbDST8nV 184.172.2.121
hxxp://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID 174.128.15.11
hxxp://a1255.g.akamai.net/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149/images/PDFToDOC.bmp
hxxp://a1255.g.akamai.net/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149.1386688310219.cab
hxxp://pixel.fetchback.com/serve/fb/pdc?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID&xr=8249407062487986062&referer=http://www.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id= 174.128.15.11
hxxp://pixel.fetchback.com/serve/fb/blank 174.128.15.11
hxxp://www180.myway.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://www.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654046478&anxrd=www.fromdoctopdf.com&anxrp=ieEnable.jhtml&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=installCompleteLanding&anxr=1109513793
hxxp://a.triggit.com/px?u=Cy&rtv=convertor&ct=ffd59f4f6ea2c23b&ctval1=[CONVERSION TYPE] 217.72.242.210
hxxp://dart.l.doubleclick.net/activity;src=3962930;type=invmedia;cat=roprkm09;ord=64701985177.376686?
hxxp://dart.l.doubleclick.net/activity;src=3335366;type=retar633;cat=conve083;ord=1;num=2241504676063.0083?
hxxp://ads.ad4game.com/www/delivery/ti.php?trackerid=317 108.168.160.67
hxxp://www156a.mywebsearch.com/tr.gif?anxa=CAPToolbar&amp&anxpt=windows&anxpv=2,6,1
hxxp://pagead.l.doubleclick.net/pixel?google_nid=triggit1&cb=4gd7ho&google_hm=bGRGQlBwZ2hTMktpby12RV9vRUVVUQ==
hxxp://pixel.fetchback.com/serve/fb/ver?uatFilter=false&fb_key=cat=&name=success&sid=4242&crv=client_revenue&oid=order_id&xr=8249407062487986062&referer=http://www.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^yyyyyy^yya^ua&coid=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=http://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=client_revenue&oid=order_id /serve/fb/pdc http://www.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^yyyyyy^yya^ua&coid=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=&cat=&sid=4242&name=success&uid=1402654047722:3982831531801780&crv=0.0&oid=ORDER_ID 174.128.15.11
hxxp://a.triggit.com/pxgcm?id=&cb=4gd7ho 217.72.242.210
hxxp://a1255.g.akamai.net/images/nocache/vicinio/207743773/com.mindspark.translate.unbranded-en-1.1.1-20131004150724/images/logo-unbranded.bmp
hxxp://a1255.g.akamai.net/images/nocache/vicinio/207743773/com.mindspark.translate.unbranded-en-1.1.1-20131004150724.1380913644838.cab
hxxp://a1255.g.akamai.net/images/vicinio/207743773/100025132_1284560970104_1354049568688.bmp
hxxp://star.c10r.facebook.com/fr/u.php?p=185501061579159&m=ldFBPpghS2Kio-vE_oEEUQ&t=2592000&cb=e2tpvm
hxxp://a1255.g.akamai.net/images/vicinio/207743773/100025130_1284560908837_1354049527576.bmp
hxxp://a1255.g.akamai.net/images/vicinio/207743773/100025126_1284560681838_1354049612079.bmp
hxxp://a.triggit.com/pxfbcm?s=miss 217.72.242.210
hxxp://a1363.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset14/1394830119959.png
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052847&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=68E760C8-462C-4F26-9CF2-EA1EEB257FB3&anxe=backFill&anxr=1854133171
hxxp://www180.myway.com/mirrorCookies.jhtml
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052851&anxsq=3&present=false&anxe=ToolbarDetect&anxr=1007230226
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052861&anxsq=4&cookiesEnabled=1&anxe=SplashLanding&anxr=310554195
hxxp://a1255.g.akamai.net/images/download/firefox/InstallOnFirefox.png
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052862&anxsq=5&anxe=SplashLandingClicked&anxr=475871741
hxxp://a1255.g.akamai.net/images/download/wb/fftest_arrow_lrg_up.png
hxxp://a1255.g.akamai.net/images/download/wb/allow_xpi_box_white.png
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654055518&anxsq=6&optIn=true&anxe=InstallerAccepted&anxr=50009494
hxxp://www180.myway.com/localStorage.jhtml?toolbarData={"toolbarId":"5864BD4E-284B-4517-9409-6B6363B179CD","partnerId":"^Y6^foxyyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"XPI","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^foxyyy^YYA^ua&coId=027382d5aeee4be8a36350dfd4a6412c&cake_id=&offer_id=","successUrl":"http://www.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"}
hxxp://a1255.g.akamai.net/images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/65ffxtbr-rsl@FromDocToPDF_65.com.xpi
hxxp://dart.l.doubleclick.net/activity;src=3962930;type=invmedia;cat=rwavulrf;ord=4846481317772.642?
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654053947&anxsq=7&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=5864BD4E-284B-4517-9409-6B6363B179CD&paidInstall=true&restartUrl=http://www.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=433607125
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/asset2/1384380963413.gif
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background/1384380910009.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/jason.pepping/background999/1384380933076.png
hxxp://a1255.g.akamai.net/images/vicinio/dsp-images/lisa.delmar/asset3/1395430291650.png
hxxp://www180.myway.com/localStorage.jhtml?toolbarData={"toolbarId":"062329B0-5521-4737-A396-00ACFB474D4F","partnerId":"^Y6^chryyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"CRX_WEBSTORE","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=","successUrl":"http://www.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"}
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe12.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654068215&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=C86E3194-D004-45EC-9B51-4B9892B55A5D&anxe=backFill&anxr=1375836688
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654070874&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&present=false&anxe=ToolbarDetect&anxr=1152182241
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654070926&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&cookiesEnabled=1&anxe=SplashLanding&anxr=1798796993
hxxp://dart.l.doubleclick.net/activity;src=3962930;type=invmedia;cat=rwavulrf;ord=9295666029211.133?
hxxp://www180.myway.com/localStorage.jhtml?toolbarData={"toolbarId":"49F19948-7BCF-4240-BFE9-02783025B89B","partnerId":"^Y6^chryyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"CRX_WEBSTORE","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=","successUrl":"http://www.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"}
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654072983&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=4&anxe=SplashLandingClicked&anxr=1839575857
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654073022&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=5&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=49F19948-7BCF-4240-BFE9-02783025B89B&paidInstall=true&restartUrl=http://www.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=220991762
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAFSh8UnRmbfJXQAAQAAAVI=
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654053953&anxsq=8&anxe=SplashLandingClicked&anxr=212412536
hxxp://www180.myway.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654077906&anxsq=9&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=5864BD4E-284B-4517-9409-6B6363B179CD&paidInstall=true&restartUrl=http://www.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=1739394702
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654073026&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=6&optIn=true&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&anxe=InstallerAccepted&anxr=145020026
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654082774&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=7&searchAssistantOptIn=true&homePageOptIn=true&tbUID=49F19948-7BCF-4240-BFE9-02783025B89B&tbVer=8.22.3.63617&anxe=InstallerFinished&anxr=204005028
hxxp://a1255.g.akamai.net/images/nocache/native/globalBlacklist-1.1.json
hxxp://www180.myway.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
hxxp://www156a.mywebsearch.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=PluginInvoked&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1648335828&controlName=SearchControl&methodName=UpdateSearch&resultCode=5&errorMessage=
hxxp://www156a.mywebsearch.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=ToolbarActive&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1996612041&defaultSearchState=overridePending&isStore=true&tabEnabled=true
hxxp://www156a.mywebsearch.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=DialogView&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=82084862&dialogType=MODAL&anxs=RestartPromptAfterInstall
hxxp://www187.mindspark.com/anx.gif?anxa=CAPToolbarButtons&anxe=ButtonStructure&anxr=494291852&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=
hxxp://dart.l.doubleclick.net/activity;src=3962930;type=invmedia;cat=roprkm09;ord=9452643389813.602?
hxxp://dart.l.doubleclick.net/activity;src=3335366;type=retar633;cat=conve083;ord=1;num=6300925726536.661?
hxxp://www180.myway.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe16.df.jabodo.com&anxu=http://www.fromdoctopdf.com/install_pixels.jhtml&anxl=en-US&anxlv=1402654084269&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&tbUID=74E82E32-0EC6-4320-8733-FD9C2C5FC58B&tbVer=8.22.3.63617&anxe=PixelFrameTB&anxr=1246908666
hxxp://pagead.l.doubleclick.net/pixel?google_nid=triggit1&cb=qbaf3c&google_hm=ZU5tZXFYSzhTT3FXaFNtaFdLckJEUQ==
hxxp://pixel.fetchback.com/serve/fb/pdc?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID&xr=2972455870849468926&referer=http://www.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id= 174.128.15.11
hxxp://a.triggit.com/pxgcm?id=&cb=qbaf3c 217.72.242.210
hxxp://star.c10r.facebook.com/fr/u.php?p=185501061579159&m=eNmeqXK8SOqWhSmhWKrBDQ&t=2592000&cb=vxrmwm
hxxp://pixel.fetchback.com/serve/fb/ver?uatFilter=false&fb_key=cat=&name=success&sid=4242&crv=client_revenue&oid=order_id&xr=2972455870849468926&referer=http://www.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^chryyy^yya^ua&coid=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=http://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=client_revenue&oid=order_id /serve/fb/pdc http://www.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^chryyy^yya^ua&coid=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=&cat=&sid=4242&name=success&uid=1402654085045:2886897097294093&crv=0.0&oid=ORDER_ID 174.128.15.11
hxxp://www156a.mywebsearch.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=UIControl&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1112274432&dialogType=MODAL&anxs=RestartPromptAfterInstall&uitype=button&controlID=Restart
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background3/1370528131060.PNG 23.0.174.19
hxxp://fromdoctopdf.dl.tb.ask.com/favicon.ico 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654077906&anxsq=9&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=5864BD4E-284B-4517-9409-6B6363B179CD&paidInstall=true&restartUrl=http://www.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=1739394702 74.113.233.180
hxxp://ak.imgfarm.com/images/download/ask/browsers_0927.png 23.0.174.19
hxxp://anx.tb.ask.com/anx.gif?anxa=CAPToolbarButtons&anxe=ButtonStructure&anxr=494291852&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi= 74.113.233.187
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654055518&anxsq=6&optIn=true&anxe=InstallerAccepted&anxr=50009494 74.113.233.180
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/lisa.delmar/asset3/1395430291650.png 23.0.174.19
hxxp://ak.imgfarm.com/images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/FromDocToPDFSetup.exe 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background/1384378062049.png 23.0.174.19
hxxp://www.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id= 74.113.233.180
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de5524d4290fb763 23.0.174.10
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background/1384380910009.png 23.0.174.19
hxxp://ad.doubleclick.net/activity;src=3962930;type=invmedia;cat=roprkm09;ord=9452643389813.602? 173.194.39.187
hxxp://ocsp.verisign.com/ 23.42.27.27
hxxp://ak.imgfarm.com/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149/images/PDFToDOC.bmp 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=&anxu=http://www.fromdoctopdf.com/ieEnable.jhtml&anxl=en-US&anxlv=1402654043722&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&url=installComplete.jhtml&anxe=PageRedirect&anxr=770063518 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654070926&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&cookiesEnabled=1&anxe=SplashLanding&anxr=1798796993 74.113.233.180
hxxp://www.fromdoctopdf.com/favicon.ico 74.113.233.180
hxxp://www.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml 74.113.233.180
hxxp://ak.imgfarm.com/images/nocache/native/globalBlacklist-1.1.json 23.0.174.19
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f+tw/GciJ7fvbA4gIz7D4CEH6T6/t8xk5Z6kuad9QG/Ds= 23.42.27.27
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://www.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654042240&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=SuccessPopDisplayButton&anxr=468097023 74.113.233.180
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/100000459/background/1365611127529.jpg 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=&anxu=http://www.fromdoctopdf.com/ieEnable.jhtml&anxl=en-US&anxlv=1402654041710&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=ieEnableLanding&anxr=548041706 74.113.233.180
hxxp://fromdoctopdf.dl.tb.ask.com/mirrorCookies.jhtml 74.113.233.180
hxxp://cdn.clicktale.net/www/tc/WRe12.js 151.249.90.198
hxxp://fromdoctopdf.dl.tb.ask.com/localStorage.jhtml?toolbarData={"toolbarId":"062329B0-5521-4737-A396-00ACFB474D4F","partnerId":"^Y6^chryyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"CRX_WEBSTORE","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=","successUrl":"http://www.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"} 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654073026&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=6&optIn=true&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&anxe=InstallerAccepted&anxr=145020026 74.113.233.180
hxxp://cm.g.doubleclick.net/pixel?google_nid=triggit1&cb=4gd7ho&google_hm=bGRGQlBwZ2hTMktpby12RV9vRUVVUQ== 173.194.39.173
hxxp://cdn.clicktale.net/www06/phc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js 151.249.90.198
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052862&anxsq=5&anxe=SplashLandingClicked&anxr=475871741 74.113.233.180
hxxp://live.tb.ask.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=DialogView&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=82084862&dialogType=MODAL&anxs=RestartPromptAfterInstall 74.113.233.156
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654070874&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&present=false&anxe=ToolbarDetect&anxr=1152182241 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654036891&anxsq=11&popStyle=up&url=http://www.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml&anxe=PostInstallPop&anxr=869555314 74.113.233.180
hxxp://ak.imgfarm.com/images/download/wb/fftest_arrow_lrg_up.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background999/1384380933076.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/202980021/background1/1360876073072.png 23.0.174.19
hxxp://cm.g.doubleclick.net/pixel?google_nid=triggit1&cb=qbaf3c&google_hm=ZU5tZXFYSzhTT3FXaFNtaFdLckJEUQ== 173.194.39.173
hxxp://ak.imgfarm.com/images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/65ffxtbr-rsl@FromDocToPDF_65.com.xpi 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654024251&anxsq=6&anxe=InstallerInvoked&anxr=1993629022 74.113.233.180
hxxp://ak.imgfarm.com/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149.1386688310219.cab 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654073022&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=5&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=49F19948-7BCF-4240-BFE9-02783025B89B&paidInstall=true&restartUrl=http://www.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=220991762 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe16.df.jabodo.com&anxu=http://www.fromdoctopdf.com/install_pixels.jhtml&anxl=en-US&anxlv=1402654084269&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&tbUID=74E82E32-0EC6-4320-8733-FD9C2C5FC58B&tbVer=8.22.3.63617&anxe=PixelFrameTB&anxr=1246908666 74.113.233.180
hxxp://ak.imgfarm.com/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-20131210101753.1386688673767.cab 23.0.174.19
hxxp://ak.imgfarm.com/images/anx/anemone-1.2.7.js 23.0.174.19
hxxp://ak.imgfarm.com/images/nocache/vicinio/207743773/com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-20131210101753/images/DocToPDF.bmp 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/207743773/100025130_1284560908837_1354049527576.bmp 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset5/1370528117612.png 23.0.174.19
hxxp://ad.doubleclick.net/activity;src=3962930;type=invmedia;cat=rwavulrf;ord=715925385974.9415? 173.194.39.187
hxxp://www.google-analytics.com/ga.js 173.194.39.174
hxxp://www.fromdoctopdf.com/ 74.113.233.180
hxxp://evsecure-ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRFp9TUB3UaX73tHhkdSo3sUtJBVQQU/IpQup65JVp7VYVPlQBjj+lYa0MCEFUtiDipO/Hsoj7MGX5O054= 23.42.27.27
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset2/1384380963413.gif 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset3/1395254553071.png 23.0.174.19
hxxp://gtssl-ocsp.geotrust.com/ 23.42.27.27
hxxp://ak.imgfarm.com/images/toolbar/btn2/test_03_icon_edit.bmp 23.0.174.19
hxxp://live.tb.ask.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=UIControl&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1112274432&dialogType=MODAL&anxs=RestartPromptAfterInstall&uitype=button&controlID=Restart 74.113.233.156
hxxp://config.tb.ask.com/cfg.jhtml?p2=^Y6^yyyyyy^YYA^ua&s=t207743773&tv=2.5.14.85&v=2.5.14.85&e=68a5&r=4686&l=9&c=01&f=002021a1&a=7BE109F9-E265-40DB-885D-AC3553B091B9&n=2014061306&lidate=2014-06-13T10:07:18Z&cv=3 74.113.233.186
hxxp://ad.doubleclick.net/activity;src=3962930;type=invmedia;cat=rwavulrf;ord=9295666029211.133? 173.194.39.187
hxxp://ak.imgfarm.com/images/download/wb/allow_xpi_box_white.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset14/1394830119959.png 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654024281&anxsq=7&optIn=true&searchAssistantOptionIE=true&searchAssistantOptInIE=true&homePageOptionIE=true&homePageOptInIE=true&anxe=InstallerHostAccepted&anxr=1797796994 74.113.233.180
hxxp://ak.imgfarm.com/images/download/IE9EnableButton_US.png 23.0.174.19
hxxp://www.fromdoctopdf.com/installComplete.jhtml?close=true 74.113.233.180
hxxp://cdn.clicktale.net/www06/pcc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js?DeploymentConfigName=Release_29012014&Version=3 151.249.90.198
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background999/1384378039938.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/207743773/100025132_1284560970104_1354049568688.bmp 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe12.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654068215&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=C86E3194-D004-45EC-9B51-4B9892B55A5D&anxe=backFill&anxr=1375836688 74.113.233.180
hxxp://ak.imgfarm.com/images/vicinio/207743773/100025126_1284560681838_1354049612079.bmp 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/207743773/background999/1372459906306.png 23.0.174.19
hxxp://ad.doubleclick.net/activity;src=3335366;type=retar633;cat=conve083;ord=1;num=6300925726536.661? 173.194.39.187
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://www.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654043715&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&anxe=installCompleteLanding&anxr=1945279672 74.113.233.180
hxxp://ak.imgfarm.com/images/nocache/vicinio/207743773/com.mindspark.translate.unbranded-en-1.1.1-20131004150724.1380913644838.cab 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654082774&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=7&searchAssistantOptIn=true&homePageOptIn=true&tbUID=49F19948-7BCF-4240-BFE9-02783025B89B&tbVer=8.22.3.63617&anxe=InstallerFinished&anxr=204005028 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052851&anxsq=3&present=false&anxe=ToolbarDetect&anxr=1007230226 74.113.233.180
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsK8Var42Wv2Ct+B0CPyO0igBZwgQUpe8LEc7AQQOjSmWQSLIc4FctfUcCEB+8ikybeTktioIu7LY7T/Q= 23.42.27.27
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/211634648/background999/1372437932631.png 23.0.174.19
hxxp://www.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id= 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654072983&anxrd=www.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=4&anxe=SplashLandingClicked&anxr=1839575857 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052861&anxsq=4&cookiesEnabled=1&anxe=SplashLanding&anxr=310554195 74.113.233.180
hxxp://ak.imgfarm.com/images/nocache/vicinio/207743773/com.mindspark.translate.unbranded-en-1.1.1-20131004150724/images/logo-unbranded.bmp 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/scott.schaffer/asset2/1389111048923.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background1/1370528215804.png 23.0.174.19
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEG5P+rPF5mnE0WfJkqvoWMQ= 23.42.27.27
hxxp://ts-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMzHSa1N197z/b7EyALt0CEA7P9DjI/r81bgTYapgbGlA= 23.42.27.27
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654026464&anxsq=10&searchAssistantOptIn=true&homePageOptIn=true&tbUID=7BE109F9-E265-40DB-885D-AC3553B091B9&tbVer=2.5.14.85&anxe=InstallerFinished&anxr=1803291899 74.113.233.180
hxxp://fonts.googleapis.com/css?family=Shadows Into Light Two|Raleway:400,900,800,700,600,500,300,200,100 173.194.70.95
hxxp://ad.doubleclick.net/activity;src=3962930;type=invmedia;cat=rwavulrf;ord=4846481317772.642? 173.194.39.187
hxxp://cdn.clicktale.net/www06/ptc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js 151.249.90.198
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/button1/1384361682725.png 23.0.174.19
hxxp://fromdoctopdf.dl.tb.ask.com/localStorage.jhtml?toolbarData={"toolbarId":"49F19948-7BCF-4240-BFE9-02783025B89B","partnerId":"^Y6^chryyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"CRX_WEBSTORE","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=","successUrl":"http://www.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"} 74.113.233.180
hxxp://ak.imgfarm.com/images/download/firefox/InstallOnFirefox.png 23.0.174.19
hxxp://www.fromdoctopdf.com/installComplete.jhtml 74.113.233.180
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= 23.42.27.27
hxxp://www.fromdoctopdf.com/splashPixels.jhtml 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016053&anxsq=3&present=false&anxe=ToolbarDetect&anxr=1389726331 74.113.233.180
hxxp://ak.imgfarm.com/images/vicinio/207743773/Logo1_1335461569136.bmp 23.0.174.19
hxxp://www.facebook.com/fr/u.php?p=185501061579159&m=ldFBPpghS2Kio-vE_oEEUQ&t=2592000&cb=e2tpvm 31.13.81.128
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654053953&anxsq=8&anxe=SplashLandingClicked&anxr=212412536 74.113.233.180
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset13/1394830290310.png 23.0.174.19
hxxp://www.facebook.com/fr/u.php?p=185501061579159&m=eNmeqXK8SOqWhSmhWKrBDQ&t=2592000&cb=vxrmwm 31.13.81.128
hxxp://ak.imgfarm.com/images/download/runrun/test/rebuttal/Alert.png 23.0.174.19
hxxp://bstat.tb.ask.com/tr.gif?anxa=CAPToolbar&amp&anxpt=windows&anxpv=2,6,1 74.113.233.156
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 23.0.174.18
hxxp://ad.doubleclick.net/activity;src=3962930;type=invmedia;cat=roprkm09;ord=64701985177.376686? 173.194.39.187
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset10/1394830064218.png 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016364&anxsq=4&cookiesEnabled=1&anxe=SplashLanding&anxr=2043420352 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654025397&anxsq=8&optIn=true&searchAssistantOptionIE=true&searchAssistantOptInIE=true&homePageOptionIE=true&homePageOptInIE=true&searchAssistantOptionFF=true&searchAssistantOptInFF=true&homePageOptionFF=true&homePageOptInFF=true&browserInstallOptionIE=false&browserInstallOptInIE=false&browserInstallOptionFF=true&browserInstallOptInFF=true&anxe=InstallerAccepted&anxr=1388818192 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052847&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=68E760C8-462C-4F26-9CF2-EA1EEB257FB3&anxe=backFill&anxr=1854133171 74.113.233.180
hxxp://fromdoctopdf.dl.tb.ask.com/localStorage.jhtml?toolbarData={"toolbarId":"5864BD4E-284B-4517-9409-6B6363B179CD","partnerId":"^Y6^foxyyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"XPI","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^foxyyy^YYA^ua&coId=027382d5aeee4be8a36350dfd4a6412c&cake_id=&offer_id=","successUrl":"http://www.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"} 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654021561&anxsq=5&anxe=SplashLandingClicked&anxr=1414323696 74.113.233.180
hxxp://ak.imgfarm.com/images/download/runrun/test/rebuttal/WPanel_P2_01.png 23.0.174.19
hxxp://ak.imgfarm.com/images/download/ask/pba_0927.png 23.0.174.19
hxxp://evsecure-ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFt3WcYXhOFexyfAMpUpKGs= 23.42.27.27
hxxp://anx.mindspark.com/tr.gif?anxa=IE9 Messages&anxe=Run Overlay - View&anxt=&anxtv=&anxp=^Y6^yyyyyy^YYA^ua&anxsi=&anxr=1402654027483&anxv=1.0&anxd=2011-04-01 74.113.233.187
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/asset11/1394830028148.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/100000487/SearchButton_65x24_02_1327418199715.bmp 23.0.174.19
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654026458&anxsq=9&optIn=true&searchAssistantOptionFF=true&searchAssistantOptInFF=true&homePageOptionFF=true&homePageOptInFF=true&anxe=InstallerSecondaryAccepted&anxr=679204151 74.113.233.180
hxxp://ak.imgfarm.com/images/installer/enable/content_area.png 23.0.174.19
hxxp://ad.doubleclick.net/activity;src=3335366;type=retar633;cat=conve083;ord=1;num=2241504676063.0083? 173.194.39.187
hxxp://live.tb.ask.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=PluginInvoked&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1648335828&controlName=SearchControl&methodName=UpdateSearch&resultCode=5&errorMessage= 74.113.233.156
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016034&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=FC261152-5CED-495D-A898-4A9A960C441A&anxe=backFill&anxr=1023458378 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe11.df.jabodo.com&anxu=http://www.fromdoctopdf.com/install_pixels.jhtml&anxl=en-US&anxlv=1402654046646&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&tbUID=7BE109F9-E265-40DB-885D-AC3553B091B9&tbVer=2.5.14.85&anxe=PixelFrameTB&anxr=763999164 74.113.233.180
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://www.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654046478&anxrd=www.fromdoctopdf.com&anxrp=ieEnable.jhtml&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=installCompleteLanding&anxr=1109513793 74.113.233.180
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl 23.0.174.18
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/jason.pepping/background2/1372348471308.png 23.0.174.19
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAFSh8UnRmbfJXQAAQAAAVI= 108.162.232.197
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/207743773/asset1/1395069229875.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/dsp-images/207743773/asset1/1395069199615.png 23.0.174.19
hxxp://ak.imgfarm.com/images/vicinio/100000486/AskToolbarIcon_1354224599535.bmp 23.0.174.19
hxxp://config.tb.ask.com/cfg.jhtml?p2=^Y6^yyyyyy^YYA^ua&s=t207743773&tv=2.5.14.85&v=2.5.14.85&e=68a5&r=0&l=9&c=01&f=002021a1&a=7BE109F9-E265-40DB-885D-AC3553B091B9&lidate=2014-06-13T10:07:18Z 74.113.233.186
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEAmEF/fqZAbsezIFkOF6Zbc= 23.42.27.27
hxxp://www.fromdoctopdf.com/anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://www.fromdoctopdf.com/&anxl=en-US&anxlv=1402654053947&anxsq=7&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=5864BD4E-284B-4517-9409-6B6363B179CD&paidInstall=true&restartUrl=http://www.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=433607125 74.113.233.180
hxxp://live.tb.ask.com/tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=ToolbarActive&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1996612041&defaultSearchState=overridePending&isStore=true&tabEnabled=true 74.113.233.156
clients3.google.com 173.194.39.162
eula.mindspark.com 74.113.233.64
support.mindspark.com 63.236.97.91
themes.googleusercontent.com 173.194.39.170
sb-ssl.google.com 173.194.39.162
ak.ssl.imgfarm.com 2.21.110.3
addons.mozilla.org 63.245.216.132
chrome.google.com 173.194.39.162
www.googleapis.com 173.194.70.95
accounts.youtube.com 173.194.39.160
clients2.google.com 173.194.39.165
extended-validation-ssl.verisign.com 69.58.181.71
www.google.com.ua 173.194.39.191
seal.verisign.com 199.7.51.231
clients4.google.com 173.194.39.168
oauth.googleusercontent.com 173.194.39.170
developer.android.com 173.194.39.162
www.bing.com 204.79.197.200
www.gstatic.com 173.194.39.184
ssl.gstatic.com 173.194.39.184
www.mindspark.com 74.113.233.83
tools.google.com 173.194.39.165
apis.google.com 173.194.39.168
services.addons.mozilla.org 63.245.216.134
home.tb.ask.com 74.113.233.48
clients2.googleusercontent.com 173.194.39.172
www.mozilla.org 63.245.217.105
snippets.mozilla.com 63.245.217.55
lh5.googleusercontent.com 173.194.39.170
activations.cdn.mozilla.net 68.232.34.191
ieonline.microsoft.com 204.79.197.200
accounts.google.com 173.194.70.84
translate.googleapis.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /splashPixels.jhtml HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=062329B0-5521-4737-A396-00ACFB474D4F; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=; successUrl=hXXp://VVV.fromdoctopdf.com/installComplete.jhtml; defaultSearchOption=true; defaultSearch=true; homePageOption=true; homePage=true; sessionData="b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9 QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIv SfaUQHy90X1sxm jcyPhrZaVY9ePe7m6XNQDpex8QF22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; cookieEnabled=true; anx="u
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:52 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="sxZ4ZF5IibvfSKqfgLj09lPDxOA0GrOWgLMfK f0kOsxTSv4AM5ACMGb3V/9n1s5jnQpZXvQCbrkFUXEm2v5PM/kayNqKg bt71TqA61sFBKeNv78faqxk0X4yCoMubCeK3HSeoU0wBv9s30tNheQXLWE 5aLvbKiW PHM0QQqSjDmSmPMMvPPCHTSlEn6QEH2YcZlex/IQ6m1XVSZNlQetZJbxHljw46hrTFxrrdKtSeDuNu9kirXHmJovMbdYR/iujY0c4hxR0K5wIfcZiPZ6BgpwPpwzkvPFHaEGoeZjfYapa4hsA9KFI hpSEy8pXyq5fuWXUZUcgoSXWyZJmwhEXZ0D0HmiDcR1WCq9gseIVj/RsYq7dB5X5jJ3IuzdXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIvCRhivhu5/Q3TzU6hz51TyJSZQJTjpeI8t p6EkYWTzl22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=245A566E-8953-4A13-83EC-4C8ED5D14DF5&fv=1402654068215&lv=1402654072983&nv=8&t=-&v=-&p=-&si=-&sn=dfprdsndlfe13.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=13.0 r0&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^chryyy^YYA^ua&xi=CRX_WEBSTORE&xtp=vhigh&xs=22641&xp=vicinio&xrt=YYA&xt=intdefaultcrx&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=a32478ee78164a828a23db60ad1f373f&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:53 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Content-Length: 519
Connection: close
Content-Type: text/html;charset=UTF-8
...........SMo.0......tI.5v.. [email protected]'....m=.0`.....#.YT.
..o..Bm..9E.....K.hK......K..y.....DuM....l./.d...X.....m.c...XG5)G...
y..u`.'X.~[.]..3..D.v..a.w x.QG.K..!`C.&.....q.:D..E..~MfC............
..m.w.V.p..k.'<.h.-0..A... ...U..}.6RvluxN.5.f...>.....G.c.S @{.
Ev..#^..`j.rDh)F'e...'j.;..,....fG...q...ly.]..W.|~.....2..........>
;.........J...J. ......R.I-....,..O.X2.F.O....f.kv..)...mS;2f..R.....|
....pys..Gx.w.Z.s......ux.).r&p...G...\.j.....Q...2d..\..T........-..H
.g.@.(.g......6...dg.}..H.kX..=a.Z......
<<< skipped >>>


POST / HTTP/1.1
Host: ocsp.verisign.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 115
Content-Type: application/ocsp-request
Connection: keep-alive

0q0o0M0K0I0... ........l .Z....`....?#...Y.........A..Je.H...W-}G.....L.y9-.....;O...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 00:41:52 GMT
Expires: Thu, 19 Jun 2014 00:41:52 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1852
Cache-Control: max-age=484558, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:34 GMT
Connection: keep-alive
0..8......10..-.. .....0......0...0...........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1>0<..U...5Ver
iSign Class 3 Secure Server CA - G2 OCSP Responder..20140612004152Z0s0
q0I0... ........l .Z....`....?#...Y.........A..Je.H...W-}G.....L.y9-..
...;O.....20140612004152Z....20140619004152Z0...*.H................,[p
..U.:.....*.p..V....~........Q.....B..pR.[....3..V.D...a..Y.3.s..E.`..
..*[email protected]...'......t*#.N.w....r.lV.%p.B.L.[...
..u.pjA._.....x..Y[.....s..mx.P.u........bg.>NgT.......|0.uF.X..(.o
.Ap~....">...^S....ER`.S......:...Ah*...R......0...0...0..........?
.Q..R^O._D.h*0.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc
.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://w
ww.verisign.com/rpa (c)091/0-..U...&VeriSign Class 3 Secure Server CA 
- G20...140504000000Z..140802235959Z0..1.0...U....US1.0...U....VeriSig
n, Inc.1.0...U....VeriSign Trust Network1>0<..U...5VeriSign Clas
s 3 Secure Server CA - G2 OCSP Responder0.."0...*.H.............0.....
.......t..y...J.....@./..3.....PE......&W...y.....N....3.\.y.kB.^.....
....MA.w.\f.F-..(.......4.t.......H;$.SJk.....7,..kH<....]QB..Eb)..
..-.O.._o..b..j......L.....g.....6r..c.G...Q....MQ......'w....l.'.....
>...w.j'fX.Qh.v...N7..Q...Q{.z..bY....>q..cK.I.*.S=..........0..
.0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://www
.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS
 incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .....
<<< skipped >>>

POST / HTTP/1.1


Host: ocsp.verisign.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 115
Content-Type: application/ocsp-request
Connection: keep-alive

0q0o0M0K0I0... ...................F....0.yV......{&.K......&............d..{2...ze...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 07:30:40 GMT
Expires: Thu, 19 Jun 2014 07:30:40 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1843
Cache-Control: max-age=509119, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:37 GMT
Connection: keep-alive
0../......(0..$.. .....0......0...0...........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign 
Class 3 Code Signing 2010 OCSP Responder..20140612073040Z0s0q0I0... ..
.................F....0.yV......{&.K......&............d..{2...ze.....
20140612073040Z....20140619073040Z0...*.H...................BJr.2i..a.
...E....c..1}.....)q8...f:...]" .6:&m.......8E.N.ef.Q.W..}u.....e.o$.Y
E..%..d..*....3gl.4......YK.....c.}?.j.Q.{O...AK..!.!y.....MW....)..q.
...N..C..8m/3....JY.i..........^P...o....C..L..G>Si..(..7..i.U..J..
..4....:..G..%..=..M.A....K..........0...0...0............b.Y".!.F.|..
..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....V
eriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.c
om/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140330
000000Z..140628235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U
....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 201
0 OCSP Responder0.."0...*.H.............0.........F........../.j...{..
...T......ZI.X......AD..;...`...Yg..../..:...$U.G1.....G4.Pan..}`.....
.a...>a.f.9.d...CH][email protected].. .. ...\...aT
FB..a....]..........lw.d...|[email protected].&7.2.." u..u..:..BY.....
.....hJ.n.is!...U. .P.YQ ............0...0...U....0.0....U. ...0..0...
.`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0
V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. lt
d. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0....
<<< skipped >>>

POST / HTTP/1.1


Host: ocsp.verisign.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 115
Content-Type: application/ocsp-request
Connection: keep-alive

0q0o0M0K0I0... .........)8t..).~.5bRd.S
....
D\.SD..~. .%..c..y...]......[y......k..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Last-Modified: Wed, 11 Jun 2014 17:41:36 GMT
Expires: Wed, 18 Jun 2014 17:41:36 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1852
Cache-Control: max-age=459280, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:38 GMT
Connection: keep-alive
0..8......10..-.. .....0......0...0...........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1>0<..U...5Ver
iSign Class 3 Secure Server CA - G3 OCSP Responder..20140611174136Z0s0
q0I0... ..........)8t..).~.5bRd.S......D\.SD..~. .%..c..y...]......[y.
.....k....20140611174136Z....20140618174136Z0...*.H...................
.!.....3.......$Q.......=(W..~........f..y.v......D.i. wH:Wy.LB.3..p[;
0.....;.T.$...V:...R..#..9S......B..[.!.L...............z.....e.sp.2=.
.. ..... ....H$..V]..B.......}.. .W_..tc9...x..(....qo.]...\.^.{{.Aq@.
 o......j......2.M{;.7..<.....x...rRJ.......0...0...0..........j...
.nN.8...6...0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.
0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.
verisign.com/rpa (c)101/0-..U...&VeriSign Class 3 Secure Server CA - G
30...140330000000Z..140628235959Z0..1.0...U....US1.0...U....VeriSign, 
Inc.1.0...U....VeriSign Trust Network1>0<..U...5VeriSign Class 3
 Secure Server CA - G3 OCSP Responder0.."0...*.H.............0........
.7o./E.G .^U.........!.......]..\..B..j.8.{32...2. K.&.B.x....N.UV.F7.
D.X..w.E.......f.........(d0o.....&d...Oc.&....K?P.>......NZ .C.{O.
S....=.A<....G.....?.d...|6A.[..)2m.....t.^.8.Xys[..).-....yp....i.
{%..N`.........c.xv.Y|..Z..../...M...;nr.]..-..3y)...........0...0...U
....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.veris
ign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incor
p. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...
<<< skipped >>>


GET /px?u=Cy&rtv=convertor&ct=ffd59f4f6ea2c23b&ctval1=[CONVERSION TYPE] HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: a.triggit.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"
X-From: uk-bidder-01
Set-Cookie: trgu=ldFBPpghS2Kio-vE_oEEUQ; domain=.triggit.com; path=/; expires=Mon, 13-Jun-2016 00:00:00 GMT
Set-Cookie: trgs=2516225169; domain=.triggit.com; path=/;
Set-Cookie: trgp=; domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT
Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=triggit1&cb=4gd7ho&google_hm=bGRGQlBwZ2hTMktpby12RV9vRUVVUQ==
Date: Fri, 13 Jun 2014 10:07:28 GMT
Content-Length: 11
Content-Type: text/html; charset=ISO-8859-1
RedirectingHTTP/1.1 302 Found..Cache-Control: private, no-cache, no-st
ore, must-revalidate..Expires: Sat, 01 Jan 2000 00:00:00 GMT..Pragma: 
no-cache..P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"..X-From: uk-bidder-0
1..Set-Cookie: trgu=ldFBPpghS2Kio-vE_oEEUQ; domain=.triggit.com; path=
/; expires=Mon, 13-Jun-2016 00:00:00 GMT..Set-Cookie: trgs=2516225169;
 domain=.triggit.com; path=/;..Set-Cookie: trgp=; domain=.triggit.com;
 path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT..Location: hXXp://cm.g.
doubleclick.net/pixel?google_nid=triggit1&cb=4gd7ho&google_hm=bGRGQlBw
Z2hTMktpby12RV9vRUVVUQ==..Date: Fri, 13 Jun 2014 10:07:28 GMT..Con
tent-Length: 11..Content-Type: text/html; charset=ISO-8859-1..Redirect
ing....


GET /pxgcm?id=&cb=4gd7ho HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Cookie: trgu=ldFBPpghS2Kio-vE_oEEUQ; trgs=2516225169; trgp=
DNT: 1
Connection: Keep-Alive
Host: a.triggit.com


HTTP/1.1 302 Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"
X-From: uk-bidder-01
Set-Cookie: trgp=GOCa65wF; domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT
Location: hXXp://VVV.facebook.com/fr/u.php?p=185501061579159&m=ldFBPpghS2Kio-vE_oEEUQ&t=2592000&cb=e2tpvm
Date: Fri, 13 Jun 2014 10:07:28 GMT
Content-Length: 11
Content-Type: text/html; charset=ISO-8859-1
RedirectingHTTP/1.1 302 Found..Cache-Control: private, no-cache, no-st
ore, must-revalidate..Expires: Sat, 01 Jan 2000 00:00:00 GMT..Pragma: 
no-cache..P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"..X-From: uk-bidder-0
1..Set-Cookie: trgp=GOCa65wF; domain=.triggit.com; path=/; expires=Fri
, 18-Jul-2014 00:00:00 GMT..Location: hXXp://VVV.facebook.com/fr/u.php
?p=185501061579159&m=ldFBPpghS2Kio-vE_oEEUQ&t=2592000&cb=e2tpvm..Date:
 Fri, 13 Jun 2014 10:07:28 GMT..Content-Length: 11..Content-Type: text
/html; charset=ISO-8859-1..Redirecting....


GET /pxfbcm?s=miss HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Cookie: trgu=ldFBPpghS2Kio-vE_oEEUQ; trgs=2516225169; trgp=GOCa65wF
DNT: 1
Connection: Keep-Alive
Host: a.triggit.com


HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"
X-From: uk-bidder-01
Set-Cookie: trgp=GOCa65wFSOCa65wFUAA=; domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT
Content-Type: image/gif
Date: Fri, 13 Jun 2014 10:07:28 GMT
Content-Length: 43
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, no-cache, no-store, must-revalidate..Expires: Sat, 01 Ja
n 2000 00:00:00 GMT..Pragma: no-cache..P3P: CP="DEVo PSDo OUR BUS DSP 
ALL COR"..X-From: uk-bidder-01..Set-Cookie: trgp=GOCa65wFSOCa65wFUAA=;
 domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT..C
ontent-Type: image/gif..Date: Fri, 13 Jun 2014 10:07:28 GMT..Content-L
ength: 43..GIF89a.............!.......,...........L..;..



POST /mirrorCookies.jhtml HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 708

sessionData=,,-1,false,1,"RCxMB5msf8u5GsSwm4+kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh+SiFsGi4Hh2pVaczSgB+Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6+ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx+RZ3yRmlYEAgWO3AM0ewUvlIm5VajI++48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG+GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5+FVq0pHaSnmXsW6fb3bVQf+D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="&dlput=,,-1,false,1,YYA
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:34 GMT
Server: Apache
Set-Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; Version=1; Domain=fromdoctopdf.dl.tb.ask.com; Max-Age=2592000; Expires=Sun, 13-Jul-2014 10:07:34 GMT; Path=""
Set-Cookie: dlput=YYA; Version=1; Domain=fromdoctopdf.dl.tb.ask.com; Max-Age=2592000; Expires=Sun, 13-Jul-2014 10:07:34 GMT; Path=""
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654054768&xn=&xrm=&xtp=&xct=&xs=&lv=1402654054768&xp=&xrt=&xt=&nv=1&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe17.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="; Version=1; Domain=.tb.ask.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:34 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 93
Connection: close
Content-Type: text/html
..........-.A..0...Rr.....im.B.....W..0...>4s..2.....I...w.3..<.
a.&....TqP.....]..x.7...KX.....
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe11.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/install_pixels.jhtml&anxl=en-US&anxlv=1402654046646&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&tbUID=7BE109F9-E265-40DB-885D-AC3553B091B9&tbVer=2.5.14.85&anxe=PixelFrameTB&anxr=763999164 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData="v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uN78x9/KXKSGcZQ3R33thSkapz sdnvyIiXOCvTH0Uc40eyuIMcAU/0D4IoaooC7fxuQWljAedxSdh SiFsGi4EcXSEqqaa6dTvPwkdn9fPoZtvQs7O1ztS9tljQP93Qn"; anxs="s=1366968256&sv=1402654042225&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654046478&nv=19&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=d14aab68382e45789266ab469fa4
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:27 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /serve/fb/blank HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pixel.fetchback.com
DNT: 1
Connection: Keep-Alive
Cookie: fbid=hlA1LoyqkQpmabCWFbORtV; uid=2_1402654047_1402654047722-3982831531801780; kwd=2_1402654047; uat=2_1402654047; bpd=2_1402654047; cmp=2_1402654047; clk=2_1402654047; afl=2_1402654047; sit=2_1402654047_4242-0-0; cre=2_1402654047; scg=2_1402654047; apd=2_1402654047; eng=2_1402654047; ppd=2_1402654047; act=2_1402654047


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:27 GMT
Cache-Control: public, max-age=31536000
Expires: Saturday, 13 June 2015 06:07:27 o'clock EDT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 139
Connection: close
...........Qt.w...pU....Q..u..tVP....7v.w.q.........))(e...X..........
......g........e&.....(.q.....l2R.S.lJ2KrR.l.a4D4)?....R`.\...........
.



GET /images/download/ask/pba_0927.png HTTP/1.1
Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 23 Sep 2013 16:06:07 GMT
ETag: "113790-dd6-4e70f32b009c4"
Accept-Ranges: bytes
Content-Length: 3542
Cache-Control: max-age=315354163
Expires: Thu, 21 Sep 2023 16:06:07 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:48 GMT
Connection: keep-alive
.PNG........IHDR....... .......P.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...xIDATx..\.TT....A.......b..k.#..hb..R..... -...k..t.Y....L..KrUv
...k.%|.c.^..@ h..G.<..a........a..0..v..~..{......_..T. .B..(.@!"W
.....|.8.;$m...!W.vV)..?.....S.......A..U/.F... ...5...Cw....)r.....$.
"..7......A.....g.....h..FA.:nF.F..9..q]&...jkka...PYi9.......NE..]R0(
@[email protected]. .........Bbb".....BCC..7...#F..e..i.
.3......;GN.\[email protected].....
..e\*......`.....c~.f.W....=..............k..{][email protected]
..>y.d.../.... ^C..>[email protected]..[.o.....~.4....n.._......)Y..
|$.H..^.Z.#8].....ju..... p....w.3.u.%.k3.W...?a..BLL.dee..Y.f..M.`..-
.~...HJJ.U.1..............o|.....n....s.]...#"....Z..t...wO....j......
..\f'..7.....K.,......N.E.@Q.]Q.!..p.R...}....A..>..O........;.....
7h.z.s#.@.`...H4xO....../5;;....=8p..I.Q. ..X..a;...J.A.?.*WWP{...D...
...b........&.jJObu.......}..%.... ./....c..0..R.6m..w..r....Z.....$..
\..e... t........)...3....Ik.zw....h#.I.P......l.vr.;^!. ...6.n9 p....
.i...O...;.v..<-@(6I.R5n.Y...044:.. .....*@.C...s1V....|..Mg..YL.t.
.u.~`..Ahm...(.Z0...U.3..j....l;T<..#....mx.R..$B............,.~.vT
.z...|:.|.H..A........l.<....}..P....oA...._.B..c....Dp...1*Th....O
."...d...lk,.............xy......X....n[....Z-...U9..W..$B...c....p.A.
2X.....N|..3.@=..}...".t?.C....s.(..v=.....{.I......}ee..m..J........"
4...-.....h:...|.}.....7...W..&X.. .....Q.R..6d.EX.m.........1........
...VB..S...Q.4P....Hl....`u.$R.,...g$..V...p.M....j.5....6.g..BqO.
<<< skipped >>>


GET /fr/u.php?p=185501061579159&m=eNmeqXK8SOqWhSmhWKrBDQ&t=2592000&cb=vxrmwm HTTP/1.1
Host: VVV.facebook.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 302 forced.302
Location: hXXp://a.triggit.com/pxfbcm?s=miss
Date: Fri, 13 Jun 2014 03:08:05 PDT
X-Content-Type-Options: nosniff
Pragma: public
Content-Security-Policy: default-src *;script-src hXXps://*.facebook.com hXXp://*.facebook.com hXXps://*.fbcdn.net hXXp://*.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' hXXps://*.akamaihd.net hXXp://*.akamaihd.net *.atlassolutions.com chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl;style-src * 'unsafe-inline';connect-src hXXps://*.facebook.com hXXp://*.facebook.com hXXps://*.fbcdn.net hXXp://*.fbcdn.net *.facebook.net *.spotilocal.com:* hXXps://*.akamaihd.net ws://*.facebook.com:* hXXp://*.akamaihd.net hXXps://fb.scanandcleanlocal.com:* *.atlassolutions.com hXXp://attachment.fbsbx.com hXXps://attachment.fbsbx.com;
X-XSS-Protection: 0
Cache-Control: public, max-age=0
Expires: Fri, 13 Jun 2014 03:08:05 PDT
Content-Type: text/html; charset=utf-8
X-FB-Debug: V5kWRsmCjQ5WuvGGHkgYKJhWkEDXTBxA7jDykKOoKEgNEDdB8TQ5jomQPMLFrE4LF ZA11G7 OJV44ZAqKppmQ==
Connection: keep-alive
Content-Length: 0
HTTP/1.1 302 forced.302..Location: hXXp://a.triggit.com/pxfbcm?s=miss.
.Date: Fri, 13 Jun 2014 03:08:05 PDT..X-Content-Type-Options: nosniff.
.Pragma: public..Content-Security-Policy: default-src *;script-src htt
ps://*.facebook.com hXXp://*.facebook.com hXXps://*.fbcdn.net hXXp://*
.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.
google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval
' hXXps://*.akamaihd.net hXXp://*.akamaihd.net *.atlassolutions.com ch
rome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl;style-src * 'unsafe-
inline';connect-src hXXps://*.facebook.com hXXp://*.facebook.com https
://*.fbcdn.net hXXp://*.fbcdn.net *.facebook.net *.spotilocal.com:* ht
tps://*.akamaihd.net ws://*.facebook.com:* hXXp://*.akamaihd.net https
://fb.scanandcleanlocal.com:* *.atlassolutions.com hXXp://attachment.f
bsbx.com hXXps://attachment.fbsbx.com;..X-XSS-Protection: 0..Cache-Con
trol: public, max-age=0..Expires: Fri, 13 Jun 2014 03:08:05 PDT..Conte
nt-Type: text/html; charset=utf-8..X-FB-Debug: V5kWRsmCjQ5WuvGGHkgYKJh
WkEDXTBxA7jDykKOoKEgNEDdB8TQ5jomQPMLFrE4LF ZA11G7 OJV44ZAqKppmQ==..Con
nection: keep-alive..Content-Length: 0..
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654043715&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&anxe=installCompleteLanding&anxr=1945279672 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml?close=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2HeZ6TbjmVBUbWkFvGCiEYAhDgRptlLIlXFkBjJMCo y33cCfCHIZ4TzBgM bjk11tGR54TrvXB1 Xfv2KO0d7WlK3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxeVh9iUDi 6MbKN/VlsvVmr6MdhiR ts3I xHVXBH7BogVvowqo2tM9gAL5aqIdBu5ikLdboZrOf AJ9JM7xpZdHSUdNflqpoe3zUzSwOvRJ98o/MevqZSv l8hLzICOEQ7bSLvwgPBy H5GpbxDpvrnpWOwlQe8abXDxNvxpVa3CDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFWkVUjXj4NFLpt9zwThtnQZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anxs="s=486774368&sv=1402654016035&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654043722&nv=16&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.ja
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:24 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654073022&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=5&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=49F19948-7BCF-4240-BFE9-02783025B89B&paidInstall=true&restartUrl=http://VVV.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=220991762 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: cookieEnabled=true; sessionData="sxZ4ZF5IibvfSKqfgLj09lPDxOA0GrOWgLMfK f0kOsxTSv4AM5ACMGb3V/9n1s5jnQpZXvQCbrkFUXEm2v5PM/kayNqKg bt71TqA61sFBKeNv78faqxk0X4yCoMubCeK3HSeoU0wBv9s30tNheQXLWE 5aLvbKiW PHM0QQqSjDmSmPMMvPPCHTSlEn6QEH2YcZlex/IQ6m1XVSZNlQetZJbxHljw46hrTFxrrdKtSeDuNu9kirXHmJovMbdYR/iujY0c4hxR0K5wIfcZiPZ6BgpwPpwzkvPFHaEGoeZjfYapa4hsA9KFI hpSEy8pXyq5fuWXUZUcgoSXWyZJmwhEXZ0D0HmiDcR1WCq9gseIVj/RsYq7dB5X5jJ3IuzdXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIvCRhivhu5/Q3TzU6hz51TyJSZQJTjpeI8t p6EkYWTzl22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yj
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:54 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Wed, 11 Jun 2014 18:01:54 GMT
Expires: Wed, 18 Jun 2014 18:01:54 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1895
Cache-Control: max-age=460720, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:18 GMT
Connection: keep-alive
0..c......\0..X.. .....0.....I0..E0...........0..1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Sym
antec Class 3 PCA - G5 OCSP Responder Certificate 2..20140611180154Z0s
0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V
.......K3.....20140611180154Z....20140618180154Z0...*.H.............H.
......h..\...).-.....#.YY.b.B..Ch....q....{..../...}...u........ZM...&
.b.....z.Lt.d.....{-WH..Z Y...P..Cc.i'.|kt`3..\x.J......1....V.-.^M.X.
~=..>.!.Z........y.1...2u....k..5.^0..O..Y X&$..}...],..67...8k.wI.
F3.*..@..^.-,]0>u....O.~...n.{9......... .L........0...0...0.......
...U..3....2.......0...*.H........0..1.0...U....US1.0...U....VeriSign,
 Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, In
c. - For authorized use only1E0C..U...<VeriSign Class 3 Public Prim
ary Certification Authority - G50...131112000000Z..141212235959Z0..1.0
...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Net
work1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 20
.."0...*.H.............0.........2...#.522.K.....G.....].........5....
..1.mW.....k....zz.5.....ts.o..v.....QtN.W.zO....t....B...:.......GVd.
'=...........6.Lg../......`.. .U..V ...6......Y....e.)....o....._.b...
..1......[.<.j.hT3..f......vJ>...Q.7....U...W3....i!...hu.JK...`
.L...S..@.~N...........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0
&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.syma
uth.com/rpa0...U.%..0... .......0...U...........0... .....0......0
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEAmEF/fqZAbsezIFkOF6Zbc= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 07:30:40 GMT
Expires: Thu, 19 Jun 2014 07:30:40 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1843
Cache-Control: max-age=509232, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:18 GMT
Connection: keep-alive
0../......(0..$.. .....0......0...0...........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign 
Class 3 Code Signing 2010 OCSP Responder..20140612073040Z0s0q0I0... ..
.................F....0.yV......{&.K......&............d..{2...ze.....
20140612073040Z....20140619073040Z0...*.H...................BJr.2i..a.
...E....c..1}.....)q8...f:...]" .6:&m.......8E.N.ef.Q.W..}u.....e.o$.Y
E..%..d..*....3gl.4......YK.....c.}?.j.Q.{O...AK..!.!y.....MW....)..q.
...N..C..8m/3....JY.i..........^P...o....C..L..G>Si..(..7..i.U..J..
..4....:..G..%..=..M.A....K..........0...0...0............b.Y".!.F.|..
..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....V
eriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.c
om/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140330
000000Z..140628235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U
....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 201
0 OCSP Responder0.."0...*.H.............0.........F........../.j...{..
...T......ZI.X......AD..;...`...Yg..../..:...$U.G1.....G4.Pan..}`.....
.a...>a.f.9.d...CH][email protected].. .. ...\...aT
FB..a....]..........lw.d...|[email protected].&7.2.." u..u..:..BY.....
.....hJ.n.is!...U. .P.YQ ............0...0...U....0.0....U. ...0..0...
.`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0
V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. lt
d. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0....
<<< skipped >>>


GET /www06/phc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cdn.clicktale.net
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:21 GMT
Server: PWS/8.0.25
X-Px: ht h0-s1092.p11-fra.cdngp.net
Cache-Control: public, max-age=300
Content-Length: 1028
Content-Type: text/javascript; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Sun, 08 Jun 2014 08:33:00 GMT
Connection: keep-alive
...........V[O.V.~...a.J..dm....o..t...R..C.F.=NN....c.....sq.FTm_ZUH.
.....o...y0..G........v....8c...(C.A$n.n..2.....<a.|w.<?`.......
...O9........?.}{3^ NV.gwgw..`.......,aU..x... .n.'..................y
..?Fw.C..,.ki....Z..6.....e..U .....u..V.`.$p..:....N._..2.b..I8.z}..0
.X..|....3......s\^..5..o.L-.i..X.=.....=.j;.s...p~.,m...Z....L.\\bl?.
<)....#..[a..E..R{..(......5..j........H...b\..ENM..M..5.a....`9..'
]...0cU.6...(...D...k.e..eF...'.e.9.....#....awh...y..g....?.;.....}..
...,.%$.4j^...pD......t..K;=..$.Z......;...mi..g....g\zt..."......D...
E7X.GK..O._u..@*....P......;..d...*...#....f...b.z..%..4.&lj.|X0..6.n.
..{... .B...nU.Z.....`7..R..5/.?..IH...i.o.C[..6...q.m.i....E..bWD0...
./5.G.L*....I<.R..R2....>."...].!..Lo.Q^;E&....9g.z....Uwf.s...x
\.;.>..5'm.....=..$...&.5W/....P.;..iz......u...w.-......F..H..V_..
6........ic.^c..>pF..:.b.J.rK.].K....GZ.}.z.?\.!.s.}yq6....J....w..
.U.....p.#I..."gj...zF:.a...ku....."....U....5;.h.....9......o9.......
T...._...f.U8...hn.....V..........i....5W.g.z..];S....Ku...c..X.d....H
TTP/1.1 200 OK..Date: Fri, 13 Jun 2014 10:07:21 GMT..Server: PWS/8.0.2
5..X-Px: ht h0-s1092.p11-fra.cdngp.net..Cache-Control: public, max-age
=300..Content-Length: 1028..Content-Type: text/javascript; charset=utf
-8..Content-Encoding: gzip..Vary: Accept-Encoding..Last-Modified: Sun,
 08 Jun 2014 08:33:00 GMT..Connection: keep-alive.............V[O.V.~.
..a.J..dm....o..t...R..C.F.=NN....c.....sq.FTm_ZUH......o...y0..G.....
...v....8c...(C.A$n.n..2.....<a.|w.<?`..........O9........?.
<<< skipped >>>


GET /images/vicinio/dsp-images/jason.pepping/asset3/1395254553071.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 19 Mar 2014 18:42:33 GMT
ETag: "3bba5a-384f-4f4fa0403d930"
Accept-Ranges: bytes
Content-Length: 14415
Cache-Control: max-age=315293991
Expires: Sat, 16 Mar 2024 18:42:33 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR... ...F.....45......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:EEDFF4AA302068118083CF9F6CF47C99" xmpMM:DocumentID="xmp.did:C259
FD41764611E3AD6DE92B10AFB3D2" xmpMM:InstanceID="xmp.iid:C259FD40764611
E3AD6DE92B10AFB3D2" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EEDFF4AA3020681180
83CF9F6CF47C99" stRef:documentID="xmp.did:EEDFF4AA302068118083CF9F6CF4
7C99"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.\ER..4}IDATx....`TU....Kf.{.$.P#..((E...(J
....*..gY...m.Q......"6P@qEz.$.R!...$..;......P..|?=d..3w.)s..?.w..-[.
.m....,Mf..K...A..A..At.;K.,.f.-..Z.T.x.fi.K..2d.<........... .. ..
 ...v.5....%%%...o..mZ..\..-.....ddd\...d2....QWS...M.H..A..A.D.....h.
..O.0}!..c.]YYYi."..M.d1..C..E...6..j. .. .. ...;0l.Z........;.;;.G[.#
g..e......A..A..A.g...,4............C.*x..... .. .. .$\cp..5...<.kR
ll.....D.A..[Sy...A..A..qv.Z.k..=..I1..... .q....#...>..8`..c...9. 
"J.[z.`.%..y..c..A..At#<. $,..L..D%...u......X:..o.laN."d..6l..
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/asset13/1394830290310.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 14 Mar 2014 20:51:29 GMT
ETag: "4cf53b-7a82-4f4973bf3f08f"
Accept-Ranges: bytes
Content-Length: 31362
Cache-Control: max-age=311763755
Expires: Mon, 11 Mar 2024 20:51:29 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR...8...........n.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5F3D3991ABBA11E3949C9586
F88F6A72" xmpMM:DocumentID="xmp.did:5F3D3992ABBA11E3949C9586F88F6A72"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F3D398FABBA11E394
9C9586F88F6A72" stRef:documentID="xmp.did:5F3D3990ABBA11E3949C9586F88F
6A72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>8.S...v.IDATx..]..T...y}....N9z....X....5..
.H.M.h,.&F..1.Dc..h$.V.QQ...z..m{y}.3ow....z ..<...o_.73....7....X.
((((((.U0..((((((QQPPPPPP.......DEAAAAAA...............%*......JT.....
..(((((((QQPPPPPP.......DEAAAAAA...............%*......JT.......((((((
(QQPPPPP........DEAAAAAA...............%*.....JT........(((((((QQPPPPP
........DEAAAAAA...............%*.....JT........(((((((QQPPPPP........
DEAAAAA................%*.....JT........((((((QQPPPPPP........DEAAAAA.
..............%*......JT........(((((.<...2-........(((((((QQPPPPP.
......8l..!Z........Q!JT.....}..o....%.>,.>.............$...
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f+tw/GciJ7fvbA4gIz7D4CEH6T6/t8xk5Z6kuad9QG/Ds= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 11:15:45 GMT
Expires: Thu, 19 Jun 2014 11:15:45 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1535
Cache-Control: max-age=522738, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:18 GMT
Connection: keep-alive
0..........0..... .....0......0...0..(........0..1.0...U....ZA1.0...U.
...Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawt
e Certification1 0)..U..."Thawte Timestamping OCSP Responder..20140612
111545Z0s0q0I0... ..........0K..=:s.\.ZY.;3..............r"{~....3.>
;..~...|.NY.K.w...;....20140612111545Z....20140619111545Z0...*.H......
........g...TF.../.....7.j7H.]....t.n...%....C. ...[D.KO`_IJ..a...:dD.
.G.j.<.......*n.Q..F.;w..&j...*..g..:;.,R.4.....l^..6..B.....O.JB..
.a.*.s...9q.....YA.../.Xt&...../.l.Wl..z.3.#Qk3..2&....h,[email protected]...
.../..TjW@..!B[..i...4..............5F...... ..#.n..*.UD....0...0...0.
.........L .."........k..0...*.H........0..1.0...U....ZA1.0...U....Wes
tern Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Cert
ification1.0...U....Thawte Timestamping CA0...140603000000Z..140901235
959Z0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0..
.U....Thawte1.0...U....Thawte Certification1 0)..U..."Thawte Timestamp
ing OCSP Responder0.."0...*.H.............0.........M<.K%.f/.......
1...?..G..kw.....V..#........G....yf..jK.{.....)[ ..q.I2F.7.~..['..I..
8..F......8.....a8g....x".d5.../...0...Q*............o..V..0.R.....u.a
Dw.{.*2K]X..S....ac.~....Q &..[.{/9E.}..*.r.K...I...Y.9(I..Q|6-0m.A..N
f.....cA.....J.....O........*.......d0b0...U....0.0...U.%..0... ......
.0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-10510..
.*.H..............o..y...>].8...x...M/r_x.....$.u.......@)N:.....Wt
..i......0. z....!w.f.......;..$*.{[email protected][email protected]
<<< skipped >>>


GET /images/vicinio/dsp-images/100000459/background/1365611127529.jpg HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 10 Apr 2013 16:25:29 GMT
ETag: "3b2b2f-684-4da041e436d4e"
Accept-Ranges: bytes
Content-Length: 1668
Cache-Control: max-age=300010419
Expires: Sat, 08 Apr 2023 16:25:29 GMT
Content-Type: image/jpeg
Date: Fri, 13 Jun 2014 10:07:27 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:69BA292EA1F111E2BB31930120E20251" xmpMM:DocumentI
D="xmp.did:69BA292FA1F111E2BB31930120E20251"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:69BA292CA1F111E2BB31930120E20251" stRef:doc
umentID="xmp.did:69BA292DA1F111E2BB31930120E20251"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;...&Adobe.d....................9....................................
......................................................................
......................................................................
................................................`.................`...
..............`....................A!q. 1..P0@`Q.................}."..
K..Q...Tj..T..........nZ..........j)vZ.]..We...e.@.....@..............
.....3..........3..........3........?.3........?.3........?.3........?
!..,.2Ye.Ye..2Ye.Y.#%.Y.,.2Y.,...dd..../..,../..........?!.g........?!
.g.............."..`./.....g<n6...H...I$..................?.}..
<<< skipped >>>


GET /?act=statistics&i=7e737kewZYa8pDw+Duoh4MEjmLz/noHd3vtbIbDST8nV HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: g.brothersoft.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: BSWS/2.3
Date: Fri, 13 Jun 2014 10:07:27 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.10
Set-Cookie: ad_out_statistics=5868; expires=Fri, 13-Jun-2014 10:12:27 GMT
Set-Cookie: bs_ad_ck_c=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=g.brothersoft.com
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: BSWS/2.3..Date: 
Fri, 13 Jun 2014 10:07:27 GMT..Content-Type: text/html; charset=UTF-8.
.Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP
/5.3.10..Set-Cookie: ad_out_statistics=5868; expires=Fri, 13-Jun-2014 
10:12:27 GMT..Set-Cookie: bs_ad_ck_c=deleted; expires=Thu, 01-Jan-1970
 00:00:01 GMT; path=/; domain=g.brothersoft.com..Content-Encoding: gzi
p..14........................0..



GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData=v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uxuQWljAedxSdh SiFsGi4P23yvNXpRtTSFfZmYpr4XH5J8v4vQNQAIBJnfgkI3VAHqaPr8h9lCoxE9et3AzVJmWyV4pk3AOByqd9OD6jHdoZtvQs7O1ztS9tljQP93Qn; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654041710&nv=13&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=3&apv_177_www06=3; WRUID=0; tbinstalled=false; dlput=YYA


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:22 GMT
Server: Apache
Accept-Ranges: bytes
ETag: W/"894-1401391120000"
Last-Modified: Thu, 29 May 2014 19:18:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 241
Connection: close
Content-Type: image/x-icon
..........c``.B... )..... ......@!....8..sC0........DX........~.......
([email protected][email protected]...... ..b.....|[email protected].[..0. ..:
.b2.z.-@)..H8...T..._....."...&'.........l.........z..,........10.930.
[email protected]?..7O...4.~.....



GET /www/delivery/ti.php?trackerid=317 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ads.ad4game.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Fri, 13 Jun 2014 10:07:28 GMT
Content-Type: image/gif
Content-Length: 43
Connection: close
X-Powered-By: PHP/5.3.3
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: OA4GUA=mozilla/5.0 (compatible; msie 10.0; windows nt 6.1; wow64; trident/6.0); expires=Sun, 13-Jul-2014 10:07:28 GMT; path=/; domain=ads.ad4game.com
Set-Cookie: OA4GBR=ie#10.0#10#.0##win#nt6.1#193.138.244.231#en-us#msie; expires=Sun, 13-Jul-2014 10:07:28 GMT; path=/; domain=ads.ad4game.com
X-host: ads.ad4game.com
X-serveraddr: 10.57.60.94
X-servername: ads.ad4game.com\ 80\ 81
GIF89a.............!.......,...........D..;..



GET /images/vicinio/dsp-images/jason.pepping/background999/1384380933076.png HTTP/1.1
Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 22:15:33 GMT
ETag: "5d848a-4697-4eb164dc04476"
Accept-Ranges: bytes
Content-Length: 18071
Cache-Control: max-age=297499181
Expires: Sat, 11 Nov 2023 22:15:33 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:48 GMT
Connection: keep-alive
.PNG........IHDR... ... .....T..?....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:3E4965EF44D411E3AFA99E
17741C840E" xmpMM:DocumentID="xmp.did:3E4965F044D411E3AFA99E17741C840E
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3E4965ED44D411E3
AFA99E17741C840E" stRef:documentID="xmp.did:3E4965EE44D411E3AFA99E1774
1C840E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.5,P..C.IDATx.......a....>t. !.@'7..m0
6.c.8......7.v..6mI..o...CK...18|h.c.........#...C6.....@..>vw...}.
....3;........W;3..>#...?..?.-;zc...8....@`...,..........X.........
 ..........@`...,..........X..........6..?.....l.?..7.pF....o..<..S
..{.....q....[{...HTTP/1.1 200 OK..Server: Apache..Last-Modified: Wed,
 13 Nov 2013 22:15:33 GMT..ETag: "5d848a-4697-4eb164dc04476"..Accept-R
anges: bytes..Content-Length: 18071..Cache-Control: max-age=297499181.
.Expires: Sat, 11 Nov 2023 22:15:33 GMT..Content-Type: image/png..Date
: Fri, 13 Jun 2014 10:07:48 GMT..Connection: keep-alive...PNG.....
<<< skipped >>>

GET /images/vicinio/dsp-images/lisa.delmar/asset3/1395430291650.png HTTP/1.1


Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Range: bytes=14279-14279
If-Range: "c5c94c-384f-4f522eecbab1c"


HTTP/1.1 206 Partial Content
Server: Apache
Last-Modified: Fri, 21 Mar 2014 19:31:30 GMT
ETag: "c5c94c-384f-4f522eecbab1c"
Accept-Ranges: bytes
Cache-Control: max-age=308548539
Expires: Mon, 18 Mar 2024 19:31:30 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:51 GMT
Content-Range: bytes 14279-14279/14415
Content-Length: 1
Connection: keep-alive
:....


GET /images/vicinio/dsp-images/lisa.delmar/asset3/1395430291650.png HTTP/1.1


Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Range: bytes=14279-14414
If-Range: "c5c94c-384f-4f522eecbab1c"


HTTP/1.1 206 Partial Content
Server: Apache
Last-Modified: Fri, 21 Mar 2014 19:31:30 GMT
ETag: "c5c94c-384f-4f522eecbab1c"
Accept-Ranges: bytes
Cache-Control: max-age=308548539
Expires: Mon, 18 Mar 2024 19:31:30 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:51 GMT
Content-Range: bytes 14279-14414/14415
Content-Length: 136
Connection: keep-alive
:!.. .. ......9Z=.d.K_S...A..A..q....5.......F.t3K1TW.A..A..A.".>..
......G...,.d)..P.6. .. .. ...s..3.....R...m...`....T:..:....IEND.B`.H
TTP/1.1 206 Partial Content..Server: Apache..Last-Modified: Fri, 21 Ma
r 2014 19:31:30 GMT..ETag: "c5c94c-384f-4f522eecbab1c"..Accept-Ranges:
 bytes..Cache-Control: max-age=308548539..Expires: Mon, 18 Mar 2024 19
:31:30 GMT..Content-Type: image/png..Date: Fri, 13 Jun 2014 10:07:51 G
MT..Content-Range: bytes 14279-14414/14415..Content-Length: 136..Conne
ction: keep-alive..:!.. .. ......9Z=.d.K_S...A..A..q....5.......F.t3K1
TW.A..A..A.".>........G...,.d)..P.6. .. .. ...s..3.....R...m...`...
.T:..:....IEND.B`.....


GET /images/nocache/native/globalBlacklist-1.1.json HTTP/1.1


Host: ak.imgfarm.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 18 Feb 2014 20:47:06 GMT
ETag: "7d65a3-11c-4f2b4600e697c"
Accept-Ranges: bytes
Content-Length: 284
Cache-Control: max-age=315273984
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/json
Date: Fri, 13 Jun 2014 10:08:03 GMT
Connection: keep-alive
[{"p":"^https?:\/\/www\\.google\\.com\/_\/chrome\/newtab"},{"p":"^http
s?:\/\/mail\\.google\\.com\/"},{"p":"^https?:\/\/plus\\.google\\.com\/
"},{"p":"^https?:\/\/docs\\.google\\.com\/"},{"p":"^https?:\/\/[A-Za-z
]*\\.vicinio\\.com\/"},{"p":"^https?:\/\/confluence\\.[A-Za-z]*\\.com\
/"}]HTTP/1.1 200 OK..Server: Apache..Last-Modified: Tue, 18 Feb 2014 2
0:47:06 GMT..ETag: "7d65a3-11c-4f2b4600e697c"..Accept-Ranges: bytes..C
ontent-Length: 284..Cache-Control: max-age=315273984..Expires: Sat 02 
Apr 1977 17:15:00 GMT..Pragma: no-cache..Content-Type: application/jso
n..Date: Fri, 13 Jun 2014 10:08:03 GMT..Connection: keep-alive..[{"p":
"^https?:\/\/www\\.google\\.com\/_\/chrome\/newtab"},{"p":"^https?:\/\
/mail\\.google\\.com\/"},{"p":"^https?:\/\/plus\\.google\\.com\/"},{"p
":"^https?:\/\/docs\\.google\\.com\/"},{"p":"^https?:\/\/[A-Za-z]*\\.v
icinio\\.com\/"},{"p":"^https?:\/\/confluence\\.[A-Za-z]*\\.com\/"}]..



GET /serve/fb/blank HTTP/1.1
Host: pixel.fetchback.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: uid=2_1402654085_1402654085045-2886897097294093; kwd=2_1402654085; uat=2_1402654085; bpd=2_1402654085; cmp=2_1402654085; clk=2_1402654085; afl=2_1402654085; sit=2_1402654085_4242-0-0; cre=2_1402654085; scg=2_1402654085; apd=2_1402654085; fbid=4kZRj2AIpsCP4lfVOnSLkI; eng=2_1402654085; ppd=2_1402654085; act=2_1402654085


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:08:05 GMT
Cache-Control: public, max-age=31536000
Expires: Saturday, 13 June 2015 06:08:05 o'clock EDT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 139
Connection: close
...........Qt.w...pU....Q..u..tVP....7v.w.q.........))(e...X..........
......g........e&.....(.q.....l2R.S.lJ2KrR.l.a4D4)?....R`.\...........
.



GET /tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=ToolbarActive&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1996612041&defaultSearchState=overridePending&isStore=true&tabEnabled=true HTTP/1.1
Host: live.tb.ask.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654073893&xp=&xrt=&xt=&nv=3&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="


HTTP/1.1 204 No Content
Server: nginx/1.0.1
Date: Fri, 13 Jun 2014 10:08:04 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052851&anxsq=3&present=false&anxe=ToolbarDetect&anxr=1007230226 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654052861&nv=3&t=-&v=-&p=-&si=-&sn=dfprdsndlfe14.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyy
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /tr.gif?anxa=IE9 Messages&anxe=Run Overlay - View&anxt=&anxtv=&anxp=^Y6^yyyyyy^YYA^ua&anxsi=&anxr=1402654027483&anxv=1.0&anxd=2011-04-01 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: anx.mindspark.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 204 No Content
Server: nginx/1.0.10
Date: Fri, 13 Jun 2014 10:07:08 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



GET /localStorage.jhtml?toolbarData={"toolbarId":"062329B0-5521-4737-A396-00ACFB474D4F","partnerId":"^Y6^chryyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"CRX_WEBSTORE","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=","successUrl":"http://VVV.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"} HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:50 GMT
Server: Apache
Set-Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654070067&xp=&xrt=&xt=&nv=1&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe4.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="; Version=1; Domain=.tb.ask.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:50 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Content-Length: 470
Connection: close
Content-Type: text/html;charset=UTF-8
..........eR]o.0.}........ .MhG6.m%.0.......o..N.97.h......./.......L2
,....'.P.wC.I.H.....%..51.,.J.H)...nh.2.B.-.:y.T^..m.E.;.^..=.D..{..@)
EB....#......'...\[email protected]..`.2...z....z..&
..h$/k.B.[A....v.x...L...>...\..E...~D8.....U,....<...Oz&..?....
..O....g...]..d...e.J.\2..OM.LLLZ..L.V.i....K.i...F.Ma...G.s.p......cw
L].'.M..z....}.M...LSP.I........m.[......,*...O.,D...j ...G..B2*b.J...
....%9...._..W.F...y.^..WW...:$.K..'u.H.....}....d. ......



GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052861&anxsq=4&cookiesEnabled=1&anxe=SplashLanding&anxr=310554195 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654052862&nv=4&t=-&v=-&p=-&si=-&sn=dfprdsndlfe14.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yy
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016053&anxsq=3&present=false&anxe=ToolbarDetect&anxr=1389726331 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="1KwlOL99CBUb/cm kLnwq9/feNfFDOkQCthghC9WPd84390vaUA8Lj4jM8zroAlXxuQWljAedxSdh SiFsGi4Ha8OPh5ArtmDARBGpQdFqf5J8v4vQNQAIBJnfgkI3VAjZfjct3YpO4X2eAmWIH0QQTahOyEzICj7kdI Mx1ztsS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654016364&nv=3&t=-&v=-&p=-&si=-&sn=dfprdsndlfe21.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YY
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:00 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654072983&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=4&anxe=SplashLandingClicked&anxr=1839575857 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: cookieEnabled=true; sessionData="sxZ4ZF5IibvfSKqfgLj09lPDxOA0GrOWgLMfK f0kOsxTSv4AM5ACMGb3V/9n1s5jnQpZXvQCbrkFUXEm2v5PM/kayNqKg bt71TqA61sFBKeNv78faqxk0X4yCoMubCeK3HSeoU0wBv9s30tNheQXLWE 5aLvbKiW PHM0QQqSjDmSmPMMvPPCHTSlEn6QEH2YcZlex/IQ6m1XVSZNlQetZJbxHljw46hrTFxrrdKtSeDuNu9kirXHmJovMbdYR/iujY0c4hxR0K5wIfcZiPZ6BgpwPpwzkvPFHaEGoeZjfYapa4hsA9KFI hpSEy8pXyq5fuWXUZUcgoSXWyZJmwhEXZ0D0HmiDcR1WCq9gseIVj/RsYq7dB5X5jJ3IuzdXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIvCRhivhu5/Q3TzU6hz51TyJSZQJTjpeI8t p6EkYWTzl22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=49F19948-7BCF-4240-BFE9-02783025B89B; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:54 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /activity;src=3962930;type=invmedia;cat=roprkm09;ord=64701985177.376686? HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ad.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: test_cookie=CheckForPermission


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:07:28 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: id=2277d3bddb0100da||t=1402654048|et=730|cs=002213fd488f456dd2f875cdc9; expires=Sun, 12-Jun-2016 10:07:28 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:07:28 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: id=2277d3bddb0100da||t
=1402654048|et=730|cs=002213fd488f456dd2f875cdc9; expires=Sun, 12-Jun-
2016 10:07:28 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_c
ookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Ju
l 2008 23:59:00 GMT..X-Content-Type-Options: nosniff..Server: cafe..Co
ntent-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol:
 80:quic..GIF89a.............!.......,...........D.;..
<<< skipped >>>


GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe12.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654068215&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=C86E3194-D004-45EC-9B51-4B9892B55A5D&anxe=backFill&anxr=1375836688 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: sessionData="KUDvVVAQLxDyVTTFzN4rcCwpMhvhfvV8Mqp6752LwC2X/zsVqvYOPkJYtkbuWdd3xuQWljAedxSdh SiFsGi4L0xKKYtjSSNfJw50jjYZQL5J8v4vQNQAIBJnfgkI3VAF7rdxM5BN2XUK05w6xLTztd//C4QT0cjief49K3MHMoS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=062329B0-5521-4737-A396-00ACFB474D4F; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partn
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:50 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /activity;src=3335366;type=retar633;cat=conve083;ord=1;num=2241504676063.0083? HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ad.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: test_cookie=CheckForPermission


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:07:28 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: id=22e0e4c8db01002a||t=1402654048|et=730|cs=002213fd48ba7a17fbbb3b1111; expires=Sun, 12-Jun-2016 10:07:28 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:07:28 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: id=22e0e4c8db01002a||t
=1402654048|et=730|cs=002213fd48ba7a17fbbb3b1111; expires=Sun, 12-Jun-
2016 10:07:28 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_c
ookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Ju
l 2008 23:59:00 GMT..X-Content-Type-Options: nosniff..Server: cafe..Co
ntent-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol:
 80:quic..GIF89a.............!.......,...........D.;..
<<< skipped >>>


GET /serve/fb/ver?uatFilter=false&fb_key=cat=&name=success&sid=4242&crv=client_revenue&oid=order_id&xr=8249407062487986062&referer=http://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^yyyyyy^yya^ua&coid=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=http://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=client_revenue&oid=order_id /serve/fb/pdc  http://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^yyyyyy^yya^ua&coid=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=&cat=&sid=4242&name=success&uid=1402654047722:3982831531801780&crv=0.0&oid=ORDER_ID HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://pixel.fetchback.com/serve/fb/blank
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pixel.fetchback.com
DNT: 1
Connection: Keep-Alive
Cookie: fbid=hlA1LoyqkQpmabCWFbORtV; uid=2_1402654047_1402654047722-3982831531801780; kwd=2_1402654047; uat=2_1402654047; bpd=2_1402654047; cmp=2_1402654047; clk=2_1402654047; afl=2_1402654047; sit=2_1402654047_4242-0-0; cre=2_1402654047; scg=2_1402654047; apd=2_1402654047; eng=2_1402654047; ppd=2_1402654047; act=2_1402654047


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:28 GMT
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Fri, 13 Jun 2014 10:07:28 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: image/gif
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close
Transfer-Encoding: chunked
36............r.t..Ldd`dh``...?....O.F ..."@2.LL............a........ 
.....0..



GET /images/vicinio/dsp-images/202980021/background1/1360876073072.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 14 Feb 2013 21:07:39 GMT
ETag: "a37109-e38-4d5b5a61ad996"
Accept-Ranges: bytes
Content-Length: 3640
Cache-Control: max-age=275061237
Expires: Sun, 12 Feb 2023 21:07:39 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:21 GMT
Connection: keep-alive
.PNG........IHDR.......l.......B.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:804397DF42A711E0BE0C9169
A179D3CF" xmpMM:DocumentID="xmp.did:804397E042A711E0BE0C9169A179D3CF"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:804397DD42A711E0BE
0C9169A179D3CF" stRef:documentID="xmp.did:804397DE42A711E0BE0C9169A179
D3CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...Z....PLTE...........................v..]
u....w.....`x.......|..i..d{.f}.l..q.....u..[t~bz.~..[s}k..o..z.....o.
.Zs}|..Yr{e|.......Voz...`w.z..^v.p..s..n..Zs|p..{..~..}..[s~_w.i..l..
Wpz...|..ay.Voyx..Xq|t..g~.t..Yr|z..z.....e{.by.r.....bz.x..Wq{w..h~.{
..}..s..g}.Xq{[t}^v.e|.m.....y..j..j.....Wp{Vpz{..q..j..|..g~.{..}..ay
....t..q..~.._v.v..t...........]u.x..Uoy...w...........f|.r..y..ax.j..
_w.`x.>.......IDATx.b(.`..c.wd..dpqap.g`ee..F .2..S....DfC0#.rF..b.
.Fd).,B=3..RF$......W...f.-.0...1`...@....<....b.`.a.g.d.f.g`G..F8.
.#.@<&,na....0aq-#...o.l..2.D.#.,.^F....l.;.. .D......b8.....'q
<<< skipped >>>

GET /images/installer/enable/content_area.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 09 Mar 2011 21:43:25 GMT
ETag: "659ed3-8ef4-49e139e5a3924"
Accept-Ranges: bytes
Content-Length: 36596
Cache-Control: max-age=219248545
Expires: Sat, 06 Mar 2021 21:43:25 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:22 GMT
Connection: keep-alive
.PNG........IHDR...w.........i.b.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:F14F3CC342B911E0BE0C9169
A179D3CF" xmpMM:DocumentID="xmp.did:F14F3CC442B911E0BE0C9169A179D3CF"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AA12BBE642A911E0BE
0C9169A179D3CF" stRef:documentID="xmp.did:F14F3CC242B911E0BE0C9169A179
D3CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.^k....hIDATx...m.m.u.7.\..s.........I.....
.F.r.P...*o%.H.P.Hq.&...T...(.:$T5H%..B.R......'...j..&......**j...}.=
g.5G...2.....s...:........Z.m....w.x..,".....]....M...q N.......?.[qyn
p.....&.N..sz........pK..7.........sz|....0"w.... u.nz|tz<.....#...
[email protected]..:=..[q..4=....C...;.........?.mx&|rz|......O..[....@....
...........;....b.<....-.....;...ou.m..s.G...q..."w.........K..5.g.
..S_..._..O....d..C.Z|.........9.6}.3...S...c.}...9...'sL.L..n.A.=.{.=
.P.... o...=7../.)..?:=~....;.....~vz|....>....'.._.>3.......lfz
-Z..OZ.G.....=.>....s.... ~f.i...k..i.U..Y].....=N.s$z......<
<<< skipped >>>

GET /images/toolbar/btn2/test_03_icon_edit.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 01 Feb 2010 15:41:36 GMT
ETag: "6d25d9-37c-47e8bd205ec00"
Accept-Ranges: bytes
Content-Length: 892
Cache-Control: max-age=198287322
Expires: Thu, 30 Jan 2020 15:41:36 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:26 GMT
Connection: keep-alive
BM|.......z...(... ...........................Q...Q...................
......................q.............uqn..............}C..........^....
......................................................................
......................................................................
......................................................................
............|||.qqq.XXX........OOO.......K....................OHHLO...
.. .0............. %...OH?:CLO... 7N ............ &. ..O</I?HLOK 33
 J........... ))  ...OF6EL?L 33 K........... )) ......O.8@?L=7 .......
.......& ........OH>COB,...............$..........OOOMMD...........
...........H;----3M8M......H!....).........5/33333-M.M.....'#)))))".%.
.....52K.73,G.M M....'...&)$... .........K1-K..M,MM.......1"....$.....
....3-....M8AM......)"......(......-/9....M*M.......#......*......4-9.
.....M......4"................K...............................


GET /images/vicinio/100000487/SearchButton_65x24_02_1327418199715.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 24 Jan 2012 15:16:39 GMT
ETag: "599593-1896-4b747a24330ae"
Accept-Ranges: bytes
Content-Length: 6294
Cache-Control: max-age=246851074
Expires: Fri, 21 Jan 2022 15:16:39 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:26 GMT
Connection: keep-alive
BM........6...(...A......... .....`.............................M..y..
.p...p...p...q...q...q...p...q...q...p...q...q...q...q...q...q...q...p
...q...p...p...q...q...p...q...p...p...q...p...q...q...q...q...p...q..
.q...p...q...q...q...q...q...q...p...p...q...q...p...p...p...q...q...q
...q...q...q...q...r....$....-.............x...~......................
......................................................................
......................................................................
......................................................................
...y...u.....'...o.x..................................................
......................................................................
......................................................................
.........................................................y....(...9..|
......................................................................
......................................................................
......................................................................
.........................................u....1..~....................
......................................................................
......................................................................
......................................................................
.....................p....1..~........................................
......................................................................
..................................................................
<<< skipped >>>

GET /images/vicinio/100000486/AskToolbarIcon_1354224599535.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 29 Nov 2012 21:29:59 GMT
ETag: "8776e5-578-4cfa8fc339795"
Accept-Ranges: bytes
Content-Length: 1400
Cache-Control: max-age=274422220
Expires: Sun, 27 Nov 2022 21:29:59 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:26 GMT
Connection: keep-alive
BMx...........(...0...............b...........x...x...:9..:9..JG..IG..
JG..YU..ZV..ie..xs..yt................................................
....................Y.................................................
.!..z...z...z.... ...!..."..."..nu..nt..ou..{...05..15..VZ..VZ..W[..ch
..ns..ns..rw..sw..*,..*-..*,[email protected][..[\..............
......................................................................
......................................................................
............vvv.uuu.sss.rrr.hhh.ggg.............S]kttuutmbZ...........
...)B##$$#48&............^uuutuuuuttur`..........<%%%#$$%%##%,9....
.....cuuuutuuututtuts].......F%%%%#$%$#$##$# *......^tuPXptuttutuuuuuu
j.....<#%..-#$##$#$$$$$$C.....sutUJatiJ\[[ittuttum....'$#.J.#.J....
##$##$4...VtuuoJM[[JYJKJYJ\o[ltn.."#$%>J...J.JGJ.J.?.A#3..VuuuuUJJJ
JioiJPJPUJdut_.!%$%$.JJJJ.?.J.J..J.%#1.VuuuuoJR\JiqNJYMLLLttutS"$%%$?J
..J...J.....##%#..tututOJaJi[JNpPJJQuuuu\.#$#$#.J.J..J.-.JJ.%%$$2.huuu
uiJPJu[Jdk[JLLotutk.D$%%$.J.J$.J...JHH=#%#B.TutuutPJJulLJPdJUJRuutk..%
#%%#.JJ%.IJ..J.J.$$#B..^uuuuiJJuuqiooJRaPottk..;%$%%.JJ$$..??J...?##B.
..euutuPNuuutuuJMuuuutg...E$$#%..$$%#$%J.$$$$#6....gutuiPuuuutuPJttuuu
W....6%#%..%%%$#%.J##%%$......\sutdtuuuttYJiuuuf......( %#.#%%$##.J.%$
%7.......SguuttuutukUlutg.........5$%##%%#$..A$#5..........S_muuuuuuuu
kW............/@$$$%%$$%B................X````X.................. :0:0
 ............
<<< skipped >>>

GET /images/vicinio/207743773/Logo1_1335461569136.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 26 Apr 2012 17:32:49 GMT
ETag: "58a5b9-dc8-4be986070893b"
Accept-Ranges: bytes
Content-Length: 3528
Cache-Control: max-age=249693950
Expires: Sun, 24 Apr 2022 17:32:49 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:26 GMT
Connection: keep-alive
BM........6...(.......................................................
........................#...%...&...) ..*!.. "../'..4-..>[email protected].
.QL..]Y..c_..........(...,"...$..-#..1'..3(..4)..3)..5*..6 ..7,..9-..:
...>[email protected]?..D;..WO..vn..lf..up..|w...~..............ke..........
................................................`]`.yvy.989.CBC..~..sr
s.rqr.hgh.ede.ZYZ.........................................dbc.XVW.kij.
................322.qoo.POO.NMM.yxx.hgg.`__...........................
..uA*...t..................U...R...['..uX..........X...Z...] ..\ ..a).
.j8..i=..wM...e...r...{..........`!..d"..i,...Y..........h$..l%..j%..v
;..........o&..v(..r'..x)..x*...:...H...a......|*..} ..{*...X...i.....
.e"...-...........9...D...............................................
2.....................................................................
..............................4...>...r............................
...........w..............k.... .........................00......WWZ.q
qt.pps.................................}}}.uuu.ppp.bbb.TTT.---.))).&&&
.!!!..................................................................
......................................................................
......................................................................
......................................................................
........M................................................T.K...N......
...F.S.......S.....................N.........N..F..U......M.!.:..... !
!!!!.0...! <...............................i>>i.........[
<<< skipped >>>

GET /images/nocache/vicinio/207743773/com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-20131210101753/images/DocToPDF.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 10 Dec 2013 15:17:53 GMT
ETag: "1433d3e-428-4ed2f9dcd2e28"
Accept-Ranges: bytes
Content-Length: 1064
Cache-Control: max-age=300921053
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:26 GMT
Connection: keep-alive
BM(.......6...(.......................................................
.....................................................0..&..jD...xn.(..
0.....ki............................?..-..7..........=..RA.H3.(..(....
......................oE. ..F..F..!.K7.F8..7..".TA.@,....>8........
..............E..<..S .S .$..9.....$.E2.Q>.Q>.7#.............
............&...c.b=.b=.2..b=.'.<).D1.G5.SA.L9.....................
.p..)...e.oM.oM.oM.).8&.=*.C0.C0.L9.........................E..I...e.z
[.z[. .7#.6$.:(.=*.>*..................a\..F..Q)..c..e..e..e.-.4..6
!.6#.7%.9'.................. .....................E....2..5 .2..H:....
...........DA.`W.cU.......!..#..%..'..(..-..-..8#.WM...............8-.
..................!..$..&.. ..&..[O.C6............H7.7(....MK.........
..........%.. ..8%.g`..................WN.&..{u....B7..........<"..
.....ne.=0.tm.....................1,.<0....|x. ...........D=.pg.!..
................................RH....gc..........L>...............
.....................lh....rh.YM..w...................................
.............WQ..............................


GET /images/nocache/vicinio/207743773/com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-20131210101753.1386688673767.cab HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 10 Dec 2013 15:17:54 GMT
ETag: "dd4478-7bc86-4ed2f9ddffe3a"
Accept-Ranges: bytes
Content-Length: 507014
Cache-Control: max-age=300921053
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/vnd.ms-cab-compressed
Date: Fri, 13 Jun 2014 10:07:26 GMT
Connection: keep-alive
MSCF............D.....................................................
.........C;R .com.mindspark.pdfconverter.pdf.chromeReview-en-1.2.0-201
31210101753.1386688673767.zip.W..%z...CK..S.0<....m..m..m..o..m..m.
..g....9;.T.RI..S.YKA..........%..............M......./.._.Q.M?..%.K.u
[email protected]@.,.....f..s...T..R...X..1.\...}.D.....t.%.q..O...L9:.{.. 
C..x.~)~.D..(...1.H...s..~..n/lPe..e.....?|..N.~V]n.._.1../'/.u...ZyA.
....a...L..q......Qi...}...T.....m.7.|&..W..N~\....x..g..\..Z.".....h.
8.!.R.TEQ(...(iE...(S..!R1...c.........r.4_....*..1...?t/...5Es.:...7.
......xa.$.W.....a.TY...n.z..=...j"].z.E.p~...(D".V.......k...l..r...T
@......fj..h....''.7...`......$U.G..:X.....?.. m...Km.............|.J%
'X..4.1.y2.r...5Rj..I(M.f..ceK.,L.....LTl.........l..Xm...Z/...l....bl
..z ......~.K`......%g].jG.[.F...1..L..?.4!......N..MI..v!d.`.,...>
[email protected]. . .D...u.Pl......G...X..f.h$FT.ZQ.....G...v$v.l.d.3.JC.......\
.j#(..T.B.% %kBQ.W...A.w..J.a..Q3......#).Z"o...U.M.T.c.Xt.....nvc.uf.
..L....7-f...#..../sr'k.k7.5m.p.H.....3.r.E&,$<.L..0.dX...C.(S....q
..B..e...5..2..0.z........z..... ....^....S.@=..............`Z?t...O=Z
k.;.....k..pM[...5$...........7....U.[.....b..N(......c^......[..u.5*.
 ..Vv.]b...Z..9.;.f.......u:q^...._$.:.~.{.T.:|..&n..WQF.}..9......S.&
gt;[email protected]}=_.WgV.'Z....ge.x.kd.:.]%|C.........Xn.........Y.Q...M
.x.i.D0%}.z..z..MJ....2.6S..5.Wq.;.i.3.n........_....8.]....]_8..TW...
[email protected]....[.;......j...-....W.....)9...."K.P..`..`'
?>lw......B....c x.....;..qH.1b..........?'G."..6...........h,~
<<< skipped >>>

GET /images/nocache/vicinio/207743773/com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149/images/PDFToDOC.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 10 Dec 2013 15:11:49 GMT
ETag: "13e5c9b-428-4ed2f881fc1f2"
Accept-Ranges: bytes
Content-Length: 1064
Cache-Control: max-age=300920680
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:27 GMT
Connection: keep-alive
BM(.......6...(.......................................................
..........................................................D\........y,
..,.d0..r...........................(..............j...*..#..&.|..f>
;.......................F^.............ybN..)."......#..(.t..kO.......
..............*....  .  .....$.........$..$..$.. .j,..................
.....cc.==.==....==......"..$..$..#..&....................~}....ee.MM.
MM.MM.....z..~!..#..$..%.....................k4.)....ee.[[.[[.....u..w
..{...!.."...................p.).)).cc.ee.ee.ee.....p..s..u..x..| ....
..............l....................(..o..n..q..o...(................Z.
.B..?.`..g .f..d..d..h..n..q..m..s...6...............w5..S._..b .g#.h"
.g..e..d..d..j..l...0..5.............U.v5..Z.~8.`!.\..e".g#.h".`..e.._
..q"..;.g*................g.n/..N..S.y5.Y..a..^..|A.[..b...:.|3.......
.................yI.z8..S..L.r .M.........G..A.o9.....................
[email protected].....................................|
.i*..f..i....................................................]........
.....................


GET /images/nocache/vicinio/207743773/com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149.1386688310219.cab HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 10 Dec 2013 15:11:51 GMT
ETag: "12f79d5-7b352-4ed2f88357448"
Accept-Ranges: bytes
Content-Length: 504658
Cache-Control: max-age=300920681
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/vnd.ms-cab-compressed
Date: Fri, 13 Jun 2014 10:07:27 GMT
Connection: keep-alive
MSCF....Z.......D...........................Z.........................
.........CzQ .com.mindspark.pdfconverter.doc-en-1.2.0-20131210101149.1
386688310219.zip....h....CK..S.0<....m..m..m..m..m.|........93;.T.R
I..S.YKA..........%..............M....6../.._.q....*%.K.Ma [email protected]@
.......V..K.=.T..r..A......|..D..,_l...^..9f....k..P/A.7/\...P.7...,./
...4.%AGOa9y..E....DU.S.z_.$........~.W..Wc......I.,..fa..npt444..!...
fq...0..,...2.................r...m.......r;.o.....B...Y...R..je......
.B.TF=g.#.x:..D..2...8.<.QV..dj<.T..5\.b..A>.>.e. ..r5..e_
...\...D.S..<..]/g..S.....t..Q{.)....P.F.......q.D...Q...f9.>Q..
.. .p*...S.'.R...."..~...t.......ON..)......... ...LeVt....t.[I*.....N
.!.E`U..0.l.D#E.$~..K..d..g.............b.[.............,....-..Pu^.F.
..h.t.lS.z.M$.......B.c.5.........v.Q.....p.../.t......d...Z..D....@NK
...3.9R..R..I.......b.&.&....t.....3u#..ze...d.....G.u.........-..l...
hhm....d....D^I.....ql-.t.........j"..OX7gr..j.E.l.:..l.U.b..z...K....
J.h.u...>.QK#.|..Z.?.........M ..6.}...1....<r..K..x..^.o.V....9
.4..e....P.l.D6|.................mG.N#Q....#.2....tP.E.ca.v<u..g...
...y....x.k.dl..X.c..E...COHj.:..Q.......]...A...R..<.U......d..QM.
G.?9H.m..........[X.t....<.c..!..Yq.}.......`~.zy...[.G......VI7...
2....... qZ3.%.6.m.I....Wka.e........D.W"p..d...&r.s.5.7..\..3{,z;V:5|
,I.D.9.YW..3;V...5.......~.{....]..`m&n.[... n<...p..W.x.a.c^=}...H
t...a...jj.;YC.b..p.ip...O"g...3x....B..".............W......(~. .....
#.q...T.e...*.v..#v.I...Y(.......G...N}...G...&~..I.h.....r.!b....
<<< skipped >>>

GET /images/nocache/vicinio/207743773/com.mindspark.translate.unbranded-en-1.1.1-20131004150724/images/logo-unbranded.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 04 Oct 2013 19:07:24 GMT
ETag: "981c96-426-4e7ef033e7628"
Accept-Ranges: bytes
Content-Length: 1062
Cache-Control: max-age=294312195
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:28 GMT
Connection: keep-alive
BM&.......6...(.......................................................
..........................................................nf.OK.......
............................................[U...."%..................
........................98..#.............zr..........................
....75......................)/.dc........................[W.......@C.'
-..........49.qq.................................lm.......^[....IJ.yy.
............fe`.................RS....................................
.[[[..............fh.............rp......................^^^..........
.88.TU.....................................ccc........................
...........yyusss............mmm.................oo.............qqpuuu
............ppp|||.............................uuu~~~............|||..
......................................................................
......................................................................
......................................................................
......................................................................
................


GET /images/nocache/vicinio/207743773/com.mindspark.translate.unbranded-en-1.1.1-20131004150724.1380913644838.cab HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 04 Oct 2013 19:07:25 GMT
ETag: "10a83f0-917a-4e7ef03526f18"
Accept-Ranges: bytes
Content-Length: 37242
Cache-Control: max-age=293973212
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/vnd.ms-cab-compressed
Date: Fri, 13 Jun 2014 10:07:28 GMT
Connection: keep-alive
MSCF.....w......D............................w.......................{
........DC.x .com.mindspark.translate.unbranded-en-1.1.1-2013100415072
4.1380913644838.zip.1....v.{CK....0..>..m{....m..m.c..m..m....F.=..
[email protected]^........O140.2s.s.5.5w..........{K......"
.....A=o|[email protected]<........Zc.J.Y<....S.E.%......f7.aR.!...h}J..bv.L
........Q...L.....I...0H_g0.....)[email protected]....~Z.".V.
Ce.4.mmC..t..."...S..icP.....-.D$H.[..h(.?.1 ..............2KHZ....X..
EWk..B.....#..,/..Q..o|.O/....._...?.......N..........V....C.......^F.
._y.M........R..8....\.1."..l...<..Y..(.C..%..D.=.....>.,<...
=...()O....y.)j.'.....sV...q.... .F..6..pd.. ..3(..........D..w./..w..
..1..0.(..L...0..bM.._..E..B.os....z n.s.#.`.Y.....>..b..@.........
s3...G}...k#.CDt...]P.OT..KP6......i[>...`...w ...0.<J^.....9e..
@..../.3...w ...*.......6:...Q....Pn..E.\.b.Y.-....rt.Hu.k.....u.....U
....x.....h6..U......P..k..J0.....x/%...P.._...5F'7..jSi.......e`.>
..l.`.!.P.....<wc..g.n.....NP  6...kpN.nOI.,tZ.M...K...l%...G....T.
 aD............[U` ...G....d.Q..E........T\.a...5.O..X.{L.....4E...A?#
miD.g.>.W.R..@[email protected]....}....-V.zRn..1P.D.Q..{...8I....PK-TR2T......
.:..P..P0....z.u~.A.|..U4`....PM...W...*Ox...,.`...>V}.c!.r<..[X
......M3..B....-..R.....9./gy.J.c....Z.h....k,l.g......r6.M\.K|).....X
[email protected]&f.Q....@......]...HA...O....<.~$...M..P..&....y..'
H.G.fRw.,.,JP*.3..v#...v....`v..t..yKv....J....a1R..S.{.Y.I.<h....|
...~5..~...#W.[..f....^w........uc*...W...Q&p.1..AkGX....`...^....
<<< skipped >>>

GET /images/vicinio/207743773/100025132_1284560970104_1354049568688.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 27 Nov 2012 20:52:48 GMT
ETag: "aa057-638-4cf803b8cd521"
Accept-Ranges: bytes
Content-Length: 1592
Cache-Control: max-age=266926004
Expires: Fri, 25 Nov 2022 20:52:48 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:28 GMT
Connection: keep-alive
BM8.......6...(... ...............................................f...
3...................f...3...................f...3........f...f...f..ff
..3f...f...3...3...3..f3..33...3..............f...3...................
f...3...................f...3...................f...3........f...f...f
..ff..3f...f...3...3...3..f3..33...3..............f...3...............
....f...3...................f...3...................f...3........f...f
...f..ff..3f...f...3...3...3..f3..33...3..............f...3.........f.
..f...f.f.f.3.f...f...f...f...f.f.f.3.f...f...f...f...f.f.f.3.f...f..f
f..ff..ff.fff.3ff..ff..3f..3f..3f.f3f.33f..3f...f...f...f.f.f.3.f...f.
..3...3...3.f.3.3.3...3...3...3...3.f.3.3.3...3...3...3...3.f.3.3.3...
3..f3..f3..f3.ff3.3f3..f3..33..33..33.f33.333..33...3...3...3.f.3.3.3.
..3.............f...3...................f...3...................f...3.
.......f...f...f..ff..3f...f...3...3...3..f3..33...3..............f...
3.......>...>.......H...S...........................I...R...S...
............?...c...d...d...S...........d.............................
......................................  . ............................
..................................... ................................
.............................. .......................................
......................................................... ............
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /images/vicinio/207743773/100025130_1284560908837_1354049527576.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 27 Nov 2012 20:52:07 GMT
ETag: "aa052-638-4cf803919d5e0"
Accept-Ranges: bytes
Content-Length: 1592
Cache-Control: max-age=267432467
Expires: Fri, 25 Nov 2022 20:52:07 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:28 GMT
Connection: keep-alive
BM8.......6...(... ...............................................f...
3...................f...3...................f...3........f...f...f..ff
..3f...f...3...3...3..f3..33...3..............f...3...................
f...3...................f...3...................f...3........f...f...f
..ff..3f...f...3...3...3..f3..33...3..............f...3...............
....f...3...................f...3...................f...3........f...f
...f..ff..3f...f...3...3...3..f3..33...3..............f...3.........f.
..f...f.f.f.3.f...f...f...f...f.f.f.3.f...f...f...f...f.f.f.3.f...f..f
f..ff..ff.fff.3ff..ff..3f..3f..3f.f3f.33f..3f...f...f...f.f.f.3.f...f.
..3...3...3.f.3.3.3...3...3...3...3.f.3.3.3...3...3...3...3.f.3.3.3...
3..f3..f3..f3.ff3.3f3..f3..33..33..33.f33.333..33...3...3...3.f.3.3.3.
..3.............f...3...................f...3...................f...3.
.......f...f...f..ff..3f...f...3...3...3..f3..33...3..............f...
3.......RRR.......(..~(......~................G...|...}..~'...Q...c...
......................................................................
........~~~.}}}.^^^.]]].SSS...........................................
......................................................................
......................................................................
................................................. ....................
............ ................................... .....................
......................................................................
..................................................................
<<< skipped >>>

GET /images/vicinio/207743773/100025126_1284560681838_1354049612079.bmp HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ak.imgfarm.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 27 Nov 2012 20:53:32 GMT
ETag: "aa05c-638-4cf803e22d4bc"
Accept-Ranges: bytes
Content-Length: 1592
Cache-Control: max-age=267109176
Expires: Fri, 25 Nov 2022 20:53:32 GMT
Content-Type: image/bmp
Date: Fri, 13 Jun 2014 10:07:28 GMT
Connection: keep-alive
BM8.......6...(... ...............................................f...
3...................f...3...................f...3........f...f...f..ff
..3f...f...3...3...3..f3..33...3..............f...3...................
f...3...................f...3...................f...3........f...f...f
..ff..3f...f...3...3...3..f3..33...3..............f...3...............
....f...3...................f...3...................f...3........f...f
...f..ff..3f...f...3...3...3..f3..33...3..............f...3.........f.
..f...f.f.f.3.f...f...f...f...f.f.f.3.f...f...f...f...f.f.f.3.f...f..f
f..ff..ff.fff.3ff..ff..3f..3f..3f.f3f.33f..3f...f...f...f.f.f.3.f...f.
..3...3...3.f.3.3.3...3...3...3...3.f.3.3.3...3...3...3...3.f.3.3.3...
3..f3..f3..f3.ff3.3f3..f3..33..33..33.f33.333..33...3...3...3.f.3.3.3.
..3.............f...3...................f...3...................f...3.
.......f...f...f..ff..3f...f...3...3...3..f3..33...3..............f...
3.................u...t...t.ggg.```.RRR.QQQ.PPP.................m.....
..\...\[email protected].............................................
............yyy.xxx.aaa.SSS.......V...................................
......................................................................
..................V...................................................
................V.....................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654026458&anxsq=9&optIn=true&searchAssistantOptionFF=true&searchAssistantOptInFF=true&homePageOptionFF=true&homePageOptInFF=true&anxe=InstallerSecondaryAccepted&anxr=679204151 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654026464&nv=10&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=%
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:10 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



POST / HTTP/1.1
Host: gtssl-ocsp.geotrust.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 102
Content-Type: application/ocsp-request
Connection: keep-alive

0d0b0@0>0<0... ........?.~..`D..AatN.l...)...ByT.a.U >c.<HW...E.J.......0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Last-Modified: Wed, 11 Jun 2014 19:10:28 GMT
Expires: Wed, 18 Jun 2014 19:10:28 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1364
Cache-Control: max-age=464603, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:29 GMT
Connection: keep-alive
0..P......I0..E.. .....0.....60..20........,0*1(0&..U....GeoTrust SSL 
TGV OCSP Responder..20140611191028Z0f0d0<0... ........?.~..`D..AatN
.l...)...ByT.a.U >c.<HW...E.J.........20140611191028Z....2014061
8191028Z0...*.H...............Z.....}......u.....i...Y...7S.,W..;.....
.....2..Sh.........'.z..9..y..r.....l.F..NO}.BQN...l.b[.%..T<O1l..'
.O.......[.....H..d..A.JRm.....O. f3.......-0.... "...C..mJ....@2A....
o....J.I.l.t2.y..g1NT.?2..a..vj#..g.;y.}..N...>..t......._x.s....'.
91.......]...k0..g0..c0..K..........0...*[email protected].
..U....GeoTrust, Inc.1.0...U....GeoTrust SSL CA0...140502165328Z..1505
22165328Z0*1(0&..U....GeoTrust SSL TGV OCSP Responder0.."0...*.H......
.......0...........S.O.].&...4.......PU.HE..L....P.AH(l...o.V...b*....
c.r.5^...'.79.e<N]^n......<p....\H..0.#[".....B.A....K%?"...Q...
z.\X.~.b....X{.R..d.e..3.p.1...]!xX?.N.X.O...`v!39..V..VK9U....|.fV.7v
.....F.3..^.E'....C..M..4Ur......B ...>..d... ...w.....p..9$....y{.
.......|0z0...U.#..0...ByT.a.U >c.<HW...E.J0... .....0......0...
U.%..0... .......0...U...........0!..U....0...0.1.0...U....TGV-B-1210.
..*.H.............]E...n...a..b.M.(B....S......H~...h.2....{pK..#...0.
........A...L).....).f|d:[email protected];r....B.$..1.LH...`....S.<.y..$..N./!
.....e?z2T.'.....0..h.,b.D..... ....d.G..*[R`2J...g....6.!.........#..
.....T.LF:q,...2..S.9....5..u!.y.RP..;H`.....S..}.F..$3Se...N.....5..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEG5P+rPF5mnE0WfJkqvoWMQ= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 20:55:51 GMT
Expires: Thu, 19 Jun 2014 20:55:51 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1685
Cache-Control: max-age=557534, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
0..........0..... .....0.....w0..s0...........0..1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Sym
antec Class 3 PCA - G2 OCSP Responder Certificate 2..20140612205551Z0s
0q0I0... .........z`.V.<N.v...TM)(.r...L_.6....a"I9....J.8...nO....
i..g....X.....20140612205551Z....20140619205551Z0...*.H.............~|
.l..SI.p.|q....[......./S....`......../.2.$f...5.i......Gw..=..s.G.M..
.a/<.....bu...}.FPi....*l.......!.z.\.$.ut..&,K.p......@?......B..3
5.*/...6M*,~........>..D.=....I>...O.#6Y.S...#..f.....QQ.Ny|.../
2t{...&B`.s}N..R..q...:y....K....~.h*..{*w..X'.....e....80..40..00....
.......N...[d..?'.g...0...*.H........0..1.0...U....US1.0...U....VeriSi
gn, Inc.1<0:..U...3Class 3 Public Primary Certification Authority -
 G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U
....VeriSign Trust Network0...131112000000Z..141212235959Z0..1.0...U..
..US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?
0=..U...6Symantec Class 3 PCA - G2 OCSP Responder Certificate 20.."0..
.*.H.............0..........DA.....\"...L_F............u..8..SE...e...
o.Q.....'...7....`..ig.s...nI....6..$-.^.'..I.I...a.S...T.Y..;. ..D.CY
.O.*...}..Q...l..q..j..?q'.g.ng."F......9.Q..".8J}.....>..$.a...%.k
.=."1<...).n.....ks.z.J....P^..G...c....v......V.P....S..].R.u.~.u.
.?....P3........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .......
..hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa
0...U.%..0... .......0...U........0... .....0......0$..U....0...0.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsK8Var42Wv2Ct+B0CPyO0igBZwgQUpe8LEc7AQQOjSmWQSLIc4FctfUcCEB+8ikybeTktioIu7LY7T/Q= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 00:41:52 GMT
Expires: Thu, 19 Jun 2014 00:41:52 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1852
Cache-Control: max-age=484719, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
0..8......10..-.. .....0......0...0...........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1>0<..U...5Ver
iSign Class 3 Secure Server CA - G2 OCSP Responder..20140612004152Z0s0
q0I0... ........l .Z....`....?#...Y.........A..Je.H...W-}G.....L.y9-..
...;O.....20140612004152Z....20140619004152Z0...*.H................,[p
..U.:.....*.p..V....~........Q.....B..pR.[....3..V.D...a..Y.3.s..E.`..
..*[email protected]...'......t*#.N.w....r.lV.%p.B.L.[...
..u.pjA._.....x..Y[.....s..mx.P.u........bg.>NgT.......|0.uF.X..(.o
.Ap~....">...^S....ER`.S......:...Ah*...R......0...0...0..........?
.Q..R^O._D.h*0.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc
.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://w
ww.verisign.com/rpa (c)091/0-..U...&VeriSign Class 3 Secure Server CA 
- G20...140504000000Z..140802235959Z0..1.0...U....US1.0...U....VeriSig
n, Inc.1.0...U....VeriSign Trust Network1>0<..U...5VeriSign Clas
s 3 Secure Server CA - G2 OCSP Responder0.."0...*.H.............0.....
.......t..y...J.....@./..3.....PE......&W...y.....N....3.\.y.kB.^.....
....MA.w.\f.F-..(.......4.t.......H;$.SJk.....7,..kH<....]QB..Eb)..
..-.O.._o..b..j......L.....g.....6r..c.G...Q....MQ......'w....l.'.....
>...w.j'fX.Qh.v...N7..Q...Q{.z..bY....>q..cK.I.*.S=..........0..
.0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://www
.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS
 incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .....
<<< skipped >>>


GET /favicon.ico HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654070067&xp=&xrt=&xt=&nv=1&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe4.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:50 GMT
Server: Apache
Accept-Ranges: bytes
ETag: W/"894-1401391120000"
Last-Modified: Thu, 29 May 2014 19:18:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 241
Connection: close
Content-Type: image/x-icon
..........c``.B... )..... ......@!....8..sC0........DX........~.......
([email protected][email protected]...... ..b.....|[email protected].[..0. ..:
.b2.z.-@)..H8...T..._....."...&'.........l.........z..,........10.930.
[email protected]?..7O...4.~.....



GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654053953&anxsq=8&anxe=SplashLandingClicked&anxr=212412536 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC/W3P6BiN7UNQvxSEYvjBPqbPBnTRQi9Cz8bAxA7zAjFQjWLYKchJ1IK6SXNaAbo4SDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ8bb WIQacDwE6edhzm0Y0yENn8mzq2e1pgzNIqzb9unQClScKoNppnC8bgT1iDTd/MhDr09QEfWObUIULksUVEWNjncEhtooMaPVCsVISOMZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654077906&nv=9&t=-&v=-&p=-&si=-&sn=dfprdsndlfe12.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:08:00 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID HTTP/1.1
Host: pixel.fetchback.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:08:04 GMT
Set-Cookie: fbid=4kZRj2AIpsCP4lfVOnSLkI; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:04 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Fri, 13 Jun 2014 10:08:04 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close
Transfer-Encoding: chunked
8ed.............X.S.8.......g.c..6.Rp.dx.-w........-.qp....8....^..B.~
..7...Z..V.}.[ .g.........q......~.X../...}.;P....n..S.f.8...}{{k.nXY.
...{.G..].<..E95.oZ..n......y......=.....;...3BY...j.V.~F..."..1...
1.....=$S..F{J....I.`.....{.\.....0xBxR....O.uC........)...a.>.p1..
..}(\...............y....]..o.....\h.1>..q...{..L2...9/\.jB.._]^..o
;.ue......7..h_.S...X.i..p..4...rI..\;..E..l4N.g`...X.._]....[3......:
...,9t...3|.>L].$....Bn.yr...;7....X6............l.t.p.O....5...Sf.
..'$..S......$...j 0..)ul8..#....E.#/......D.<...h........c...i....
....F,....x.^7# ..$/.!...._.FX.i.LF.i.@..#.....:....;m1..c4..l....L.5.
n..f...X6e...C...3Ks.'yZK.mM...B.^..&..-..././H...X..-..2s ._U.|#v...[
A._.....8. ........A...7..)I..$...>.!XWn.<..P....8.8KY^...)g.l..
.L...d?K..I..X...5../.&.Ua...D..2..2<...A..%'....`.8..R.id.d*.S0 i.
.&..I...S... }.Y..p.)...=....r<..N.j..=......Cs%.d4=>.!..:E...88
\...L{..Cp.....6#.....|.R2..KC)./9g...V.xO%.s....G..X...G........y|.,.
.....C...X.....7.{.=..B.6.Q...w..{.UzZs6.^h.q^..A..f..f.9...[.K#>h.
..!..iy~?...p..Y(.Tg2.......,`DH.:.... ..R....aj..>.<C.3`....$S.
....V.Tx.....~.9....o.wj..m....Y..s......>.(DJ..P:.....T...........
o2..A.......0...HR.i..2.JW&..[._.r.4EY.:....<..V....8.Q....rh...gf.
i?..Z"...j...E.c.R...h. =[l.t. [email protected]@/``.CJ.|...............L.....Z
r)D...9N)....,I.4r.43.g ....'.{/E.?F..B....g.."Q[`...UH....O...J.br...
-:.........qB.&1w..Ce.=..`..)....7M._.^ ......{?}.....^e.).E..[....B.%
S.....g....B.....'.Nu....K.H......dNZ*. ..P(.S%U..P.T....(=/.2..?]
<<< skipped >>>


GET /splashPixels.jhtml HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="1KwlOL99CBUb/cm kLnwq9/feNfFDOkQCthghC9WPd84390vaUA8Lj4jM8zroAlXxuQWljAedxSdh SiFsGi4Ha8OPh5ArtmDARBGpQdFqf5J8v4vQNQAIBJnfgkI3VAjZfjct3YpO4X2eAmWIH0QQTahOyEzICj7kdI Mx1ztsS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654016370&nv=4&t=-&v=-&p=-&si=-&sn=dfprdsndlfe21.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; anxs="s=486774368&sv=1402654016035&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; __CT_Data=gpv=1&apv_177_www06=1; WRUID=0; tbinstalled=false; cookieEnabled=true


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:01 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654021561&nv=5&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:01 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Content-Length: 519
Connection: close
Content-Type: text/html;charset=UTF-8
...........SMo.0......tI.5v.. [email protected]'....m=.0`.....#.YT.
..o..Bm..9E.....K.hK......K..y.....DuM....l./.d...X.....m.c...XG5)G...
y..u`.'X.~[.]..3..D.v..a.w x.QG.K..!`C.&.....q.:D..E..~MfC............
..m.w.V.p..k.'<.h.-0..A... ...U..}.6RvluxN.5.f...>.....G.c.S @{.
Ev..#^..`j.rDh)F'e...'j.;..,....fG...q...ly.]..W.|~.....2..........>
;.........J...J. ......R.I-....,..O.X2.F.O....f.kv..)...mS;2f..R.....|
....pys..Gx.w.Z.s......ux.).r&p...G...\.j.....Q...2d..\..T........-..H
.g.@.(.g......6...dg.}..H.kX..=a.Z......
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654024251&anxsq=6&anxe=InstallerInvoked&anxr=1993629022 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654024281&nv=7&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefa
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:08 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /?act=statistics&i=7e737kewZYa8pDw+Duoh4MEjmLz/noHd3vtbIbDST8nV HTTP/1.1
Host: g.brothersoft.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: BSWS/2.3
Date: Fri, 13 Jun 2014 10:08:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.10
Set-Cookie: ad_out_statistics=5868; expires=Fri, 13-Jun-2014 10:13:04 GMT
Set-Cookie: bs_ad_ck_c=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=g.brothersoft.com
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: BSWS/2.3..Date: 
Fri, 13 Jun 2014 10:08:04 GMT..Content-Type: text/html; charset=UTF-8.
.Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP
/5.3.10..Set-Cookie: ad_out_statistics=5868; expires=Fri, 13-Jun-2014 
10:13:04 GMT..Set-Cookie: bs_ad_ck_c=deleted; expires=Thu, 01-Jan-1970
 00:00:01 GMT; path=/; domain=g.brothersoft.com..Content-Encoding: gzi
p..14........................0..



GET /installComplete.jhtml HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData=v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uxuQWljAedxSdh SiFsGi4P23yvNXpRtTSFfZmYpr4XH5J8v4vQNQAIBJnfgkI3VAHqaPr8h9lCoxE9et3AzVJmWyV4pk3AOByqd9OD6jHdoZtvQs7O1ztS9tljQP93Qn; anxs="s=1366968256&sv=1402654042225&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654045253&nv=17&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=3&apv_177_www06=3; WRUID=0; tbinstalled=false; dlput=YYA


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:26 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uN78x9/KXKSGcZQ3R33thSkapz sdnvyIiXOCvTH0Uc40eyuIMcAU/0D4IoaooC7fxuQWljAedxSdh SiFsGi4EcXSEqqaa6dTvPwkdn9fPoZtvQs7O1ztS9tljQP93Qn"; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654046646&nv=18&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=d14aab68382e45789266ab469fa4607c&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:26 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
2002.............}.w.6....9.? L....eI........I.......9>..Il(R%)?...
.....)J..t.....E`0..f......m...=>zsx..O..,......W'...7....6.G.G..?.
.~....;.. ../.l..<..b.,I..f....q.m...y..y....Y..'F.....s(.J...A<
*.......-...v0.Y<..;..%f..>*...G...*Q............={}|~...:.e.]..
.0Hx...o..b...Y..N.H.>sfv..dtr........-...'v.........|a'..7......K.
N....b..h.N......"t.=.# ..a..(...\~]c....  ............8~...Fz....%@..
..c.........G...kb[.C..}.@s;.z......"fa...L....:d.....D...........5...
.c.y...E.O.0........SZ.B....v{.. KW......(.$../f/.P.jL..N^.I.(..!.!*..
....P..i0..v. .c..5f..<A.p.%2...Yw'e.2.n...x.@{.H&..<..W..!.y...
..7j#Q...Qf...V.......'...3..y]...M..T&^.4{.E... ..=*[email protected]...
).......mSf4.Q..^G.h...C.o..8-x..K.c..J..d..&`..};....".^Z.......Z.l..
._&..$\......%..I..i......g......z...vZF.pd [2.@..(d..}.l..D.u.X .`h..
..s...Q9.iK...][email protected]..?..*Zd..a...|}{.BL..
%.(.......k......j.=WQ...n.T%[....C.....5f..dC..&j.<s...0...k.z...V
.=...0J. ...V..bQ..?....T:..t2..:................q.p.......QaR. iL....
.X.N.;Q.......n C..w?..y..`...h...l_.. .jV..i9{....3.0....(.v.K.....#.
.cc.&...?........8.kIx.8N....0....!.B..........6.jV.'E..5z2..bh.....c.
Q../..J.^.;..R......AK\h{.*.UM...;[email protected]{s...E.....@.${..AR...|.....
R\..p 2^..~!4/...F'.;....V.<..T.........G;^L.gM./../mu5....c..v.Tj.
Z^.....P...M|0.. (.....bqC>.!.f.:.f.....a...x.....2_q..q.6.c.6..`.f
v......R1...e..1Z[.^.`^%..y.;9VL.v.ma.!.$.\....H.M.l...C.._'...}?n..._
H..z.i.@.^.<...d.....:..3...(..&.h....H...t56.... hk......V8..b
<<< skipped >>>


GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAFSh8UnRmbfJXQAAQAAAVI= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Fri, 13 Jun 2014 10:07:56 GMT
Content-Type: application/ocsp-response
Content-Length: 1501
Connection: keep-alive
Set-Cookie: __cfduid=d7d1f02a47dbafaa460c4d9ab2aa88cbc1402654076785; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Mon, 09 Jun 2014 21:34:28 GMT
Expires: Tue, 17 Jun 2014 10:07:55 GMT
ETag: "e2ed7c6503a7d1f38eba1a1cbca523d0bc044743"
Cache-Control: public, max-age=345599
CF-Cache-Status: HIT
CF-RAY: 139d7bebec470c8f-AMS
0..........0..... .....0......0...0.......j.....N ...#c........2014060
9213428Z0..0..0L0... ...........p.....!M.....PH.O....-.lM=.P3...x....$
.......R..'Ff.%t.....R....20140609213428Z....20140613213428Z."0 0... .
....0......20130609213428Z0...*.H.............kdV}7q.8.....w.P;.5.Q.6.
...[.7.&..BT.I.r......M.a..........gz*".B...5%.V..c..%..Y...i:...W{...
2...*..:0....G.K...........U......~MCh......O.jp.g.f..[-/..v#..z... ..
U.....v.q....^j*..g....a....>e...........Lw...j}3w..J...[.9.#/X.7.x
....0,..IkI.5..VZ.W..bX......0...0...0...................6.........0..
.*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0
...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microso
ft IT SSL SHA10...140508220345Z..140707220345Z0!1.0...U....Should be i
gnore by CA0.."0...*.H.............0.........1._G....#.L;!>Q.z.m?e8
.-1\...Scf....0.....E(/F.(..nN...U....3"&M./[email protected];...j.k..\.
d'...s2D...W6.g.9...xk................Q.GZK.1.\-.E.......l.h.]%i4....v
.....J.-. O. ?.*...A3...h.#..."..c....PhV.>..;...Y...._.".t....|c..
....3.l.YUZ."p.r..C.U-[y..........0..0...U.......j.....N ...#c......0.
..U.#..0.....-.lM=.P3...x....$.0...U...........0...U.%..0... .......0.
.. .....7....0.0... .......0... .....0......0...*.H.............oV....
....#...h_.....]1..G...c.....C....z.5.Q.K.A...t.Z.A..d.~...lG..\P.....
. .........(.[`..ww2Vd............=.]%.).0j?...w.]...W.........G-6..&g
t;.3.Kg...J.KGa..9$)[email protected].\.9...j8.8..O<......../,..c./o....Y..`...
`<.i\[email protected]...(Y...
<<< skipped >>>


GET /serve/fb/pdc?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID&xr=8249407062487986062&referer=http://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id= HTTP/1.1
Accept: */*
Referer: hXXp://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: pixel.fetchback.com
DNT: 1
Connection: Keep-Alive
Cookie: fbid=hlA1LoyqkQpmabCWFbORtV


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:27 GMT
Set-Cookie: fbid=hlA1LoyqkQpmabCWFbORtV; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: uid=2_1402654047_1402654047722-3982831531801780; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: kwd=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: uat=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: bpd=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: cmp=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: clk=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: afl=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: sit=2_1402654047_4242-0-0; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: cre=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: scg=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: apd=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: fbid=hlA1LoyqkQpmabCWFbORtV; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: eng=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: ppd=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Set-Cookie: act=2_1402654047; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Fri, 13 Jun 2014 10:07:27 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close
Transfer-Encoding: chunked
234.............T[k.0.~7.?....,.|./k.2h.}.....d.(Q _..$e..........2c.s
>.K..a...|N8kz&7-........(....2....l6d...........P......o>..`...
@T.......T.t)........K..,..Ei...h.9.a@`.5.I.D.p... ..Yk.A;...T......(=
h..()...4J...S.pI...v.R...f.#......k......e..l...ZO...uk.5..{.M;m2[<
;..v..)`8...=..Q..aF.4......u.i..........S.U#.Q./...-...8......._.y...
...?..E.J...V.k.(OF.#.aB.t..$.....E..q.....YN]...>u.I.....y.t..j2..
.G..6...=.....)d.g.. ..Y.....?=.........Q...l....v..z.....8..'x....Fv-
1..n4.W.T....5..q....;}.[.........i.....Rzu.,... K..Z....l....k$...".E
d;.u..k...n..g.........a.......a4.....0..
<<< skipped >>>


GET /serve/fb/ver?uatFilter=false&fb_key=cat=&name=success&sid=4242&crv=client_revenue&oid=order_id&xr=2972455870849468926&referer=http://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^chryyy^yya^ua&coid=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=http://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=client_revenue&oid=order_id /serve/fb/pdc  http://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^y6^chryyy^yya^ua&coid=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=&cat=&sid=4242&name=success&uid=1402654085045:2886897097294093&crv=0.0&oid=ORDER_ID HTTP/1.1
Host: pixel.fetchback.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://pixel.fetchback.com/serve/fb/blank
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: uid=2_1402654085_1402654085045-2886897097294093; kwd=2_1402654085; uat=2_1402654085; bpd=2_1402654085; cmp=2_1402654085; clk=2_1402654085; afl=2_1402654085; sit=2_1402654085_4242-0-0; cre=2_1402654085; scg=2_1402654085; apd=2_1402654085; fbid=4kZRj2AIpsCP4lfVOnSLkI; eng=2_1402654085; ppd=2_1402654085; act=2_1402654085


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:08:05 GMT
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Fri, 13 Jun 2014 10:08:05 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: image/gif
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close
Transfer-Encoding: chunked
36............r.t..Ldd`dh``...?....O.F ..."@2.LL............a........ 
.....0..



GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAFSh8UnRmbfJXQAAQAAAVI= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Fri, 13 Jun 2014 10:07:56 GMT
Content-Type: application/ocsp-response
Content-Length: 1501
Connection: keep-alive
Set-Cookie: __cfduid=d7d1f02a47dbafaa460c4d9ab2aa88cbc1402654076785; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Mon, 09 Jun 2014 21:34:28 GMT
Expires: Tue, 17 Jun 2014 10:07:55 GMT
ETag: "e2ed7c6503a7d1f38eba1a1cbca523d0bc044743"
Cache-Control: public, max-age=345599
CF-Cache-Status: HIT
CF-RAY: 139d7bebe4aa0c8f-AMS
0..........0..... .....0......0...0.......j.....N ...#c........2014060
9213428Z0..0..0L0... ...........p.....!M.....PH.O....-.lM=.P3...x....$
.......R..'Ff.%t.....R....20140609213428Z....20140613213428Z."0 0... .
....0......20130609213428Z0...*.H.............kdV}7q.8.....w.P;.5.Q.6.
...[.7.&..BT.I.r......M.a..........gz*".B...5%.V..c..%..Y...i:...W{...
2...*..:0....G.K...........U......~MCh......O.jp.g.f..[-/..v#..z... ..
U.....v.q....^j*..g....a....>e...........Lw...j}3w..J...[.9.#/X.7.x
....0,..IkI.5..VZ.W..bX......0...0...0...................6.........0..
.*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0
...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microso
ft IT SSL SHA10...140508220345Z..140707220345Z0!1.0...U....Should be i
gnore by CA0.."0...*.H.............0.........1._G....#.L;!>Q.z.m?e8
.-1\...Scf....0.....E(/F.(..nN...U....3"&M./[email protected];...j.k..\.
d'...s2D...W6.g.9...xk................Q.GZK.1.\-.E.......l.h.]%i4....v
.....J.-. O. ?.*...A3...h.#..."..c....PhV.>..;...Y...._.".t....|c..
....3.l.YUZ."p.r..C.U-[y..........0..0...U.......j.....N ...#c......0.
..U.#..0.....-.lM=.P3...x....$.0...U...........0...U.%..0... .......0.
.. .....7....0.0... .......0... .....0......0...*.H.............oV....
....#...h_.....]1..G...c.....C....z.5.Q.K.A...t.Z.A..d.~...lG..\P.....
. .........(.[`..ww2Vd............=.]%.).0j?...w.]...W.........G-6..&g
t;.3.Kg...J.KGa..9$)[email protected].\.9...j8.8..O<......../,..c./o....Y..`...
`<.i\[email protected]...(Y...
<<< skipped >>>


GET /activity;src=3335366;type=retar633;cat=conve083;ord=1;num=6300925726536.661? HTTP/1.1
Host: ad.doubleclick.net
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
X-Client-Data: CNO1yQEIhLbJAQiktskBCKm2yQEIwbbJAQiehsoBCLiIygEI8YjKAQiplMoB
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: test_cookie=CheckForPermission


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:08:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: id=226e6fbfdb0100f1||t=1402654084|et=730|cs=002213fd48755c9f19f765c36a; expires=Sun, 12-Jun-2016 10:08:04 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:08:04 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: id=226e6fbfdb0100f1||t
=1402654084|et=730|cs=002213fd48755c9f19f765c36a; expires=Sun, 12-Jun-
2016 10:08:04 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_c
ookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Ju
l 2008 23:59:00 GMT..X-Content-Type-Options: nosniff..Server: cafe..Co
ntent-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol:
 80:quic..GIF89a.............!.......,...........D.;..
<<< skipped >>>


GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654077906&anxsq=9&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=5864BD4E-284B-4517-9409-6B6363B179CD&paidInstall=true&restartUrl=http://VVV.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=1739394702 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC/W3P6BiN7UNQvxSEYvjBPqbPBnTRQi9Cz8bAxA7zAjFQjWLYKchJ1IK6SXNaAbo4SDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ8bb WIQacDwE6edhzm0Y0yENn8mzq2e1pgzNIqzb9unQClScKoNppnC8bgT1iDTd/MhDr09QEfWObUIULksUVEWNjncEhtooMaPVCsVISOMZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654077909&nv=10&t=-&v=-&p=-&si=-&sn=dfprdsndlfe12.df.jabodo.com&od=none&op=-&ok=
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:08:00 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id= HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: cookieEnabled=true; sessionData="sxZ4ZF5IibvfSKqfgLj09lPDxOA0GrOWgLMfK f0kOsxTSv4AM5ACMGb3V/9n1s5jnQpZXvQCbrkFUXEm2v5PM/kayNqKg bt71TqA61sFBKeNv78faqxk0X4yCoMubCeK3HSeoU0wBv9s30tNheQXLWE 5aLvbKiW PHM0QQqSjDmSmPMMvPPCHTSlEn6QEH2YcZlex/IQ6m1XVSZNlQetZJbxHljw46hrTFxrrdKtSeDuNu9kirXHmJovMbdYR/iujY0c4hxR0K5wIfcZiPZ6BgpwPpwzkvPFHaEGoeZjfYapa4hsA9KFI hpSEy8pXyq5fuWXUZUcgoSXWyZJmwhEXZ0D0HmiDcR1WCq9gseIVj/RsYq7dB5X5jJ3IuzdXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIvCRhivhu5/Q3TzU6hz51TyJSZQJTjpeI8t p6EkYWTzl22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=49F19948-7BCF-4240-BFE9-02783025B89B; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=; successUrl=hXXp://VVV.fromdoctopdf.com/installComplete.jhtml; defaultSearchOption=true; defaultSearch=true; homePageOption=true; h
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:08:04 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="HnhOu9cHX5d /Yo7R3taUn3kGrL2fn5GLOyQnwNey8l XbGM9qyORIykuzJkpUsouiOUsaT0NKKTMuP0DmxWNbNu/bXwQDhmMm JXta6/Ge07fRxAcc9JqUJ/bGz9 uoSfNwU9nVeylRom2Sqsk9uaequ4kvTzEEkCEjuHheHi0mMh24xluz0Wpr/KrgNmMPVghBYl0ne bC1yXqaRgEvfsWWqNrzxip4HY4jKHmq1AQ1OFXk0DeAV0KZKp773EWUjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJepcsgxanQwt8x9SOJjQeZ4xJCfA3bJZophxlPh0NEavIiUcxpKYfjWzqJQuC6scWd9cVPGYsARlXDvDIXIyH7gOdwSfb1kHrAgIsg3NvNTiAWdkPuTnvy7m1OI0VwTBC X9P/1ReGOH6FUt6P3uAVmQ4ELVvCpmYq4b5PI6nqoX/i2rrRqtuxaF BRoJvJRV7KdjpdmyhdQr5godpojZa7wd/JsdWYJxvbj6fi1z0iwbA=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=245A566E-8953-4A13-83EC-4C8ED5D14DF5&fv=1402654068215&lv=1402654084269&nv=13&t=-&v=-&p=-&si=-&sn=dfprdsndlfe16.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=13.0 r0&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^chryyy^YYA^ua&xi=CRXEXE&xtp=vhigh&xs=22641&xp=vicinio&xrt=YYA&xt=intdefaultcrx&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=a32478ee78164a828a23db60ad1f373f&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:08:04 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
2002.............}.w......9....v%.e......:.......v.....C...."U......;3
x. AJv..._.n,...`0/....$..?........z.;....."w.w.$..Y..a.e~.u.(."..i.(.
.a._;[email protected].#..kk.....4G.h..q.l}2._...O..@A|..s..k..F.
......37..8V...=K.8.Y.....,..~.....h.-..)s. en.............}`.(..Y...T
.....I.d.yV,....HXW......._..i.',...,.Ga.z,......<t3_.. ..)..hW...)
..!42cA..a.......S.....a8p...........3,..:..I^.....x8..Ht\..]....h..$.
Z..i:.'o..L.C.|.i...R......_..M...v......a..vs........q..Of40......ICy
.A4.8"...t.p...;mfm.^..9.2.n....Y.g..b.|..._Pa..:..,X...Q.C^.!.]..../w
..6...,I.| .w.T^......^"`.g.di.j.I.f....hLb....8;.^f~/...[a.Zm...5.D/.
.......;~.....MuZ....jYVT.I.l/..`0..2....8....k.2..{9ic...C.......J cV
........Z.qg3?..'A.5.....&..sa&..BN.."e!...~d..x...X..M.T#.u..!.....Of
...|4Z.....G<"3..w...R4.G.."..z...w....z..Fk....s..u......4A..,N...
'/....k7.B....N.lv...d....M..`.`a8~{s.....4k1....M.. ..6;wGn.(O...q._3
.Cm......=h....`..Y...N...Sp.. ..[...h0.5.7..4...]\.:......'.......q..
0..x...0 ........<..y.i.T-........T..X.|X..v..a..a5......X.*..8...P
....C#y.....vg........A.%.#.....E...6..9D'...H....Ko..$..x.....X..o...
..cB...q.......E....]__...d..U..0.........]......_..s....).T..[.j&.f.&
gt;.qd..4KN...4.%2.P.D..../.i3..=.....::M..Iv..Z...U.vY...6V..e.~..]c.
..E2..s4.t>H9.6....r.M.6.'MN....Pn.....M...... }.go.ax.....(..f.. 7
..Z...=.C.A..C.{...g..;...E..-P M.I.>.....*.....q.G.,./.@q%..A.....
?7.....t.......rJ..:=.....,....#.AuRm.f.#..i.p...[.]...*(..=....4...Uo
....#!jk]".{.{.<..G..S'..^....b.f..VY....C .aq6....d....q.p....
<<< skipped >>>


GET /tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=UIControl&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1112274432&dialogType=MODAL&anxs=RestartPromptAfterInstall&uitype=button&controlID=Restart HTTP/1.1
Host: live.tb.ask.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654073893&xp=&xrt=&xt=&nv=3&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="


HTTP/1.1 204 No Content
Server: nginx/1.0.1
Date: Fri, 13 Jun 2014 10:08:07 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



POST /mirrorCookies.jhtml HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
Connection: keep-alive
Content-Length: 734
Cache-Control: max-age=0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: hXXp://VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654070067&xp=&xrt=&xt=&nv=1&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe4.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="

sessionData=,,-1,false,1,"b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9+QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu+di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd+6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ+4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR+W5Uk2lqktj3DeGUK5TdAqt2CkFxIv+SfaUQHy90X1sxm+jcyPhrZaVY9ePe7m6XNQDpex8QF22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="&dlput=%2
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:51 GMT
Server: Apache
Set-Cookie: sessionData="b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9 QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIv SfaUQHy90X1sxm jcyPhrZaVY9ePe7m6XNQDpex8QF22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; Version=1; Domain=fromdoctopdf.dl.tb.ask.com; Max-Age=2592000; Expires=Sun, 13-Jul-2014 10:07:51 GMT; Path=""
Set-Cookie: dlput=YYA; Version=1; Domain=fromdoctopdf.dl.tb.ask.com; Max-Age=2592000; Expires=Sun, 13-Jul-2014 10:07:51 GMT; Path=""
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654071702&xp=&xrt=&xt=&nv=2&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe20.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="; Version=1; Domain=.tb.ask.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:51 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 93
Connection: close
Content-Type: text/html
..........-.A..0...Rr.....im.B.....W..0...>4s..2.....I...w.3..<.
a.&....TqP.....]..x.7...KX.....
<<< skipped >>>


GET /images/vicinio/dsp-images/jason.pepping/asset5/1370528117612.png HTTP/1.1
Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 06 Jun 2013 14:15:08 GMT
ETag: "42370e-1d3a-4de7cf116fcf8"
Accept-Ranges: bytes
Content-Length: 7482
Cache-Control: max-age=287461575
Expires: Sun, 04 Jun 2023 14:15:08 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR.......A.............tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:549D36B18EF011E1A2BBEFA444
46F2AE" xmpMM:DocumentID="xmp.did:549D36B28EF011E1A2BBEFA44446F2AE">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:549D36AF8EF011E1A2BB
EFA44446F2AE" stRef:documentID="xmp.did:549D36B08EF011E1A2BBEFA44446F2
AE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>~..8....IDATx..].t.U......}.....$d.........&g
t;.a.CG..8.. .......=3n.s.g.. "".B......-A..H.I k.....V.........s.?E.[
..}.n.......: ^.W".(?...#.ED.(".D.ED.(".D.ED.(".D.ED.(".D.ED.(".D.ED.(
".D..'.(".D..'.(".D..'.(".D..'.(".D.7..'..o.=B..U.4..("N....M....`6\C.
..."t*...1.PkhhX.fMMM...08.........Q...1...z.B29M=%Cs....[/.8...k...w.
.Z.j.td..X2E=1%|.r{..(7t3.N.I....#.t.}.J.. ....o...kA..._.X,..s..k.=KP
.X...H.....xA...&d..9..  Q..k..SSGT<x..GG.j ....H...........r.wB...
.}..Pf.qL.#G...=.n.....T...........L....#..t..Us....2.J?:_............
..%.$.='....<xg....OZ?l..x..3.V.....H.[<O...s....;v.......]n
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/button1/1384361682725.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 16:54:43 GMT
ETag: "a9a324-bd5-4eb11d267ad5b"
Accept-Ranges: bytes
Content-Length: 3029
Cache-Control: max-age=300652212
Expires: Sat, 11 Nov 2023 16:54:43 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:34 GMT
Connection: keep-alive
.PNG........IHDR.......$......S......tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:2A37056610E911E3AC809FB54
AEE8879" xmpMM:DocumentID="xmp.did:2A37056710E911E3AC809FB54AEE8879"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A37056410E911E3AC8
09FB54AEE8879" stRef:documentID="xmp.did:2A37056510E911E3AC809FB54AEE8
879"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>.Z.L...JIDATx..\{PT.....eawY. .<\B$..E!Fk
..Nh..A....S....kkR.f.v........?j'.I..q....dL...I.5I......ty?va.w.....
.]!Eh..c~....{.;.~...;...J...Y".p-..0..............v.U./.F.7..&|.p=.Z.
.%.A.j.?}...9..lj.Z.:j$.!4 s.5...-.....A..l..'....$..2wQ. ....i...KQ.=
..z....%.:V..DM"..Xh....><~7.>.&....HB.).G..:.p.R...o.7....8.
....0i.)..D..;q...AO..j.pcS^w;k,..........L.$#/....F..hH.<Vt:..^.s.
o\...2^xX.B. ~.x...qyP.?...LF....n8.....7....J..B...'<..M..>.&..
.e.....z.zG."j=....A_....2i.".n.K..(D...[.>.h.]..8.J.E.w.'".2i..D$A
;.%...Y<..=(dW.~.....(LY. .Q...[....q...[.6.....o..u.l.F..&G...
<<< skipped >>>


GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 24 May 2014 05:04:51 GMT
If-None-Match: "96bfbfb1d77cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Sat, 24 May 2014 05:04:51 GMT
ETag: "96bfbfb1d77cf1:0"
Cache-Control: max-age=900
Date: Fri, 13 Jun 2014 10:07:29 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Sat, 24 May 2014 05:04:51 GMT..ETag: "96bfbfb1d77cf1:0"..Cache
-Control: max-age=900..Date: Fri, 13 Jun 2014 10:07:29 GMT..Connection
: keep-alive......


GET /pki/crl/products/WinPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 07 May 2014 05:04:02 GMT
If-None-Match: "a413fc3b169cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Wed, 07 May 2014 05:04:02 GMT
ETag: "a413fc3b169cf1:0"
Cache-Control: max-age=900
Date: Fri, 13 Jun 2014 10:07:30 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Wed, 07 May 2014 05:04:02 GMT..ETag: "a413fc3b169cf1:0"..Cache
-Control: max-age=900..Date: Fri, 13 Jun 2014 10:07:30 GMT..Connection
: keep-alive..



GET /fr/u.php?p=185501061579159&m=ldFBPpghS2Kio-vE_oEEUQ&t=2592000&cb=e2tpvm HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
DNT: 1
Connection: Keep-Alive
Host: VVV.facebook.com


HTTP/1.1 302 forced.302
Location: hXXp://a.triggit.com/pxfbcm?s=miss
Date: Fri, 13 Jun 2014 03:07:28 PDT
X-Content-Type-Options: nosniff
Pragma: public
X-XSS-Protection: 0
Cache-Control: public, max-age=0
Expires: Fri, 13 Jun 2014 03:07:28 PDT
X-UA-Compatible: IE=edge,chrome=1
Content-Type: text/html; charset=utf-8
X-FB-Debug: rpYjJst5vxS4yt7Nrwl1a5vFtB/o67Mpx1J0aDWjFwqmU1laOKwTPseWFL8rJvwrnCLovdzNTjtCKidjEIUGlw==
Connection: keep-alive
Content-Length: 0
HTTP/1.1 302 forced.302..Location: hXXp://a.triggit.com/pxfbcm?s=miss.
.Date: Fri, 13 Jun 2014 03:07:28 PDT..X-Content-Type-Options: nosniff.
.Pragma: public..X-XSS-Protection: 0..Cache-Control: public, max-age=0
..Expires: Fri, 13 Jun 2014 03:07:28 PDT..X-UA-Compatible: IE=edge,chr
ome=1..Content-Type: text/html; charset=utf-8..X-FB-Debug: rpYjJst5vxS
4yt7Nrwl1a5vFtB/o67Mpx1J0aDWjFwqmU1laOKwTPseWFL8rJvwrnCLovdzNTjtCKidjE
IUGlw==..Connection: keep-alive..Content-Length: 0..



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016364&anxsq=4&cookiesEnabled=1&anxe=SplashLanding&anxr=2043420352 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="1KwlOL99CBUb/cm kLnwq9/feNfFDOkQCthghC9WPd84390vaUA8Lj4jM8zroAlXxuQWljAedxSdh SiFsGi4Ha8OPh5ArtmDARBGpQdFqf5J8v4vQNQAIBJnfgkI3VAjZfjct3YpO4X2eAmWIH0QQTahOyEzICj7kdI Mx1ztsS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654016370&nv=4&t=-&v=-&p=-&si=-&sn=dfprdsndlfe21.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:00 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654070926&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&cookiesEnabled=1&anxe=SplashLanding&anxr=1798796993 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=062329B0-5521-4737-A396-00ACFB474D4F; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=; successUrl=hXXp://VVV.fromdoctopdf.com/installComplete.jhtml; defaultSearchOption=true; defaultSearch=true; homePageOption=true; homePage=true; sessionData="b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9 QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgM
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:51 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/FromDocToPDFSetup.exe HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (Compatible; FromDocToPDF_65EIInstaller)
Host: ak.imgfarm.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 04 Jun 2014 18:34:07 GMT
ETag: "12b4fe-5ca980-4fb06dfab14ed"
Accept-Ranges: bytes
Content-Length: 6072704
Cache-Control: max-age=315214217
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/x-msdownload
Date: Fri, 13 Jun 2014 10:07:09 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......\..|.../.../
.../.../.../N../.../.../.../z../.../.../.../.../.../Rich.../..........
..............PE..L....."S.................0...P\......(.......@....@.
..........................\.......\...................................
...[..x.........\...........\.........................................
.....................@[email protected]%.......0
.................. ..`.rdata..."[email protected]...@..............@[email protected]...
^[email protected].....\.......\.................@.
.@....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654082774&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=7&searchAssistantOptIn=true&homePageOptIn=true&tbUID=49F19948-7BCF-4240-BFE9-02783025B89B&tbVer=8.22.3.63617&anxe=InstallerFinished&anxr=204005028 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: cookieEnabled=true; sessionData="sxZ4ZF5IibvfSKqfgLj09lPDxOA0GrOWgLMfK f0kOsxTSv4AM5ACMGb3V/9n1s5jnQpZXvQCbrkFUXEm2v5PM/kayNqKg bt71TqA61sFBKeNv78faqxk0X4yCoMubCeK3HSeoU0wBv9s30tNheQXLWE 5aLvbKiW PHM0QQqSjDmSmPMMvPPCHTSlEn6QEH2YcZlex/IQ6m1XVSZNlQetZJbxHljw46hrTFxrrdKtSeDuNu9kirXHmJovMbdYR/iujY0c4hxR0K5wIfcZiPZ6BgpwPpwzkvPFHaEGoeZjfYapa4hsA9KFI hpSEy8pXyq5fuWXUZUcgoSXWyZJmwhEXZ0D0HmiDcR1WCq9gseIVj/RsYq7dB5X5jJ3IuzdXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIvCRhivhu5/Q3TzU6hz51TyJSZQJTjpeI8t p6EkYWTzl22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=49F19948-7BCF-4240-BFE9-02783025
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:08:04 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654024281&anxsq=7&optIn=true&searchAssistantOptionIE=true&searchAssistantOptInIE=true&homePageOptionIE=true&homePageOptInIE=true&anxe=InstallerHostAccepted&anxr=1797796994 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654025397&nv=8&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6%
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:09 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /activity;src=3962930;type=invmedia;cat=rwavulrf;ord=9295666029211.133? HTTP/1.1
Host: ad.doubleclick.net
Connection: keep-alive
Cache-Control: max-age=0
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
X-Client-Data: CNO1yQEIhLbJAQiktskBCKm2yQEIwbbJAQiehsoBCLiIygEI8YjKAQiplMoB
Referer: hXXp://VVV.fromdoctopdf.com/splashPixels.jhtml
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:07:53 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 13-Jun-2014 10:22:53 GMT; path=/; domain=.doubleclick.net
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:07:53 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: test_cookie=CheckForPe
rmission; expires=Fri, 13-Jun-2014 10:22:53 GMT; path=/; domain=.doubl
eclick.net..X-Content-Type-Options: nosniff..Server: cafe..Content-Len
gth: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic.
.GIF89a.............!.......,...........D.;....


GET /activity;src=3962930;type=invmedia;cat=roprkm09;ord=9452643389813.602? HTTP/1.1


Host: ad.doubleclick.net
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
X-Client-Data: CNO1yQEIhLbJAQiktskBCKm2yQEIwbbJAQiehsoBCLiIygEI8YjKAQiplMoB
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: test_cookie=CheckForPermission


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:08:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: id=2248b29edb0100be||t=1402654084|et=730|cs=002213fd4890e71c6ec5cf1dc2; expires=Sun, 12-Jun-2016 10:08:04 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:08:04 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: id=2248b29edb0100be||t
=1402654084|et=730|cs=002213fd4890e71c6ec5cf1dc2; expires=Sun, 12-Jun-
2016 10:08:04 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_c
ookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Ju
l 2008 23:59:00 GMT..X-Content-Type-Options: nosniff..Server: cafe..Co
ntent-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol:
 80:quic..GIF89a.............!.......,...........D.;..
<<< skipped >>>


GET /tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=PluginInvoked&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=1648335828&controlName=SearchControl&methodName=UpdateSearch&resultCode=5&errorMessage= HTTP/1.1
Host: live.tb.ask.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654073893&xp=&xrt=&xt=&nv=3&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="


HTTP/1.1 204 No Content
Server: nginx/1.0.1
Date: Fri, 13 Jun 2014 10:08:04 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



GET /activity;src=3962930;type=invmedia;cat=rwavulrf;ord=715925385974.9415? HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/splashPixels.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ad.doubleclick.net
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:07:01 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 13-Jun-2014 10:22:01 GMT; path=/; domain=.doubleclick.net
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:07:01 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: test_cookie=CheckForPe
rmission; expires=Fri, 13-Jun-2014 10:22:01 GMT; path=/; domain=.doubl
eclick.net..X-Content-Type-Options: nosniff..Server: cafe..Content-Len
gth: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic.
.GIF89a.............!.......,...........D.;..



GET /images/anx/anemone-1.2.7.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 08 Jul 2013 20:02:48 GMT
ETag: "774114-a236-4e105875b5290"
Accept-Ranges: bytes
Content-Length: 41526
Cache-Control: max-age=309572103
Expires: Thu, 06 Jul 2023 20:02:48 GMT
Content-Type: application/javascript
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
// You can define an _AnemoneParams global var with the following memb
ers (all are optional):..// uniqueUser: unique user ID (${eventRecord.
uniqueUserId}) -- if missing, will generate a value..// appId: applica
tion ID (${eventRecord.application}) -- if missing, will use current h
ostname..// appVersion: application build version (${eventRecord.appBu
ildVersion})..// appDate: application build date (${eventRecord.appBui
ldDate}) -- if missing, will attempt to use document.lastModified..// 
logPageView: if true, each page view will be logged (only do this if y
ou are not using server-side logging -- otherwise each page view will 
be logged twice)..// updateSession: if true, the session and referrer 
info in the cookie will be updated (only do this if you are not using 
server-side logging at all, or not using the Java servlet filter -- ot
herwise events may be double-counted and sessions may expire unexpecte
dly)..// domain: cookie domain (if not present, will use the last two 
components of the current hostname)..// url: base URL for callback (if
 not present, will use the current URL with "anemone.jhtml" instead of
 the page)..// getAppParams: function which returns an object whose pr
operty names/values will be logged for page views and events (values w
ill be URL-encoded)..// getAppCookieChips: function which returns an o
bject whose property names/values will be added to the Anemone cookie 
(names should begin with "x")..// getUserSegments: function which acce
pts an array of segment IDs and returns the array, possibly adding
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background1/1370528215804.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 06 Jun 2013 14:16:46 GMT
ETag: "635700-1ae0-4de7cf6ee5c67"
Accept-Ranges: bytes
Content-Length: 6880
Cache-Control: max-age=287535728
Expires: Sun, 04 Jun 2023 14:16:46 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
[email protected] ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:7A86773D6BD411E2BFD9E432
700E40AC" xmpMM:DocumentID="xmp.did:7A86773E6BD411E2BFD9E432700E40AC"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7A86773B6BD411E2BF
D9E432700E40AC" stRef:documentID="xmp.did:7A86773C6BD411E2BFD9E432700E
40AC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.$.....TIDATx.....$.]...S.=3;k.qbG.'.......
../J..C.p..)....p! .@H"..p..n.A..H..$ ..y1...{./3..PU..]=......n=....=
3=.....o?.T=....gq..}.....=q..Q.Y.h....HUD..R............X_.......w.f.
u.W.>..............?.~...R.?/.8.....^.B.9..3.L....].....j.....<.
..A..[7....x.>n.....?...}v.6..8^......s..E...fQ....S....8h.........
z..q.}.._..{......x....3....M/..Kr{.i..v{y.;..xZ?`..W...O.....i....]0u
W..?.z....z.vC..q ..../.5.F.1{[email protected]...~..;w..8..u..B._U.{
.}..-...2..y...c.,.(..Q........rq....o.SO]....?Mw..7....W?...........4
..q;.|......ut...]R........o.\^......?......./<.s.A.d#.<....
<<< skipped >>>

GET /images/vicinio/dsp-images/207743773/background999/1372459906306.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml?close=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 28 Jun 2013 22:51:38 GMT
ETag: "1c9a74-285da-4e03eb8b65111"
Accept-Ranges: bytes
Content-Length: 165338
Cache-Control: max-age=293368225
Expires: Mon, 26 Jun 2023 22:51:38 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:22 GMT
Connection: keep-alive
.PNG........IHDR...T.........JL......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:08801174072068118C14B382F3F4B1D6" xmpMM:DocumentID="xmp.did:5581
2826D30B11E29CF3D9F188167602" xmpMM:InstanceID="xmp.iid:55812825D30B11
E29CF3D9F188167602" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49E72B9C0923681182
2AC838F8D35617" stRef:documentID="xmp.did:08801174072068118C14B382F3F4
B1D6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........IDATx...k.n.U.6..}.z..>......$..
..8.......R..\.6j.Vm..Q..-*.R.T.G[.B...H.$J..%m@!.s.1`H.0...HHp.....&g
t;g...{Yk.9...y.o;'1{..{/k=...9..c....w..{v7.< ..~....i....z.....?.
y..51;.q.?............}....qz.m..........nw.....].....u...K.......w-_|
.../....yf.?u.Hw...Ww..|...u.,.."..o.....?kw...Zn.-..>........{:_..
.w...8V....^...<......o....e.....r..0`....Y'...^.y..G..;........%..
.\.....7.W......e.OC..O....'.....u.{...Y..;?3............g..5..=..u...
9.4w....\..3..Nn..........n~Y.;. .8......<V...<..q:.......p.
<<< skipped >>>


GET /activity;src=3962930;type=invmedia;cat=rwavulrf;ord=4846481317772.642? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/splashPixels.jhtml
Connection: keep-alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 13 Jun 2014 10:07:35 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 13-Jun-2014 10:22:35 GMT; path=/; domain=.doubleclick.net
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Date: Fri, 13 Jun 2014 10:07:35 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-r
evalidate..Content-Type: image/gif..Set-Cookie: test_cookie=CheckForPe
rmission; expires=Fri, 13-Jun-2014 10:22:35 GMT; path=/; domain=.doubl
eclick.net..X-Content-Type-Options: nosniff..Server: cafe..Content-Len
gth: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic.
.GIF89a.............!.......,...........D.;..



GET /ga.js HTTP/1.1
Host: VVV.google-analytics.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Date: Thu, 12 Jun 2014 23:42:41 GMT
Expires: Fri, 13 Jun 2014 11:42:41 GMT
Last-Modified: Thu, 29 May 2014 22:33:33 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15836
Cache-Control: public, max-age=43200
Age: 37507
Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f.....ZhiI..dY.iB.b.KI.o.gF.-'..9....n
byF..h4...../....z..|..y .b../......A_.S.....w......$2=.\..8e..:.G..].
.<.b....M_7.,.I...{..t<./s....x...,...(r4...8W|&N._K...M...p.\9.
..'.I.._.Jz.!.6.....8........P...F.......]H...-..!.M.t...?..6..5O..1..
p0..7.n$y*.z..Z...".W .8XE.....z.a....`.n....t....v.u..6.....A:H...=..
z.....!...5.u [email protected](;. ... W#.M..4
.0.u|.8..{..5...v.T.....5.@)..M..wr.....A>.v..%w..C.B..,Wjj8......j
.r./.Y..RI.6.(........T....Dq......Al...b...:.r.........}1.C...ZYv..y.
r.=d^.....T....L.U(.2 ...`..5......8.tD=..........c.#u.h...-..yu.....r
..?D....j.JQa.T.....f...G.q?r....7_llo>..@....].n;[email protected]_.@...
....#[email protected]...~.UL&...,X.a.Gl...C..c....W........i..2....w.V.{S
...T(w..KF........1.".......V..N.J V.y...K.....4....  .W...Y.......k$.
..r...P..H.J.^.......|... [email protected]..,|\AH`..._..k. x...A...d$.X.~.H
|.3..w>.@M"...s....1..Yi.#..G.........tO....v...1...{k.......np...8
y...Aa....V1.UvB...UJ.q.YC.=.W....1..Yns....s.8.....}..}.0h:......[.Q.
[email protected].}.(..Z.%..q....=Q.$HD....|.[Yq5A..rR.|.r...A....,....^.3
.w...4.:..3.=...>.Z_.A?2X.W..vl...Y.Q].....`VUv......9.R%<.k)..P
OLv..rm..Gc._j.cr/...yBjJ....:7....'....uQ.7.W..0s/K...|..*bY...&...pe
E.50.......&...T)-.-.)......A.."....aK...M.#.Y..... Js......ns.......V
....F;Q....0.P..S.L..l...B..&...nfX3d.....Z....5...6... :.[.{.".!.7*.0
...ylO..N...n ....r.M [email protected]..]W.u..D...m..J.5k..nT...t!.
..._..=..G.Y..^Y..f..]...d.N^....9....m1-0..`K.uB..R.MB.......%.!.
<<< skipped >>>


GET / HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:48 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="KUDvVVAQLxDyVTTFzN4rcCwpMhvhfvV8Mqp6752LwC2X/zsVqvYOPkJYtkbuWdd3xuQWljAedxSdh SiFsGi4L0xKKYtjSSNfJw50jjYZQL5J8v4vQNQAIBJnfgkI3VAF7rdxM5BN2XUK05w6xLTztd//C4QT0cjief49K3MHMoS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="xrp=^Y6^yyyyyy^YYA^ua&xnt=&xh=7998&xpp=^Y6^chryyy^YYA^ua&xi=CRX_WEBSTORE&fv=1402654068215&xn=&xrm=&xtp=vhigh&xct=&xs=22641&lv=1402654068215&xp=vicinio&xrt=YYA&xt=intdefaultcrx&nv=1&xu=&xrs=&oc=-&od=none&ob=-&xkw=&om=-&xrco=Y6&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe12.df.jabodo.com&xgc=false&op=-&xbkw=&xrca=yyyyyy&xrcc=ua&xft=&xad=&xcid=a32478ee78164a828a23db60ad1f373f&xuer=3"; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:48 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
1ff8.............}.[.........AQ{b9...!...C.4.....B...-.V"[.$s).......v
u.!.iO.7>............~.?.).{.`so..d.............a.4..,o4..G......7F
..h...(.. ..a....4.A..........r#........jaa.u!UJ6..3_.....H..)s2S..s..
..{N$_..Q....z.....k{>.]...J.4._<[email protected].].
.1S.*m".....q..........D<s.......N.A. .M.QA<?.....2....}..^R.J..
.7R .S.M..j>2~.G~....&r..y...c.....h.X._.Y....`.W.zP...Z._..q......
/.4....@w.$~............Q......#..k...ip....e....'.Y5s...e.."....#7}..
RA1%[email protected]:Q:hkeF...Eb.)#.X^.X..^p...<.Bw.1......
^.\.........*..(W..Q..w@u<[email protected].:....w..%.k.I&c.....$.._3.Q...
..y.ol.....pq..K.j... .}j(......%.....X3V[Oe..<..s.c...X'.>bL.&n
.n...JCZ...4 ...H.%.n'..I*.N..*..;.7g.$M.QVg)&&...........U...(....s..
H.b.t&a..Sh......B0E... V.(.o.rR.....?ep...[...:...C.......BY8......d.
&...i4...x/........T......%.Ux.`....!n.Z....5......L%..?Y...L.P..f.P..
.u...y.....qF......_.4......8.Sw..Y..N.X.....`..4:7.,i.... ....8..c..~
........A:..~h*L.~..I'..v..-i..P.....|\^.H<x.....8..w..ES..}%&.|.)X
?.r>^,X..J.:n.S?....8........cc............D...J...v.z3..P.. .!.B..
.......k..f..'Y...x.S. .>..C.1v.'X.8...W..`....~c.-..........O\....
..@e......(.....B....E..I.~-......_..3..D&H@.....~.bt..!?.,KU..;G..y..
.y...Q./.'..P. .{.w9W.4P. )&......9....C...;.C.{...F0...x..F.&.$......
..%.....M.Qc...`s...fk....m......Q.ekN|..c....H...*...onn=.Z......%...
.V2fg......GKY.=.<?....<.9.s.N.p..6vFI.O.i.#.~....~/.:[email protected]..>
;%\......H....A...?.V......(2.0 ..........}w..J....#.S..........".
<<< skipped >>>


GET /css?family=Shadows Into Light Two|Raleway:400,900,800,700,600,500,300,200,100 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Fri, 13 Jun 2014 10:07:33 GMT
Date: Fri, 13 Jun 2014 10:07:33 GMT
Cache-Control: private, max-age=86400
Content-Encoding: gzip
Content-Length: 593
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
............[..0...{..w.."x..........a.1.....P.....;...d.......k..I.l.
...&.~.(.u..(.Pe. ...|...$C.C.8..z.&.u6.C.X.X...C!l.t....6._.|..L.....
l...a..........Q......I.....@\.9..2.K.&...AA...Z=..............t...~..
.=.vI5..]9l.p.rS>.........%...rJ.0>N;..9<W..mt..x..J...x.M.].
..s.p=.f`....9.._..(V)......H...V..Ug..{...^..Yhq....|..[.ZJ.x.......y
...KV..F..[...=.d......../....h....o.k.....Y'<....Iw1~..-........V7
.(....h\J.. J...g.0...j.1.^Q...'Q..);..6...i..9....&.sk*^.D([email protected]'<
...ZLG.j,b..Z>'j[.w{.%-f.`.$..>./?..%..........c.;>..........
....':.$.f.:.t......b.M".'..t..x{.o.aMa..M.D4.B._........HTTP/1.1 200 
OK..Content-Type: text/css..Timing-Allow-Origin: *..Expires: Fri, 13 J
un 2014 10:07:33 GMT..Date: Fri, 13 Jun 2014 10:07:33 GMT..Cache-Contr
ol: private, max-age=86400..Content-Encoding: gzip..Content-Length: 59
3..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS
-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:quic..
............[..0...{..w.."x..........a.1.....P.....;...d.......k..I.l.
...&.~.(.u..(.Pe. ...|...$C.C.8..z.&.u6.C.X.X...C!l.t....6._.|..L.....
l...a..........Q......I.....@\.9..2.K.&...AA...Z=..............t...~..
.=.vI5..]9l.p.rS>.........%...rJ.0>N;..9<W..mt..x..J...x.M.].
..s.p=.f`....9.._..(V)......H...V..Ug..{...^..Yhq....|..[.ZJ.x.......y
...KV..F..[...=.d......../....h....o.k.....Y'<....Iw1~..-........V7
.(....h\J.. J...g.0...j.1.^Q...'Q..);..6...i..9....&.sk*^.D([email protected]'<
...ZLG.j,b..Z>'j[.w{.%-f.`.$..>./?..%..........c.;>......
<<< skipped >>>


POST /anx.gif?anxa=CAPToolbarButtons&anxe=ButtonStructure&anxr=494291852&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi= HTTP/1.1
Host: anx.tb.ask.com
Connection: keep-alive
Content-Length: 1946
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Origin: chrome-extension://dhhjmlmdpcpiojiffodbldlkgcnaeogp
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654073893&xp=&xrt=&xt=&nv=3&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="

buttons=[{"b":221868145,"c":"mindspark.magnify","p":"L.0"},{"b":221868146,"c":"mindspark.entersearchterms","p":"L.0.0"},{"b":221868151,"c":"mindspark.full","p":"L.0.1"},{"b":221868155,"c":"mindspark.image","p":"L.0.2"},{"b":221868160,"c":"mindspark.advanced","p":"L.0.3"},{"b":221868164,"c":"mindspark.directorysearch","p":"L.0.4"},{"b":221868101,"c":"mindspark.search","p":"L.1"},{"b":221868104,"c":"mindspark.fro
HTTP/1.1 204 No Content
Server: nginx/1.0.10
Date: Fri, 13 Jun 2014 10:08:04 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe16.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/install_pixels.jhtml&anxl=en-US&anxlv=1402654084269&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&tbUID=74E82E32-0EC6-4320-8733-FD9C2C5FC58B&tbVer=8.22.3.63617&anxe=PixelFrameTB&anxr=1246908666 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: cookieEnabled=true; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=49F19948-7BCF-4240-BFE9-02783025B89B; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=; successUrl=hXXp://VVV.fromdoctopdf.com/installComplete.jhtml; defaultSearchOption=true; defaultSearch=true; homePageOption=true; homePage=true; chromeToolbarInstalled=true; sessionData="HnhOu9cHX5d /Yo7R3taUn3kGrL2fn5GLOyQnwNey8l XbGM9qyORIykuzJkpUsouiOUsaT0NKKTMuP0DmxWNbNu/bXwQDhmMm JXta6/Ge07fRxAcc9JqUJ/bGz9 uoSfNwU9nVeylRom2Sqsk9uaequ4kvTzEEkCEjuHheHi0mMh24xluz0Wpr
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:08:04 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /css?family=Shadows Into Light Two|Raleway:400,900,800,700,600,500,300,200,100 HTTP/1.1
Host: fonts.googleapis.com
Connection: keep-alive
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Fri, 13 Jun 2014 10:07:48 GMT
Date: Fri, 13 Jun 2014 10:07:48 GMT
Cache-Control: private, max-age=86400
Content-Encoding: gzip
Content-Length: 593
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
............[..0...{..w.."x..........a.1.....P.....;...d.......k..I.l.
...&.~.(.u..(.Pe. ...|...$C.C.8..z.&.u6.C.X.X...C!l.t....6._.|..L.....
l...a..........Q......I.....@\.9..2.K.&...AA...Z=..............t...~..
.=.vI5..]9l.p.rS>.........%...rJ.0>N;..9<W..mt..x..J...x.M.].
..s.p=.f`....9.._..(V)......H...V..Ug..{...^..Yhq....|..[.ZJ.x.......y
...KV..F..[...=.d......../....h....o.k.....Y'<....Iw1~..-........V7
.(....h\J.. J...g.0...j.1.^Q...'Q..);..6...i..9....&.sk*^.D([email protected]'<
...ZLG.j,b..Z>'j[.w{.%-f.`.$..>./?..%..........c.;>..........
....':.$.f.:.t......b.M".'..t..x{.o.aMa..M.D4.B._..........



GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654053947&anxsq=7&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&tbUID=5864BD4E-284B-4517-9409-6B6363B179CD&paidInstall=true&restartUrl=http://VVV.fromdoctopdf.com/loading.jhtml&anxe=InstallerInvoked&anxr=433607125 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC/W3P6BiN7UNQvxSEYvjBPqbPBnTRQi9Cz8bAxA7zAjFQjWLYKchJ1IK6SXNaAbo4SDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ8bb WIQacDwE6edhzm0Y0yENn8mzq2e1pgzNIqzb9unQClScKoNppnC8bgT1iDTd/MhDr09QEfWObUIULksUVEWNjncEhtooMaPVCsVISOMZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654053953&nv=8&t=-&v=-&p=-&si=-&sn=dfprdsndlfe12.df.jabodo.com&od=none&op=-&ok=-&
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:36 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /css?family=Shadows Into Light Two|Raleway:400,900,800,700,600,500,300,200,100 HTTP/1.1
Accept: text/css
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Fri, 13 Jun 2014 10:06:57 GMT
Date: Fri, 13 Jun 2014 10:06:57 GMT
Cache-Control: private, max-age=86400
Content-Encoding: gzip
Content-Length: 772
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
............I..@.... ......8....im...a)...........mz..h......z...z\C..
kE...;.{{.M [email protected].&.......&A....W4 4,.{.
......5h..R....u<.}.G.$!....;..3..P.L.....F.R.{S.3..)8(.....D...-.)
..;:&mL.....0.......c..}..*.u....X#z....).d.......`.'...,.p...9=..M.}.
..........Wg..ZH....m......S=......'a;....Bp..*.._.._.y#g G"..;p.P ;..
..1%...[.E.j.r. ..[Z.7TJ4.s..r...r.."5%...V.D..vJ.RTb.V.j..p..:....[9.
......7U..e_.......0.V...!...)_Oqj...k;.wHI..cq&..u.)/.....?.3.7j..O..
...HQ....O.^...".#... ..RL.m2.....7.7n.b$..P.2.3^EB..*KUU.!.hp...B.3R.
%......HsC!...(.m.i|.Qd.o.J.c...s.%..._ry.g.F".s;5.........q.......kv.
 ...%...........4i*1.(:.=.. .z.....vc.^.....iI.B"..F...`.-...F..a..A..
.OUfF.K...l..o-.m9..Om.^8....Y\..o)..cKi/..u....Q....{e.......&.....vE
.....HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-Origin: *..
Expires: Fri, 13 Jun 2014 10:06:57 GMT..Date: Fri, 13 Jun 2014 10:06:5
7 GMT..Cache-Control: private, max-age=86400..Content-Encoding: gzip..
Content-Length: 772..X-Content-Type-Options: nosniff..X-Frame-Options:
 SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..Alternate-P
rotocol: 80:quic..............I..@.... ......8....im...a)...........mz
..h......z...z\C..kE...;.{{.M [email protected].&...
....&A....W4 4,.{.......5h..R....u<.}.G.$!....;..3..P.L.....F.R.{S.
3..)8(.....D...-.)..;:&mL.....0.......c..}..*.u....X#z....).d.......`.
'...,.p...9=..M.}...........Wg..ZH....m......S=......'a;....Bp..*.._..
_.y#g G"..;p.P ;....1%...[.E.j.r. ..[Z.7TJ4.s..r...r.."5%...V.D..v
<<< skipped >>>


GET /images/download/ask/browsers_0927.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 23 Sep 2013 16:14:08 GMT
ETag: "113791-1415-4e70f4f57f7c1"
Accept-Ranges: bytes
Content-Length: 5141
Cache-Control: max-age=314993402
Expires: Thu, 21 Sep 2023 16:14:08 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR...O...,.....$T.r....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..[..T....V{uU.J.t.Jw#. Kp..........h.h.Kf&..':...C.....h4
.c..0*[email protected]......}....Q...`...='.=............[...:...V.."..E.?.
...eD...Bt).v...6.UD.D6....e.;...a...1.........._..Q..~..8.s..a!:....&
gt;...O.<.G.Q.....~......g.o:.......2....i...6. ....{....k...$....e
.g.....;..9.l_..W^....>.A.46Q[[..X.".....Z.J/)).s......P}....<.u
..=...d...9a..c>6......k{.hc...i....v...3..../......|?p....6[..9s.M
d5/ ........3.7D..h.'.Y...1>;.-[.....r................v.1`~~.~...O.
X..l..=r.H..8q.>z.h...dV....k.eeezkk.~...c\.c.t.Rc...SO=......$..7W
x.?.x.w555.0.={..|&.e....L o...1VVP...c0...........45S.<...Sb..v...
..G.yD..........;|.p...]..O.-../......Y...2A...o.x...0X.5.\..x....7 ..
. W.4.b.g7.5q..b.g...>..c..7.|.9.c<..ll6.....k^.Ta.........../..
G.}.....<V.v....c..!...)S.p8..X,f....3..S.....$,.}.................
.,8..tHF.p.B..?.t(.............i.&....$(...{X.z5H.>u>...F.......
....y...X.v......q.M7......j...Wc.W_}....[.2g......w/......}..........
C.E..C.4l...O<.D.5.. ..."c.w.q.!`UU1{............*..cf....,..:3s..&
lt;.c...f....l....t.9.....>..Z.../_n<3..5[...............Y.5...@
..1..>....Md.j./..Y!..u..>.....&.|....GWW.....H...]L.......o..3.
.9....5c......C.2.....S../.~b.....n..........J0.{....L...^.5...l..._..
)3..sd:.s}...t1.m...g.x.b..(w....L.o.p....\I]........z.D;....;...56."e
.f.QNhH.f..*.....\yn.v..H..&U...<.y8...,k3....gv Ph)....(.`.p.f?..9
....Pb.........d.QY.A_BG...]Q.....Y. ..3Ij.k....XW..IX..x...9.LY..
<<< skipped >>>

GET /images/download/ask/pba_0927.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 23 Sep 2013 16:06:07 GMT
ETag: "113790-dd6-4e70f32b009c4"
Accept-Ranges: bytes
Content-Length: 3542
Cache-Control: max-age=315354163
Expires: Thu, 21 Sep 2023 16:06:07 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR....... .......P.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...xIDATx..\.TT....A.......b..k.#..hb..R..... -...k..t.Y....L..KrUv
...k.%|.c.^..@ h..G.<..a........a..0..v..~..{......_..T. .B..(.@!"W
.....|.8.;$m...!W.vV)..?.....S.......A..U/.F... ...5...Cw....)r.....$.
"..7......A.....g.....h..FA.:nF.F..9..q]&...jkka...PYi9.......NE..]R0(
@[email protected]. .........Bbb".....BCC..7...#F..e..i.
.3......;GN.\[email protected].....
..e\*......`.....c~.f.W....=..............k..{][email protected]
..>y.d.../.... ^C..>[email protected]..[.o.....~.4....n.._......)Y..
|$.H..^.Z.#8].....ju..... p....w.3.u.%.k3.W...?a..BLL.dee..Y.f..M.`..-
.~...HJJ.U.1..............o|.....n....s.]...#"....Z..t...wO....j......
..\f'..7.....K.,......N.E.@Q.]Q.!..p.R...}....A..>..O........;.....
7h.z.s#.@.`...H4xO....../5;;....=8p..I.Q. ..X..a;...J.A.?.*WWP{...D...
...b........&.jJObu.......}..%.... ./....c..0..R.6m..w..r....Z.....$..
\..e... t........)...3....Ik.zw....h#.I.P......l.vr.;^!. ...6.n9 p....
.i...O...;.v..<-@(6I.R5n.Y...044:.. .....*@.C...s1V....|..Mg..YL.t.
.u.~`..Ahm...(.Z0...U.3..j....l;T<..#....mx.R..$B............,.~.vT
.z...|:.|.H..A........l.<....}..P....oA...._.B..c....Dp...1*Th....O
."...d...lk,.............xy......X....n[....Z-...U9..W..$B...c....p.A.
2X.....N|..3.@=..}...".t?.C....s.(..v=.....{.I......}ee..m..J........"
4...-.....h:...|.}.....7...W..&X.. .....Q.R..6d.EX.m.........1........
...VB..S...Q.4P....Hl....`u.$R.,...g$..V...p.M....j.5....6.g..BqO.
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/asset11/1394830028148.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 14 Mar 2014 20:47:07 GMT
ETag: "68a848-e413-4f4972c5420f3"
Accept-Ranges: bytes
Content-Length: 58387
Cache-Control: max-age=313590156
Expires: Mon, 11 Mar 2024 20:47:07 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR...8...........n.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:1DB88BBD0C206811822AD392055CB2AC" xmpMM:DocumentID="xmp.did:AC8A
63557F9311E3869488C434A73F85" xmpMM:InstanceID="xmp.iid:AC8A63547F9311
E3869488C434A73F85" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1EB88BBD0C20681182
2AD392055CB2AC" stRef:documentID="xmp.did:1DB88BBD0C206811822AD392055C
B2AC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.L.....AIDATx..}.....vW...3.....*.L.0.c...M
0...6...............s...1.....A .P.*..J...qv'w..UWOOOZ.Vi%.1.zz......W
..W.Ph.... (./J...QfJl9@......\(=..>O.....B.s.e......<.*\3.5.3.0
.q.O.........V2..b.-gD...R.~.......T..s...W= ....<..2..^......9@...
P.h..........U.~wM.]K...y.............9/ej...P...]......jc6..u.2..)-..
....L.Oy....V``G....%.....Lf..$.:F9(... T.K..,......'....Y..Il.JO...L.
.9..=......j...[[email protected]@)..."lA..V........p...9./1.....$..cr..
.A)j..,J....J........Y.6..Q.8.P..:kX.~......`.~..3.)ZT.eN. ...a.;.
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background3/1370528131060.PNG HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 06 Jun 2013 14:15:22 GMT
ETag: "627c9-16b-4de7cf1e3fd4c"
Accept-Ranges: bytes
Content-Length: 363
Cache-Control: max-age=287461585
Expires: Sun, 04 Jun 2023 14:15:22 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
.PNG........IHDR.....................sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<....tEXtSoftware.Adobe ImageRea
dyq.e<....IDATXG..... .E..:....W..qA.f....x.../.D.....(c...s8e.....
.q..Z..xhl.........K.5...T4`.......[..,.<z..]M.d.... . rm.esC..;.s_
M1.......Z[.. .kX.....f....wc....2.L!Sx^~..)..F.#...Ha..3...&..h...&.E
./.mb..v_.....IEND.B`.HTTP/1.1 200 OK..Server: Apache..Last-Modified: 
Thu, 06 Jun 2013 14:15:22 GMT..ETag: "627c9-16b-4de7cf1e3fd4c"..Accept
-Ranges: bytes..Content-Length: 363..Cache-Control: max-age=287461585.
.Expires: Sun, 04 Jun 2023 14:15:22 GMT..Content-Type: image/png..Date
: Fri, 13 Jun 2014 10:06:59 GMT..Connection: keep-alive...PNG........I
HDR.....................sRGB.........gAMA......a.... cHRM..z&.........
.....u0...`..:....p..Q<....tEXtSoftware.Adobe ImageReadyq.e<....
IDATXG..... .E..:....W..qA.f....x.../.D.....(c...s8e......q..Z..xhl...
......K.5...T4`.......[..,.<z..]M.d.... . rm.esC..;.s_M1.......Z[..
 .kX.....f....wc....2.L!Sx^~..)..F.#...Ha..3...&..h...&.E./.mb..v_....
.IEND.B`.....


GET /images/download/IE9EnableButton_US.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml?close=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 15 Jan 2013 16:43:33 GMT
ETag: "6cbb71-13cb-4d356765e22c2"
Accept-Ranges: bytes
Content-Length: 5067
Cache-Control: max-age=274498688
Expires: Fri, 13 Jan 2023 16:43:33 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:22 GMT
Connection: keep-alive
.PNG........IHDR.......F.............sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6...EIDATx...}[email protected]......
........ . &.q...KHYn..n..u.U...%......n.n]r.....J...u..D.......!.$...
...2.0...L3s.L.y....&.d...T.*...<...|.....!.....k...~o.......,8..g&
gt;.r...~).es-n....C,.....`......4W...d"E....q...." $E.....(.........&
lt;...EVG.(....]'....|5.DG.(..w.........p.(.>w..]...s...;...TX....%
..<S......Y..D...H.i.....(E.....^{!lf...!...8<......1.!Ec.4Cn-..
...pt..M..0W......pA.p8....MQ)......p8...Nh..)..g9.Nb.tBso.....3.z....
l..Z......d....I8.NJ....pR......R..p8...E......*..'.pQ.p8).......l....
'1.s.0e..6...&.E.'J....;..TX....r.a.7.bI..............[$.QY..[.s.i....
.../......*.....F.....F4._..?_{.....Zu...w:.HQ..%..Nk...Tx.S.Y\..AeQ.*
....m ...Li....|.......M.H8}..yL...d.-.....#,E5.%....`......t.V.R...$I
..S.... .....@....?./.U....l...,....~...e...........|3....7s..........
......B_s..L.7.0*.H(..]W.....\.z.,dT...Ri6..uvln,CCy.........0.~...Dc.
........6Pe.......O..DBd............}....z......k..k.......t..q..<\
.]-...}..x..A...ZTd.Y......\..P.....Ov..]-........xqK..|.....d......"a
..:..x.c...6$.....@[.M.oc..............d.HTTP/1.1 200 OK..Server: Apac
he..Last-Modified: Tue, 15 Jan 2013 16:43:33 GMT..ETag: "6cbb71-13cb-4
d356765e22c2"..Accept-Ranges: bytes..Content-Length: 5067..Cache-Contr
ol: max-age=274498688..Expires: Fri, 13 Jan 2023 16:43:33 GMT..Content
-Type: image/png..Date: Fri, 13 Jun 2014 10:07:22 GMT..Connection: kee
p-alive...PNG........IHDR.......F.............sBIT....|.d.....pHYs
<<< skipped >>>


GET /splashPixels.jhtml HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654053025&nv=5&t=-&v=-&p=-&si=-&sn=dfprdsndlfe14.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=027382d5aeee4be8a36350dfd4a6412c&xuer=3&xx=install"; anxs="s=1041949101&sv=1402654052847&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; cookieEnabled=true
Connection: keep-alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC/W3P6BiN7UNQvxSEYvjBPqbPBnTRQi9Cz8bAxA7zAjFQjWLYKchJ1IK6SXNaAbo4SDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ8bb WIQacDwE6edhzm0Y0yENn8mzq2e1pgzNIqzb9unQClScKoNppnC8bgT1iDTd/MhDr09QEfWObUIULksUVEWNjncEhtooMaPVCsVISOMZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654055518&nv=6&t=-&v=-&p=-&si=-&sn=dfprdsndlfe12.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=027382d5aeee4be8a36350dfd4a6412c&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:35 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Content-Length: 519
Connection: close
Content-Type: text/html;charset=UTF-8
...........SMo.0......tI.5v.. [email protected]'....m=.0`.....#.YT.
..o..Bm..9E.....K.hK......K..y.....DuM....l./.d...X.....m.c...XG5)G...
y..u`.'X.~[.]..3..D.v..a.w x.QG.K..!`C.&.....q.:D..E..~MfC............
..m.w.V.p..k.'<.h.-0..A... ...U..}.6RvluxN.5.f...>.....G.c.S @{.
Ev..#^..`j.rDh)F'e...'j.;..,....fG...q...ly.]..W.|~.....2..........>
;.........J...J. ......R.I-....,..O.X2.F.O....f.kv..)...mS;2f..R.....|
....pys..Gx.w.Z.s......ux.).r&p...G...\.j.....Q...2d..\..T........-..H
.g.@.(.g......6...dg.}..H.kX..=a.Z......
<<< skipped >>>


GET /cfg.jhtml?p2=^Y6^yyyyyy^YYA^ua&s=t207743773&tv=2.5.14.85&v=2.5.14.85&e=68a5&r=0&l=9&c=01&f=002021a1&a=7BE109F9-E265-40DB-885D-AC3553B091B9&lidate=2014-06-13T10:07:18Z HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: config.tb.ask.com
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:25 GMT
Server: Apache
P3P: CP="CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: np=780c22fa; Domain=.tb.ask.com; Expires=Thu, 06-Jun-2024 06:07:25 GMT; Path=/
Set-Cookie: si=""; Domain=.tb.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: ccsP="tbf=002021a1"; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:25 GMT; Path=/
Set-Cookie: UID=7BE109F9-E265-40DB-885D-AC3553B091B9; Domain=.tb.ask.com; Expires=Thu, 06-Jun-2024 06:07:25 GMT; Path=/
Set-Cookie: si2="7BE109F9-E265-40DB-885D-AC3553B091B9="; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:25 GMT; Path=/
Set-Cookie: anx="os=-&g=-&sn=dfprd1cfgfe22.df.jabodo.com&fv=1402654045655&op=-&lv=1402654045655&td=207743773&si=-&nv=1&v=2.5.14.85&oc=-&t=7BE109F9-E265-40DB-885D-AC3553B091B9&od=none&ob=-&p=^Y6^yyyyyy^YYA^ua&om=-&ok=-"; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:25 GMT; Path=/
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
1ff8..<!-- Config ID: 207743773 (LIVE) -->..<!-- product=Y6 t
rack=YYA language=en browserVersion=IE10 userExperience=3 toolbarVersi
on=2051485 -->..<html>..[CustomSearchBox221359559]..backColor
=0xFFFFFF..borderColor=0x186ca3..borderCornerDiameter=2..borderPixels=
2..minHeightPixels=25..textColor=0x000000..widthChars=50..[MenuButton2
21359574Menu]..n=3..t=0..cn0=mindspark.notspyware..i0=221359575..t0=No
t Spyware..u0=hXXp://VVV.mindspark.com/main/toolbar-info/security-conc
erns/index.shtml..cn1=mindspark.help..i1=221359582..t1=Help..u1=http:/
/support.mindspark.com/..cn2=mindspark.version..i2=221359588..s2=0x0c.
.t2=FromDocToPDF Version..[MenuButton221359615Menu]..n=6..t=0..cn0=min
dspark.entersearchterms..i0=221359616..t0=Enter search terms and get..
...s1=4..cn2=mindspark.full..i2=221359621..t2=Full Search..u2=hXXp://s
earch.tb.ask.com/search/GGmain.jhtml?p2=^Y6^yyyyyy^YYA^ua&ptb=7BE109F9
-E265-40DB-885D-AC3553B091B9&ind=2014061306&n=780c22fa&st=bar&searchfo
r=<!-- MY_TEXT_INPUT -->..cn3=mindspark.image..i3=221359625..t3=
Image Search..u3=hXXp://search.tb.ask.com/search/GGimage.jhtml?p2=^Y6^
yyyyyy^YYA^ua&ptb=7BE109F9-E265-40DB-885D-AC3553B091B9&ind=2014061306&
n=780c22fa&st=bar&searchfor=<!-- MY_TEXT_INPUT -->..cn4=mindspar
k.advanced..i4=221359630..t4=Advanced Search..u4=hXXp://search.tb.ask.
com/search/GGadvf.jhtml?p2=^Y6^yyyyyy^YYA^ua&ptb=7BE109F9-E265-40DB-88
5D-AC3553B091B9&ind=2014061306&n=780c22fa&st=bar&searchfor=<!-- MY_
TEXT_INPUT -->..cn5=mindspark.directorysearch..i5=221359634..t5
<<< skipped >>>

GET /cfg.jhtml?p2=^Y6^yyyyyy^YYA^ua&s=t207743773&tv=2.5.14.85&v=2.5.14.85&e=68a5&r=4686&l=9&c=01&f=002021a1&a=7BE109F9-E265-40DB-885D-AC3553B091B9&n=2014061306&lidate=2014-06-13T10:07:18Z&cv=3 HTTP/1.1


Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: config.tb.ask.com
DNT: 1
Cache-Control: no-cache
Cookie: np=780c22fa; ccsP="tbf=002021a1"; UID=7BE109F9-E265-40DB-885D-AC3553B091B9; si2="7BE109F9-E265-40DB-885D-AC3553B091B9="; anx="os=-&g=-&sn=dfprd1cfgfe22.df.jabodo.com&fv=1402654045655&op=-&lv=1402654045655&td=207743773&si=-&nv=1&v=2.5.14.85&oc=-&t=7BE109F9-E265-40DB-885D-AC3553B091B9&od=none&ob=-&p=^Y6^yyyyyy^YYA^ua&om=-&ok=-"


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:26 GMT
Server: Apache
P3P: CP="CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: np=780c22fa; Domain=.tb.ask.com; Expires=Thu, 06-Jun-2024 06:07:26 GMT; Path=/
Set-Cookie: si=""; Domain=.tb.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: ccsP="tbf=002021a1"; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:26 GMT; Path=/
Set-Cookie: UID=7BE109F9-E265-40DB-885D-AC3553B091B9; Domain=.tb.ask.com; Expires=Thu, 06-Jun-2024 06:07:26 GMT; Path=/
Set-Cookie: si2="7BE109F9-E265-40DB-885D-AC3553B091B9="; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:26 GMT; Path=/
Set-Cookie: anx="os=-&g=-&sn=dfprd1cfgfe22.df.jabodo.com&fv=1402654045655&op=-&lv=1402654046144&td=207743773&si=-&nv=2&v=2.5.14.85&oc=-&t=7BE109F9-E265-40DB-885D-AC3553B091B9&od=none&ob=-&p=^Y6^yyyyyy^YYA^ua&om=-&ok=-"; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:26 GMT; Path=/
Content-Length: 328
Content-Type: text/html;charset=UTF-8
<!-- Config ID: 207743773 (LIVE) -->..<!-- product=Y6 track=Y
YA language=en browserVersion=IE10 userExperience=3 toolbarVersion=205
1485 -->..<html>..[common]..hpwl=.mywebsearch.com,.iwon.com,.
google.com,.yahoo.com,.bing.com,.msn.com,.tb.ask.com..[general]..hmrev
ision=358..maxage=10800..revision=4686..version=3..</html>..HTTP
/1.1 200 OK..Date: Fri, 13 Jun 2014 10:07:26 GMT..Server: Apache..P3P:
 CP="CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OT
C NOI DSP COR"..Set-Cookie: np=780c22fa; Domain=.tb.ask.com; Expires=T
hu, 06-Jun-2024 06:07:26 GMT; Path=/..Set-Cookie: si=""; Domain=.tb.as
k.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: ccsP
="tbf=002021a1"; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Exp
ires=Thu, 06-Jun-2024 06:07:26 GMT; Path=/..Set-Cookie: UID=7BE109F9-E
265-40DB-885D-AC3553B091B9; Domain=.tb.ask.com; Expires=Thu, 06-Jun-20
24 06:07:26 GMT; Path=/..Set-Cookie: si2="7BE109F9-E265-40DB-885D-AC35
53B091B9="; Version=1; Domain=.tb.ask.com; Max-Age=315000000; Expires=
Thu, 06-Jun-2024 06:07:26 GMT; Path=/..Set-Cookie: anx="os=-&g=-&sn=df
prd1cfgfe22.df.jabodo.com&fv=1402654045655&op=-&lv=1402654046144&td=20
7743773&si=-&nv=2&v=2.5.14.85&oc=-&t=7BE109F9-E265-40DB-885D-AC3553B09
1B9&od=none&ob=-&p=^Y6^yyyyyy^YYA^ua&om=-&ok=-"; Version=1; Do
main=.tb.ask.com; Max-Age=315000000; Expires=Thu, 06-Jun-2024 06:07:26
 GMT; Path=/..Content-Length: 328..Content-Type: text/html;charset=UTF
-8..<!-- Config ID: 207743773 (LIVE) -->..<!-- product=Y6
<<< skipped >>>


GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: fromdoctopdf.dl.tb.ask.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:01 GMT
Server: Apache
Accept-Ranges: bytes
ETag: W/"894-1401391120000"
Last-Modified: Thu, 29 May 2014 19:18:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 241
Connection: close
Content-Type: image/x-icon
..........c``.B... )..... ......@!....8..sC0........DX........~.......
([email protected][email protected]...... ..b.....|[email protected].[..0. ..:
.b2.z.-@)..H8...T..._....."...&'.........l.........z..,........10.930.
[email protected]?..7O...4.~.....



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654025397&anxsq=8&optIn=true&searchAssistantOptionIE=true&searchAssistantOptInIE=true&homePageOptionIE=true&homePageOptInIE=true&searchAssistantOptionFF=true&searchAssistantOptInFF=true&homePageOptionFF=true&homePageOptInFF=true&browserInstallOptionIE=false&browserInstallOptInIE=false&browserInstallOptionFF=true&browserInstallOptInFF=true&anxe=InstallerAccepted&anxr=1388818192 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:10 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=&anxu=http://VVV.fromdoctopdf.com/ieEnable.jhtml&anxl=en-US&anxlv=1402654043722&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=3&url=installComplete.jhtml&anxe=PageRedirect&anxr=770063518 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData=v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uxuQWljAedxSdh SiFsGi4P23yvNXpRtTSFfZmYpr4XH5J8v4vQNQAIBJnfgkI3VAHqaPr8h9lCoxE9et3AzVJmWyV4pk3AOByqd9OD6jHdoZtvQs7O1ztS9tljQP93Qn; anxs="s=1366968256&sv=1402654042225&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654045253&nv=17&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=3&apv_177_www06=3; WRUID=0; tbinstalled=false; dlput=YYA


HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:26 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id= HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData=v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uxuQWljAedxSdh SiFsGi4P23yvNXpRtTSFfZmYpr4XH5J8v4vQNQAIBJnfgkI3VAHqaPr8h9lCoxE9et3AzVJmWyV4pk3AOByqd9OD6jHdoZtvQs7O1ztS9tljQP93Qn; anxs="s=1366968256&sv=1402654042225&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654045253&nv=17&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=3&apv_177_www06=3; WRUID=0; tbinstalled=false; dlput=YYA


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:26 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uux6XqsS8mCwPvNZMXJ dz3ZKKzsNoOMSwquLd0HSxtyLepFyEdks9GlSFb6b7wTmkiYeE2iheHz4IhcvVevuVIJpP0tiHmrFLqeDGiU59JBInYi4nu6D0 HwysKBGohieF0lJKgHmoWZvlseWTB5YEUjicQ7NzEHmAkfycXxn HZ0vj89nACj04l8JSGJT9uh8SSh67gOXmpHKJKz6jmnQ=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654046450&nv=18&t=-&v=-&p=-&si=-&sn=dfprdsndlfe11.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:26 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
2002.............}.w.:....9..`.......<..q;i..f..|M.....G.h[.,.Jr...
......v.Ng.....-.... ....,...~y.?........y.......D.(K.6.......#?..u...
$......j.<X[.O...g,p....B./.. .:...a.....>Y.....z....~......  .]
..4.......P...O...W..X7..4.........4..(....h....)s. en....{.... q....:
..q6.......^:..l.....l....$cP....xm...OX6.....A.z,.....x........h.....
g.K..p.....2j..ek......'[email protected]..$.k..=.......,..@.^4^......._...&g
t;[email protected]..;G.....y......u.Z.C...%....L.>mc.9oN. .......[.o......\.
......a......D!.=....3.x.4Ye.l"T......g....g.i0..H..w.,[email protected]
m....(?.6..Q...%m.O..].e..x......S...I..,...r....1..<.N-.1.2.....l.
.j4. .W..........sw...c.A..4.:....RUA.... ......2..QC.._g..]4]Q]O.S.._
P..~..d.5P0.N.KJ....Z.v..........j.X6AQ4.L...9..U.J.2V...w.......l....
l0`55.j...Y.@@...`..1..hBfr.e....x..5....]...........G.5....94.....?..
..z..QZ..C....0}..^`.'8dgY......}[email protected]..}....].4k0....M.7?..&;s'n
....~r.C~...Vv..2X.v.-....,|..........'.6.,...|......&...=j....cOc0.g.
.....Q..7...Di4..h..X....H..y..E.Z..\O....1.V..........`...U.d..`..t.m
...8.....................v.....`...#..........,K.........0...&...(..ip
c....0.........!l.i.....v...q....jM.d...<.G.3.g.....S....{;<..g0
....4S.F.l....}..Fa...Y.n..H.Vb..eu.......hF}..mX....O..n....F..H.....
...u.s..^.=.. .q..9...v...B...z...f.VWK2/.c....4x:vc^WBi.3...o..."..%.
`.<.a.i.r...B.....`(B..v../8=q....(.].W.............E..q......e)|.-
..R......0.S...X.@.|.....%...V...i.d...~qs.!..j...... ]...........2(.v
._...i..}c.a\.&..q.rJ.~O......P.g.IQr....f.z.Vc..........(..$].2.p
<<< skipped >>>


GET /favicon.ico HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:33 GMT
Server: Apache
Accept-Ranges: bytes
ETag: W/"894-1401391120000"
Last-Modified: Thu, 29 May 2014 19:18:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 241
Connection: close
Content-Type: image/x-icon
..........c``.B... )..... ......@!....8..sC0........DX........~.......
([email protected][email protected]...... ..b.....|[email protected].[..0. ..:
.b2.z.-@)..H8...T..._....."...&'.........l.........z..,........10.930.
[email protected]?..7O...4.~.....



GET /images/vicinio/dsp-images/scott.schaffer/asset2/1389111048923.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 07 Jan 2014 16:10:48 GMT
ETag: "6dc121-1ae0-4ef639ea0b377"
Accept-Ranges: bytes
Content-Length: 6880
Cache-Control: max-age=309410901
Expires: Fri, 05 Jan 2024 16:10:48 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR.......^.....C..G....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:F6D9E057205CE3119FA5D062CD2A31F7" xmpMM:DocumentID="xmp.did:32E0
9A6877B611E3A07AD8BC64C1F550" xmpMM:InstanceID="xmp.iid:32E09A6777B611
E3A07AD8BC64C1F550" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:641D6C47AC77E3118D9A
9B4FBB9BB8D7" stRef:documentID="xmp.did:F6D9E057205CE3119FA5D062CD2A31
F7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>........IDATx....|....w.......w.H(.T.*"..OE.X
@.R,.(MDDA|R...)....>)[email protected]........{.=.7..
)!x.........\........JBE[H............%..q..........H...F."i.z...,...l
v.f..[....N|...v"A........b....xe...........s.%. I.......YXP....w=7..C
.F....= U..Gb...._..A|....k...`z..TD.IR..t..}....=B...=t..U....4mb0...
..h$.z._....3...w....J>.H\.1oi..Y..7....... PX.M.x......q....%IY.x.
...H.3.ur..)....@.\......6'w...Q.$.=..(s...3.$'..C...@.$.C.).Ko...bt}.
.......2.L`G...B..K.~}.}<.$IEIR.#.aN....tk\.X. ..a..s....].....
<<< skipped >>>

GET /images/download/runrun/test/rebuttal/Alert.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 24 May 2012 14:59:50 GMT
ETag: "154cb8-bff-4c0c980e38966"
Accept-Ranges: bytes
Content-Length: 3071
Cache-Control: max-age=274129925
Expires: Sun, 22 May 2022 14:59:50 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR...2...,.....'..Z....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:494CC4B8A5A511E19155B5BA
1D593A6F" xmpMM:DocumentID="xmp.did:494CC4B9A5A511E19155B5BA1D593A6F"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:494CC4B6A5A511E191
55B5BA1D593A6F" stRef:documentID="xmp.did:494CC4B7A5A511E19155B5BA1D59
3A6F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>V......sIDATx..Z{l[......I.4....$7~.o'N..4}
@C..X M.4.M.16&.i [email protected]{.P.".?L.g.&M.....=...0:Q....&l.e@K...}...s..
.qZ..F?]..{.=.......r....F..q...A.9.8.x..W.!{...\.F$&...v......km-,...
f.....7....>.HW...5 .F...{O.:......~..l......#.......P.......w5v.T0
..QDW.0...p.B_..>.....3.....".y.cQ~....g0N.>.......?........d.L.
....j7Jl...?.....=...do..^.`..s..)..%....>O"....0.....x..N....`j...
~......T}c-x'nn.~?]/D..s..].0....&.....?.F&G..q%F.......|=..Jwhp...H..
D3x.....y8..Gp..UA...{.t.zc,.g.w....[.?......(..\q...x...~.^;.q....f8.
x.F..H..d.n..>......7)$..YY....-.-.V))a......}.*"A.}...G8uz./1}
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654042240&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=SuccessPopDisplayButton&anxr=468097023 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml?close=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2HeZ6TbjmVBUbWkFvGCiEYAhDgRptlLIlXFkBjJMCo y33cCfCHIZ4TzBgM bjk11tGR54TrvXB1 Xfv2KO0d7WlK3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxeVh9iUDi 6MbKN/VlsvVmr6MdhiR ts3I xHVXBH7BogVvowqo2tM9gAL5aqIdBu5ikLdboZrOf AJ9JM7xpZdHSUdNflqpoe3zUzSwOvRJ98o/MevqZSv l8hLzICOEQ7bSLvwgPBy H5GpbxDpvrnpWOwlQe8abXDxNvxpVa3CDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFWkVUjXj4NFLpt9zwThtnQZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anxs="s=486774368&sv=1402654016035&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654043722&nv=16&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.ja
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:24 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654070874&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&present=false&anxe=ToolbarDetect&anxr=1152182241 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=062329B0-5521-4737-A396-00ACFB474D4F; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=; successUrl=hXXp://VVV.fromdoctopdf.com/installComplete.jhtml; defaultSearchOption=true; defaultSearch=true; homePageOption=true; homePage=true; sessionData="b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9 QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJev
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:51 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /images/vicinio/dsp-images/207743773/asset1/1395069199615.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 17 Mar 2014 15:13:21 GMT
ETag: "5cd9b-2123b-4f4cedc33f9a6"
Accept-Ranges: bytes
Content-Length: 135739
Cache-Control: max-age=311966067
Expires: Thu, 14 Mar 2024 15:13:21 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:27 GMT
Connection: keep-alive
.PNG........IHDR.............u.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFt3WcYXhOFexyfAMpUpKGs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: evsecure-ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Thu, 12 Jun 2014 10:26:57 GMT
Expires: Thu, 19 Jun 2014 10:26:57 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1895
Cache-Control: max-age=519664, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:00 GMT
Connection: keep-alive
0..c......\0..X.. .....0.....I0..E0...........0..1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Sym
antec Class 3 PCA - G5 OCSP Responder Certificate 2..20140612102657Z0s
0q0I0... ...................B.>.I.$&.....e......0..C9...313..[wY...
.^.'.2.)(k....20140612102657Z....20140619102657Z0...*.H.............o.
.^IA/<]E;....;v;bQ*..... S..I>/.(Q^.....,........<~..p.M...q.
....l...Ll..^...,...`..|....r...R#...4.......;.......~......... j.,@..
.... .Z......c},..O=..U.QH...>......F...x.._.....m.....b.Y~...2....
..a.[F..o.yR.y..R.r.F.?V.I3.87r...x_n.-.7.5.h...79...7bq....0...0...0.
.........U..3....2.......0...*.H........0..1.0...U....US1.0...U....Ver
iSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSi
gn, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publi
c Primary Certification Authority - G50...131112000000Z..141212235959Z
0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tru
st Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certific
ate 20.."0...*.H.............0.........2...#.522.K.....G.....]........
.5......1.mW.....k....zz.5.....ts.o..v.....QtN.W.zO....t....B...:.....
..GVd.'=...........6.Lg../......`.. .U..V ...6......Y....e.)....o.....
_.b.....1......[.<.j.hT3..f......vJ>...Q.7....U...W3....i!...hu.
JK...`.L...S..@.~N...........0...0...U.......0.0l..U. .e0c0a..`.H...E.
...0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://ww
w.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRFp9TUB3UaX73tHhkdSo3sUtJBVQQU/IpQup65JVp7VYVPlQBjj+lYa0MCEFUtiDipO/Hsoj7MGX5O054= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: evsecure-ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Wed, 11 Jun 2014 10:13:33 GMT
Expires: Wed, 18 Jun 2014 10:13:33 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1984
Cache-Control: max-age=432472, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:00 GMT
Connection: keep-alive
0..........0..... .....0......0...0..W........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of 
use at hXXps://VVV.verisign.com/rpa (c)061@0>..U...7VeriSign Class 
3 Extended Validation SSL OCSP Responder..20140611101333Z0s0q0I0... ..
......E....u._.....J..R.AU....P...%Z{U.O..c..XkC..U-.8.;...>..~N...
...20140611101333Z....20140618101333Z0...*.H...............p..........
s..e.......n...`7.uAU..A.b.|..g.%.2...F....D..b.>6..|q. S;.*..^.GA.
..*j/,.....D..m ..._?E.^..=.....[i.GS...=..] 3 ..IQ.....K~$X..w#I....&
w.C...g..#".C`<N8. O...3Y.X7B...a..o..E.G.5....e.H....>O.E..M7%4
S1-...1=..x.L.........L.....=b......[.R...... 0..'0..#0..........Z....
~d.;.G..Z%o0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0
...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.v
erisign.com/rpa (c)061402..U... VeriSign Class 3 Extended Validation S
SL CA0...140608000000Z..140906235959Z0..1.0...U....US1.0...U....VeriSi
gn, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at ht
tps://VVV.verisign.com/rpa (c)061@0>..U...7VeriSign Class 3 Extende
d Validation SSL OCSP Responder0.."0...*.H.............0.........%.=Kh
..P..r.X.]...ytu..L..-r.s......J...E3C.....!.\.w-.P........gEF..M.....
1...,...Y""x9{D..UOZ.z..>}......~tC.....~...........n........9...G.
T..dwP....2_ .mx.w.}V|.Cq1...z.t1.X..u7.'.?.,.v....:....8.B.....2..T.w
..].$.J...~I..c1.......J.S...$.......lD.qv..........0...0...U....0.0..
..U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
<<< skipped >>>


GET /images/vicinio/dsp-images/lisa.delmar/asset3/1395430291650.png HTTP/1.1
Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 21 Mar 2014 19:31:30 GMT
ETag: "c5c94c-384f-4f522eecbab1c"
Accept-Ranges: bytes
Content-Length: 14415
Cache-Control: max-age=308548539
Expires: Mon, 18 Mar 2024 19:31:30 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:48 GMT
Connection: keep-alive
.PNG........IHDR... ...F.....45......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:EEDFF4AA302068118083CF9F6CF47C99" xmpMM:DocumentID="xmp.did:C259
FD41764611E3AD6DE92B10AFB3D2" xmpMM:InstanceID="xmp.iid:C259FD40764611
E3AD6DE92B10AFB3D2" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EEDFF4AA3020681180
83CF9F6CF47C99" stRef:documentID="xmp.did:EEDFF4AA302068118083CF9F6CF4
7C99"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.\ER..4}IDATx....`TU....Kf.{.$.P#..((E...(J
....*..gY...m.Q......"6P@qEz.$.R!...$..;......P..|?=d..3w.)s..?.w..-[.
.m....,Mf..K...A..A..At.;K.,.f.-..Z.T.x.fi.K..2d.<........... .. ..
 ...v.5..HTTP/1.1 200 OK..Server: Apache..Last-Modified: Fri, 21 Mar 2
014 19:31:30 GMT..ETag: "c5c94c-384f-4f522eecbab1c"..Accept-Ranges: by
tes..Content-Length: 14415..Cache-Control: max-age=308548539..Expires:
 Mon, 18 Mar 2024 19:31:30 GMT..Content-Type: image/png..Date: Fri, 13
 Jun 2014 10:07:48 GMT..Connection: keep-alive...PNG........IHDR..
<<< skipped >>>


GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654055518&anxsq=6&optIn=true&anxe=InstallerAccepted&anxr=50009494 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC/W3P6BiN7UNQvxSEYvjBPqbPBnTRQi9Cz8bAxA7zAjFQjWLYKchJ1IK6SXNaAbo4SDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ8bb WIQacDwE6edhzm0Y0yENn8mzq2e1pgzNIqzb9unQClScKoNppnC8bgT1iDTd/MhDr09QEfWObUIULksUVEWNjncEhtooMaPVCsVISOMZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654053947&nv=7&t=-&v=-&p=-&si=-&sn=dfprdsndlfe12.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyy
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



POST /mirrorCookies.jhtml HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
Connection: keep-alive
Content-Length: 706
Cache-Control: max-age=0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: hXXp://VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654070067&xp=&xrt=&xt=&nv=1&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe4.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="

sessionData=,,-1,false,1,"KUDvVVAQLxDyVTTFzN4rcCwpMhvhfvV8Mqp6752LwC2X/zsVqvYOPkJYtkbuWdd3xuQWljAedxSdh+SiFsGi4L0xKKYtjSSNfJw50jjYZQL5J8v4vQNQAIBJnfgkI3VAF7rdxM5BN2XUK05w6xLTztd//C4QT0cjief49K3MHMoS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx+RZ3yRmlYEAgWO3AM0ewUvlIm5VajI++48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG+GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5+FVq0pHaSnmXsW6fb3bVQf+D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="&dlput=,,-1,false,1,YYA
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:50 GMT
Server: Apache
Set-Cookie: dlput=YYA; Version=1; Domain=fromdoctopdf.dl.tb.ask.com; Max-Age=2592000; Expires=Sun, 13-Jul-2014 10:07:50 GMT; Path=""
Set-Cookie: sessionData="KUDvVVAQLxDyVTTFzN4rcCwpMhvhfvV8Mqp6752LwC2X/zsVqvYOPkJYtkbuWdd3xuQWljAedxSdh SiFsGi4L0xKKYtjSSNfJw50jjYZQL5J8v4vQNQAIBJnfgkI3VAF7rdxM5BN2XUK05w6xLTztd//C4QT0cjief49K3MHMoS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; Version=1; Domain=fromdoctopdf.dl.tb.ask.com; Max-Age=2592000; Expires=Sun, 13-Jul-2014 10:07:50 GMT; Path=""
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654070495&xp=&xrt=&xt=&nv=2&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe3.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="; Version=1; Domain=.tb.ask.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:50 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 93
Connection: close
Content-Type: text/html
..........-.A..0...Rr.....im.B.....W..0...>4s..2.....I...w.3..<.
a.&....TqP.....]..x.7...KX.....
<<< skipped >>>


GET /www06/ptc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cdn.clicktale.net
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:06:59 GMT
Server: PWS/8.0.25
X-Px: ht h0-s1055.p11-fra.cdngp.net
Cache-Control: public, max-age=300
Content-Length: 2494
Content-Type: text/javascript; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 06 Jun 2014 11:05:18 GMT
Connection: keep-alive
.............R.H.7...f..E.mY....m*1d..d...\..\B.....;.......gF_6&....]
D.-.t..t....n.~2..p<..cY;..eo.~...N...7<0.....{.....8....#......
[email protected]?#/....._L.v>cl>.|.....S..t...0.z..Pf..![.8..0..
....|.Q.!....?.G..7...}....)G..!U.. .`...S~.1x.... ..,[email protected]
..LF...S.}.._..Ds].\3......f.$.k..F.....h.......4$.......?.x.....p]zC.
t|x;.%.*.t......Io....q...Q.{.#3...'.Z8.s,GH....h......A......O.z68.'W
.$..........F{.R .!.]H.0.....Y.x...f..x.. ...L.15..[......<.j..8.[.
......X.....$....d.._..,#.D..v...PO.......O~y{z.....%.....E.......]..L
i.......;n(.....=q.ZIb [email protected]...*..N..L,.b..(.:..m......m.....
s@3#.....6..*.......J.7....N|..x.%....."[..5..e..g7}E;.?..`.x.....6$..
ed.W.!!..ezR3...\..>[email protected].. .......Sb{|8......4...}...E...,...
..W...N...xwM.....G.H\qf.4K'h.r.*.MboK.,#....b 0.J....BVk.["Y.*,.~1-08
.r......:..p.!.!#....0%.5<@$9.#..S.G.iq6.K'....O.....)'...-Noy.....
.[?.m......X`.....{w7.x?....0..{....X;.Y0.T......g.....&.1..e..;{.O.. 
K..m......*.lAH...(.j..._OO.O.T.o&.?....\>.w..V...._.#u.Q|L_.O=.D..
YVgWB.g....X..dg?...*/.k).sR.#-b..&I.....i....q......I..OMx..fL9...^.X
...2.....I.q..t....8)1.2.W.k........1s...5.BF....|<%:5*.Qs...uA2m..
rE..........Q..(Ry...Q.8f..]..c..@B2. @.4.W..f`J.%[....L......Y..a.n..
..:..'Bg'....`/....}..=..<7...'[email protected]..,w*'.
c...f)e-%.2e.}.&.D.=.I....HO....XR..!.S.'aJxB.!r|.7J..}H7..K.....C12.@
.|.m....zQ4Tg..<..i.F.(.&r....C.LJ.a>.\.....$dXD.....RA7..9\.K!.
..V. .4.TI.H@.&|.O.$7....s.........)...m....^.hT...!....|\.e.. .S.
<<< skipped >>>

GET /www06/pcc/6eab298c-6a72-4fcd-aab0-85ea18b19c79.js?DeploymentConfigName=Release_29012014&Version=3 HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cdn.clicktale.net
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:00 GMT
Server: PWS/8.0.25
X-Px: ht h0-s1055.p11-fra.cdngp.net
Cache-Control: public, max-age=86400
Content-Length: 12056
Content-Type: text/javascript; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 06 Jun 2014 13:31:18 GMT
Connection: keep-alive
...........}...F....U.......5..H6k!\.G...6C.|.I..<.cKF.......<.%
Y.....[.nm...q.....n.....n.8>....."=....n......]..<..^...zV.....
.z..IVZ/.,N.S.............$K.h.[y...9... }........<..._=..=Q...{..@
.u.~......(o.;..,*.<...i...<.<..i.%.k}...........,n..%..=.'..
.e....M.q.B7hc..OQ....j[....u..Z8.....)..<.........Y.]..U.'e.D.....
ITv.E^...2..:.&V............%....u.p.J<k.....5..*.w..>.?..(:~..3
.}.....s.o....;...c..f..YB..g...?.7.;n..5?..8.b.p.f4....F........?..i.
5........E....<.*FX.....uF.[.....p...X.2..{..(&at......4.QY.g..EL%.
...q.......7.....Qz.........9....-.F..a.(0.Ww....-."[email protected]
(I..y...zZ..9...L>.JI....e.Q.2.R....e....#.h..aT&..,.cf......F.....
...|..HE.......h&......%....S(s.....m...m......''.>...^?>x...i..
.$...`./..-`......W..i...ix...D.e.....^.......2T.~.wF..A...A....@.....
`'.[......|^.<....*"[email protected]@....g...}'...k..5
.G... ..Q4K.1.,.*y.d.<...O......\.....P.v...O,./_..p8R.n}Z..b4.X...
[email protected]..'......F...5.gM.U..I....|.Y...[.Iy^d.0.i
g(....<.\[email protected]^X.B..L..........X.Zeg...Q...;...<...?;c...h..
..............7.........5. ...6.}:.'...@,./i.i.q.`.p.J..B.i&Wc......{.
xF...D.N..Z.f]...Yv..(F."[email protected]|.O....y.#(.h........l.S....H
.%........n.4)_..x...N..{..........h.C..`@t.....t..9..]..........<D
i......$...}..x.;i.".&U...L.,.......H...Ux.d.1../......<...<4...
x........h.W.].....qg.d.hV..s..~(.).W^,.y.................;..........)
.|Z.@|...U..N...Vq...%.....K.s....Y...'..!(.....='...{..e.*.......
<<< skipped >>>

GET /www/tc/WRe12.js HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cdn.clicktale.net
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:00 GMT
Server: PWS/8.0.25
X-Px: ht h0-s1055.p11-fra.cdngp.net
ETag: "8053a3507646cf1:6a12"
Cache-Control: max-age=604800
Expires: Sat, 14 Jun 2014 05:19:44 GMT
Age: 535636
Content-Length: 8835
Content-Type: application/x-javascript
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Sun, 23 Mar 2014 09:00:19 GMT
Connection: keep-alive
...........|ks.8.....4...9bh.I.A..r.H<.c....G.IA$DQ.H...xd...../.r.
...fF".4..~........ ..{...0...5..yt...p...3...;.j7.7,.(9...4.'......|.
........g... ...<.5.y....yA......>.....z...C3..`...2.......:..r.
G.8....b.w.5C.......`...,):..Y...9....S....`..S.F.p|..dg,..W......U...
..I...G?......{...._....I..l.)....R5..Q..&..#8.k.:.._........#~.#.g...
.a..3..0.Xt...*.gB...WU.e..mU|W.O......{.\...>....W.~.}.....OIG...Q
...E..A...X.N2 .,u'......u{...........O.f70(...VQS.a1....M.i2 ...O....
....(...G]<....N...$.n.z<%&Ae.....:....m.4.....G._...7k...i..Z.i
A....b..\...x.... ..@..,"[email protected]...#.......R/H.......<NZ...,.. B
.'\K....B.G.1..M...zQ;.......$5..P.z/..T.......b.........\..$.G.Q.=.X(
..8....(H8......s..y..g..b.F.U..N...O......./.QF..'.nk...#1..$<ey..
K...B........D<.?._.E~.._..I...lwj`47.."V.... $....4r..X.ytt~&..Z..
..y..~...G\..Y...x.G9....l1`.#jSx.c..{.T...o .T<O....i.V..ua..%%.G|
...y....oY...]..........u..........`...E>.%...'Af.. .A.A{.y...k....
.S.ya.o.N=}[email protected]>..N...G*...:.lP.<...`d.k.e.
.E.i.m.RoB...%..gr..U...3..,......4.Ng....a..........v8......x%\._. z.
|a.`...d....H .C2lL.d......m.).%....mUC..|..,......^dA..YP.]9V...]2t.q
.#M..s&..J....5...j^..dX..R| Y./.nm<...&&].7R..t..e(t I.<v..R5.b
<>6....k5W/....U...W.A.o...............Q..b...Lc..S..9.."-....[.
.B.0b.L.r .Ni..c.i..,...g.....Bj.6}...E..Z....Z.X.1....T#........%....
.x.].d..u....w. ....9#M}cYaya.....C.......DG%..M'].....[.'@..`.r.>h
}.T...........A..w..%..S...`......HS...(..3..t.b.l.$.....m...&k..h
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de5524d4290fb763 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 05 Dec 2013 22:47:50 GMT
If-None-Match: "0af536cf2ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 05 Dec 2013 22:47:50 GMT
ETag: "0af536cf2ce1:0"
Cache-Control: max-age=86400
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 05 Dec 2013 22:47:50 GMT..ETag: "0af536cf2ce1:0"..Cac
he-Control: max-age=86400..Date: Fri, 13 Jun 2014 10:06:59 GMT..Connec
tion: keep-alive..



POST /tr.gif?anxa=CAPToolbar&&anxpt=windows&anxpv=2,6,1 HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (Compatible; FromDocToPDF_65)
Host: bstat.tb.ask.com
Content-Length: 244
DNT: 1
Cache-Control: no-cache
Cookie: np=780c22fa; ccsP="tbf=002021a1"; UID=7BE109F9-E265-40DB-885D-AC3553B091B9; si2="7BE109F9-E265-40DB-885D-AC3553B091B9="; anx="os=-&g=-&sn=dfprd1cfgfe22.df.jabodo.com&fv=1402654045655&op=-&lv=1402654046144&td=207743773&si=-&nv=2&v=2.5.14.85&oc=-&t=7BE109F9-E265-40DB-885D-AC3553B091B9&od=none&ob=-&p=^Y6^yyyyyy^YYA^ua&om=-&ok=-"

now=539ACD5F&00000001_5=1_539ACD58&00000001_6=1_539ACD58&00000000_7=1_539ACD58&00000000_2713=1_539ACD58&0000000A_2713=1_539ACD58&00000014_2713=1_539ACD58&0000001E_2713=1_539ACD58&000A0000_8=1_539ACD5C&1D000100_A=1_539ACD5C&000A0000_9=3_539ACD5F
HTTP/1.1 204 No Content
Server: nginx/1.0.1
Date: Fri, 13 Jun 2014 10:07:28 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



GET /localStorage.jhtml?toolbarData={"toolbarId":"5864BD4E-284B-4517-9409-6B6363B179CD","partnerId":"^Y6^foxyyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"XPI","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^foxyyy^YYA^ua&coId=027382d5aeee4be8a36350dfd4a6412c&cake_id=&offer_id=","successUrl":"http://VVV.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"} HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMs
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
Set-Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654054768&xn=&xrm=&xtp=&xct=&xs=&lv=1402654055969&xp=&xrt=&xt=&nv=2&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="; Version=1; Domain=.tb.ask.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:35 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Content-Length: 460
Connection: close
Content-Type: text/html;charset=UTF-8
..........eR]o.0.}........ _..].i.>.....4^....I..F.M!....@4`...s..&
gt;.>QF....}...f.... n....iL.jf.,.J.Y.y)a?.JLQ).1...B..Y.VFD.'....#
.L..7.-BT..Kn..../.. .n.d...ep?.g.b.L..h...Q....x.M.wK6d..T.Q......m.n
7./....u..J...5q...`....7...g...x...PQ..aI7p....)o...k..[~A.....f&....
...{P?.2@FT.:N...(. ..R....~...N... .....>....{[email protected]..?..|9...$0.fx.
W.2.a..b . <.2.`...N.V...u}al......,.aQ) 8z.F.....Xa..>..W(.Z.j3
G..Z....,.lh}]?|.k.y......ysczD.1@]..>.Q..=........I........



GET /images/download/ask/browsers_0927.png HTTP/1.1
Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 23 Sep 2013 16:14:08 GMT
ETag: "113791-1415-4e70f4f57f7c1"
Accept-Ranges: bytes
Content-Length: 5141
Cache-Control: max-age=314993402
Expires: Thu, 21 Sep 2023 16:14:08 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR...O...,.....$T.r....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..[..T....V{uU.J.t.Jw#. Kp..........h.h.Kf&..':...C.....h4
.c..0*[email protected]......}....Q...`...='.=............[...:...V.."..E.?.
...eD...Bt).v...6.UD.D6....e.;...a...1.........._..Q..~..8.s..a!:....&
gt;...O.<.G.Q.....~......g.o:.......2....i...6. ....{....k...$....e
.g.....;..9.l_..W^....>.A.46Q[[..X.".....Z.J/)).s......P}....<.u
..=...d...9a..c>6......k{.hc...i....v...3..../......|?p....6[..9s.M
d5/ ........3.7D..h.'.Y...1>;.-[.....r................v.1`~~.~...O.
X..l..=r.H..8q.>z.h...dV....k.eeezkk.~...c\.c.t.Rc...SO=......$..7W
x.?.x.w555.0.={..|&.e....L o...1VVP...c0...........45S.<...Sb..v...
..G.yD..........;|.p...]..O.-../......Y...2A...o.x...0X.5.\..x....7 ..
. W.4.b.g7.5q..b.g...>..c..7.|.9.c<..ll6.....k^.Ta.........../..
G.}.....<V.v....c..!...)S.p8..X,f....3..S.....$,.}.................
.,8..tHF.p.B..?.t(.............i.&....$(...{X.z5H.>u>...F.......
....y...X.v......q.M7......j...Wc.W_}....[.2g......w/......}..........
C.E..C.4l...O<.D.5.. ..."c.w.q.!`UU1{............*..cf....,..:3s..&
lt;.c...f....l....t.9.....>..Z.../_n<3..5[...............Y.5...@
..1..>....Md.j./..Y!..u..>.....&.|....GWW.....H...]L.......o..3.
.9....5c......C.2.....S../.~b.....n..........J0.{....L...^.5...l..._..
)3..sd:.s}...t1.m...g.x.b..(w....L.o.p....\I]........z.D;....;...56."e
.f.QNhH.f..*.....\yn.v..H..&U...<.y8...,k3....gv Ph)....(.`.p.f?..9
....Pb.........d.QY.A_BG...]Q.....Y. ..3Ij.k....XW..IX..x...9.LY..
<<< skipped >>>

GET /images/download/ask/pba_0927.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 23 Sep 2013 16:06:07 GMT
ETag: "113790-dd6-4e70f32b009c4"
Accept-Ranges: bytes
Content-Length: 3542
Cache-Control: max-age=315354163
Expires: Thu, 21 Sep 2023 16:06:07 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR....... .......P.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...xIDATx..\.TT....A.......b..k.#..hb..R..... -...k..t.Y....L..KrUv
...k.%|.c.^..@ h..G.<..a........a..0..v..~..{......_..T. .B..(.@!"W
.....|.8.;$m...!W.vV)..?.....S.......A..U/.F... ...5...Cw....)r.....$.
"..7......A.....g.....h..FA.:nF.F..9..q]&...jkka...PYi9.......NE..]R0(
@[email protected]. .........Bbb".....BCC..7...#F..e..i.
.3......;GN.\[email protected].....
..e\*......`.....c~.f.W....=..............k..{][email protected]
..>y.d.../.... ^C..>[email protected]..[.o.....~.4....n.._......)Y..
|$.H..^.Z.#8].....ju..... p....w.3.u.%.k3.W...?a..BLL.dee..Y.f..M.`..-
.~...HJJ.U.1..............o|.....n....s.]...#"....Z..t...wO....j......
..\f'..7.....K.,......N.E.@Q.]Q.!..p.R...}....A..>..O........;.....
7h.z.s#.@.`...H4xO....../5;;....=8p..I.Q. ..X..a;...J.A.?.*WWP{...D...
...b........&.jJObu.......}..%.... ./....c..0..R.6m..w..r....Z.....$..
\..e... t........)...3....Ik.zw....h#.I.P......l.vr.;^!. ...6.n9 p....
.i...O...;.v..<-@(6I.R5n.Y...044:.. .....*@.C...s1V....|..Mg..YL.t.
.u.~`..Ahm...(.Z0...U.3..j....l;T<..#....mx.R..$B............,.~.vT
.z...|:.|.H..A........l.<....}..P....oA...._.B..c....Dp...1*Th....O
."...d...lk,.............xy......X....n[....Z-...U9..W..$B...c....p.A.
2X.....N|..3.@=..}...".t?.C....s.(..v=.....{.I......}ee..m..J........"
4...-.....h:...|.}.....7...W..&X.. .....Q.R..6d.EX.m.........1........
...VB..S...Q.4P....Hl....`u.$R.,...g$..V...p.M....j.5....6.g..BqO.
<<< skipped >>>


GET /images/vicinio/dsp-images/jason.pepping/background/1384380910009.png HTTP/1.1
Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 22:15:10 GMT
ETag: "127108-3f6-4eb164c61c8b7"
Accept-Ranges: bytes
Content-Length: 1014
Cache-Control: max-age=297499158
Expires: Sat, 11 Nov 2023 22:15:10 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:48 GMT
Connection: keep-alive
.PNG........IHDR....... .....mo......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:E4A251F4555EE2118EE3C5B57A67443E" xmpMM:DocumentID="xmp.did:960B
E3D22AD911E3A077B6E01DD9B7E5" xmpMM:InstanceID="xmp.iid:960BE3D12AD911
E3A077B6E01DD9B7E5" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A7B1D6E4220681180
83A29412ECA1E7" stRef:documentID="xmp.did:E4A251F4555EE2118EE3C5B57A67
443E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>]Y.G...$IDATx...1.........9A.*.....J.......
.B...A.......IEND.B`.HTTP/1.1 200 OK..Server: Apache..Last-Modified: W
ed, 13 Nov 2013 22:15:10 GMT..ETag: "127108-3f6-4eb164c61c8b7"..Accept
-Ranges: bytes..Content-Length: 1014..Cache-Control: max-age=297499158
..Expires: Sat, 11 Nov 2023 22:15:10 GMT..Content-Type: image/png..Dat
e: Fri, 13 Jun 2014 10:07:48 GMT..Connection: keep-alive...PNG........
IHDR....... .....mo......tEXtSoftware.Adobe ImageReadyq.e<...hiTXtX
ML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSz
<<< skipped >>>


GET /tr.gif?anxa=CAPNative&anxv=8.27.3.62724&anxe=DialogView&anxt=49F19948-7BCF-4240-BFE9-02783025B89B&anxtv=8.27.3.62724&anxp=^Y6^chryyy^YYA^ua&anxsi=&anxd=2014-05-09T23:34:48.995Z&f=00400000&anxr=82084862&dialogType=MODAL&anxs=RestartPromptAfterInstall HTTP/1.1
Host: live.tb.ask.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654073893&xp=&xrt=&xt=&nv=3&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="


HTTP/1.1 204 No Content
Server: nginx/1.0.1
Date: Fri, 13 Jun 2014 10:08:04 GMT
Connection: close
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: max-age=0



GET /ieEnable.jhtml?successurl=installComplete.jhtml HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654036929&nv=12&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=1&apv_177_www06=1; WRUID=0; tbinstalled=false; dlput=YYA


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:21 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData=v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uxuQWljAedxSdh SiFsGi4P23yvNXpRtTSFfZmYpr4XH5J8v4vQNQAIBJnfgkI3VAHqaPr8h9lCoxE9et3AzVJmWyV4pk3AOByqd9OD6jHdoZtvQs7O1ztS9tljQP93Qn; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654041407&nv=13&t=-&v=-&p=-&si=-&sn=dfprdsndlfe30.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=d14aab68382e45789266ab469fa4607c&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:21 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
2002.............}.v.F..o...C.....].BgdI....X..g......4E. .......}..h.
InU..n,..8.$G..E...........}W....G.........I.N.>{yr.*.v..k.........
.W/Y..a..3.....N.n..\a.q..v.......Z ....o........fb.ly.Wy.....$....<
;[email protected]..>.|.H.R@ ......q|p.TC..W....Yi._..e.r.N.
>M..73^a.x.W.~....=...(.I...us{{c.....'<q,..l.=h........Dzr.?...
'.'.[..^.....=....B7u&._..a....i.O=~.`.0..................0..N..._..8.
...x.,.ql......7>....'m..a.....h.D..t.uf.{....<.za~.......]...w.
.{..K....`1(\3..?..[......w0u.a.tVf.P......K.. W...w.6......1g...Wk..N
.....1}.e.|......,T..4..p'R.....R.{V.i8.:Kd".,...T4(..... C...G2!... .
j^....y|.q.Fi$..N1J..!...............f^..a...........h3...w...&.....Sv
....%.....X....E.....j.hk..K4.X.].........^Q.3.."*I......0p...0...HK..
t...^k..a...D1..3S..v....<I.iJ.........90h.W.HtS...a.v.P..X..p..<
;Y......!A..P..3..<...qR.....m.8...-........=GS..."..._p-!.OQm...?.
'...>..$.w..n..1Y.......L..]..?$=U...K..B...ZS...y......!.%n..lC..&
j..p.._...._MjtP.;......(q.IV.....G.C.(........g..h.. p..v.'3l~3.f0...
n0....b.0...t&.0..r..g5'..:.......X|..g./..... ...$...\XqS..~.....<
..Q...~..B....=.}3'.i=..a./[email protected]...........(......fc.....OnX..
YW...vYkC~.....F7i$.y.#...Ri......T..}#..X..u.=....c.a.:... ...?.K@]..
K..-4N..q.45}..........R....c....<;.0...:d..5mjY|.4.L......U....|..
._b'`ei..........  -4...)9nx...>..L4..J.3..O1.....k...C3.6..|..x1..
~-F..W..Y\.M.............$.P*.....}/Fo.8......3..N...... .!<&......
(.m.V.........._`......g..i^.Z|..g..{.[2]..0..O{.."0.-...=:...QE..
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=&anxu=http://VVV.fromdoctopdf.com/ieEnable.jhtml&anxl=en-US&anxlv=1402654041710&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=ieEnableLanding&anxr=548041706 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData=v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uxuQWljAedxSdh SiFsGi4P23yvNXpRtTSFfZmYpr4XH5J8v4vQNQAIBJnfgkI3VAHqaPr8h9lCoxE9et3AzVJmWyV4pk3AOByqd9OD6jHdoZtvQs7O1ztS9tljQP93Qn; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654042240&nv=14&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=3&apv_177_www06=3; WRUID=0; tbinstalled=false; dlput=YYA; anxs="s=1366968256&sv=1402654042225&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"


HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:26 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe5.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/installComplete.jhtml&anxl=en-US&anxlv=1402654046478&anxrd=VVV.fromdoctopdf.com&anxrp=ieEnable.jhtml&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=2&anxe=installCompleteLanding&anxr=1109513793 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: cookieEnabled=true; sessionData="v2qyhD9Kbja5FFXr etTBzBmVA3mXGiyi6XQf1bPExSctMi06LdUu3N6LpVeFD3uN78x9/KXKSGcZQ3R33thSkapz sdnvyIiXOCvTH0Uc40eyuIMcAU/0D4IoaooC7fxuQWljAedxSdh SiFsGi4EcXSEqqaa6dTvPwkdn9fPoZtvQs7O1ztS9tljQP93Qn"; anxs="s=1366968256&sv=1402654042225&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654047319&nv=20&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=d14aab68382e45789266ab469fa4607c&xuer=3&xx=install"; __CT_Data=gpv=4&apv_177_www06=4; WRUID=0; tbinstalled=false; dlput=YYA


HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:28 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /px?u=Cy&rtv=convertor&ct=ffd59f4f6ea2c23b&ctval1=[CONVERSION TYPE] HTTP/1.1
Host: a.triggit.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 302 Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"
X-From: uk-bidder-02
Set-Cookie: trgu=eNmeqXK8SOqWhSmhWKrBDQ; domain=.triggit.com; path=/; expires=Mon, 13-Jun-2016 00:00:00 GMT
Set-Cookie: trgs=4003055552; domain=.triggit.com; path=/;
Set-Cookie: trgp=; domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT
Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=triggit1&cb=qbaf3c&google_hm=ZU5tZXFYSzhTT3FXaFNtaFdLckJEUQ==
Date: Fri, 13 Jun 2014 10:08:04 GMT
Content-Length: 11
Content-Type: text/html; charset=ISO-8859-1
RedirectingHTTP/1.1 302 Found..Cache-Control: private, no-cache, no-st
ore, must-revalidate..Expires: Sat, 01 Jan 2000 00:00:00 GMT..Pragma: 
no-cache..P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"..X-From: uk-bidder-0
2..Set-Cookie: trgu=eNmeqXK8SOqWhSmhWKrBDQ; domain=.triggit.com; path=
/; expires=Mon, 13-Jun-2016 00:00:00 GMT..Set-Cookie: trgs=4003055552;
 domain=.triggit.com; path=/;..Set-Cookie: trgp=; domain=.triggit.com;
 path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT..Location: hXXp://cm.g.
doubleclick.net/pixel?google_nid=triggit1&cb=qbaf3c&google_hm=ZU5tZXFY
SzhTT3FXaFNtaFdLckJEUQ==..Date: Fri, 13 Jun 2014 10:08:04 GMT..Con
tent-Length: 11..Content-Type: text/html; charset=ISO-8859-1..Redirect
ing....


GET /pxgcm?id=&cb=qbaf3c HTTP/1.1


Host: a.triggit.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: trgu=eNmeqXK8SOqWhSmhWKrBDQ; trgs=4003055552; trgp=


HTTP/1.1 302 Found
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"
X-From: uk-bidder-02
Set-Cookie: trgp=GIWb65wF; domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT
Location: hXXp://VVV.facebook.com/fr/u.php?p=185501061579159&m=eNmeqXK8SOqWhSmhWKrBDQ&t=2592000&cb=vxrmwm
Date: Fri, 13 Jun 2014 10:08:05 GMT
Content-Length: 11
Content-Type: text/html; charset=ISO-8859-1
RedirectingHTTP/1.1 302 Found..Cache-Control: private, no-cache, no-st
ore, must-revalidate..Expires: Sat, 01 Jan 2000 00:00:00 GMT..Pragma: 
no-cache..P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"..X-From: uk-bidder-0
2..Set-Cookie: trgp=GIWb65wF; domain=.triggit.com; path=/; expires=Fri
, 18-Jul-2014 00:00:00 GMT..Location: hXXp://VVV.facebook.com/fr/u.php
?p=185501061579159&m=eNmeqXK8SOqWhSmhWKrBDQ&t=2592000&cb=vxrmwm..Date:
 Fri, 13 Jun 2014 10:08:05 GMT..Content-Length: 11..Content-Type: text
/html; charset=ISO-8859-1..Redirecting....


GET /pxfbcm?s=miss HTTP/1.1


Host: a.triggit.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: trgu=eNmeqXK8SOqWhSmhWKrBDQ; trgs=4003055552; trgp=GIWb65wF


HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
P3P: CP="DEVo PSDo OUR BUS DSP ALL COR"
X-From: uk-bidder-02
Set-Cookie: trgp=GIWb65wFSIWb65wFUAA=; domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT
Content-Type: image/gif
Date: Fri, 13 Jun 2014 10:08:05 GMT
Content-Length: 43
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, no-cache, no-store, must-revalidate..Expires: Sat, 01 Ja
n 2000 00:00:00 GMT..Pragma: no-cache..P3P: CP="DEVo PSDo OUR BUS DSP 
ALL COR"..X-From: uk-bidder-02..Set-Cookie: trgp=GIWb65wFSIWb65wFUAA=;
 domain=.triggit.com; path=/; expires=Fri, 18-Jul-2014 00:00:00 GMT..C
ontent-Type: image/gif..Date: Fri, 13 Jun 2014 10:08:05 GMT..Content-L
ength: 43..GIF89a.............!.......,...........L..;..



GET /images/vicinio/dsp-images/jason.pepping/asset2/1384380963413.gif HTTP/1.1
Host: ak.imgfarm.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 22:16:03 GMT
ETag: "b252d1-3591-4eb164f904070"
Accept-Ranges: bytes
Content-Length: 13713
Cache-Control: max-age=297523594
Expires: Sat, 11 Nov 2023 22:16:03 GMT
Content-Type: image/gif
Date: Fri, 13 Jun 2014 10:07:48 GMT
Connection: keep-alive
GIF89a..^........%1.!*....R`.ET.{..)4.!*.......0=....(3.3A........... 
.*5................-9..(.......2?.&0.1=.-9.%0.jv.",.$6.............(2.
...2>.-9..'.$...,....1>..&.)3. *.*5....*5....'1....)4.2>.6C. 
).",.......(2..'.&0....$-..9.'2.......*4. *.$..(3.QX.",..#....... ).,8
.9H..#./<.>N.Zf.",........'.",. ).$........ ).$......../;...." .
7D.......0=.q|.....'..1....#,.,7.$..*;....)4.......$..%..$.....1>..
.. 7..9.#,. ). 6.0<..'....gr./<.2?..$..).*5.,7..... .(8..&.do...
.#-. )..$." ./;.6F.7E.%/....",.9G.#-.:H.8F.:I." .;J.!*.;J.$..<K.6D.
[email protected]>.8G.#,....;I.! ....'1.......5C.&1.(3.5B.4B.3?.qt.,7.....
..-9.,8.-8..9..;./;....9?.`e.NS.............%/..........'1.......%/.$.
. <.OV.8E.#-.8F.5B....%0....$/.&1.4B.-9....rx.5C."2..$./<.....;.
8G.5D.7F....(9..!.......! ....%4....io.`l......!..NETSCAPE2.0.....!..X
MP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E4A251F4555EE2118
EE3C5B57A67443E" xmpMM:DocumentID="xmp.did:960BE3CE2AD911E3A077B6E01DD
9B7E5" xmpMM:InstanceID="xmp.iid:960BE3CD2AD911E3A077B6E01DD9B7E5" xmp
:CreatorTool="Adobe Photoshop CS6 (Macintosh)"> <xmpMM:Deriv
<<< skipped >>>


GET /images/vicinio/dsp-images/jason.pepping/background/1384378062049.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 21:27:42 GMT
ETag: "127106-3f6-4eb15a29ffefe"
Accept-Ranges: bytes
Content-Length: 1014
Cache-Control: max-age=309353172
Expires: Sat, 11 Nov 2023 21:27:42 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR....... .....mo......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:E4A251F4555EE2118EE3C5B57A67443E" xmpMM:DocumentID="xmp.did:960B
E3D22AD911E3A077B6E01DD9B7E5" xmpMM:InstanceID="xmp.iid:960BE3D12AD911
E3A077B6E01DD9B7E5" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A7B1D6E4220681180
83A29412ECA1E7" stRef:documentID="xmp.did:E4A251F4555EE2118EE3C5B57A67
443E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>]Y.G...$IDATx...1.........9A.*.....J.......
.B...A.......IEND.B`.HTTP/1.1 200 OK..Server: Apache..Last-Modified: W
ed, 13 Nov 2013 21:27:42 GMT..ETag: "127106-3f6-4eb15a29ffefe"..Accept
-Ranges: bytes..Content-Length: 1014..Cache-Control: max-age=309353172
..Expires: Sat, 11 Nov 2023 21:27:42 GMT..Content-Type: image/png..Dat
e: Fri, 13 Jun 2014 10:06:58 GMT..Connection: keep-alive...PNG........
IHDR....... .....mo......tEXtSoftware.Adobe ImageReadyq.e<...hiTXtX
ML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSz
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/asset10/1394830064218.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 14 Mar 2014 20:47:43 GMT
ETag: "c3bf49-fbf6-4f4972e7aa00c"
Accept-Ranges: bytes
Content-Length: 64502
Cache-Control: max-age=313590190
Expires: Mon, 11 Mar 2024 20:47:43 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR...8...........n.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background2/1372348471308.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 27 Jun 2013 15:54:25 GMT
ETag: "6bf69d-40ba-4e024c6c94e4c"
Accept-Ranges: bytes
Content-Length: 16570
Cache-Control: max-age=289355986
Expires: Sun, 25 Jun 2023 15:54:25 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
.PNG........IHDR...8...........n.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:C5A00533DF3311E299A5E69B1
262A3E9" xmpMM:DocumentID="xmp.did:C5A00534DF3311E299A5E69B1262A3E9"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C5A00531DF3311E299A
5E69B1262A3E9" stRef:documentID="xmp.did:C5A00532DF3311E299A5E69B1262A
3E9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>.I6...=/IDATx...i......|2....7.7H.$.C"%@...u
.=.i...=...z6$.........3.....GX.].........]yG...f$.C..H. ......h.YG..?
.dee]}.....Ot...........'.|R...^..U..:....;e.......F..=.}..6JU....T...
..6\.sU...0YOX..V._......~..u..WO^:.&\f3.`...X...?\p.s......)-x..._z,{
RuJK.N).eGm}.Q..I...E..Z...b.....*H.U*?.....j....\.o.e^7.^1....g.A....
...^W. .y36. ...K.|:.r'..m.z.[y;.g.:.c ....Ra=q.<7l.s.o.x...#.<.
.\.~k[..j.........t.%o.d.]..$...)..*....,x.H.....nlJE?.Q.K...b7...MZ..
B..R...K..\..%S..Pc..T.X.S.$.`........uV.....Hg..l....R.l.l.jH.Va.L>
;..>9P4/....G.......".*....w.?{..W..6......'>...{_N)UK).D...
<<< skipped >>>


GET /localStorage.jhtml?toolbarData={"toolbarId":"49F19948-7BCF-4240-BFE9-02783025B89B","partnerId":"^Y6^chryyy^YYA^ua","partnerSubId":"","installDate":"2014061301","homePageOption":"true","homePage":"true","defaultSearchOption":"true","defaultSearch":"true","installType":"CRX_WEBSTORE","pixelUrl":"http://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=","successUrl":"http://VVV.fromdoctopdf.com/installComplete.jhtml","dlput":"YYA"} HTTP/1.1
Host: fromdoctopdf.dl.tb.ask.com
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: sessionData="b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9 QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHj
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:53 GMT
Server: Apache
Set-Cookie: anx="xrp=&xnt=&xh=&xpp=&xi=&fv=1402654070067&xn=&xrm=&xtp=&xct=&xs=&lv=1402654073893&xp=&xrt=&xt=&nv=3&xu=&xrs=&oc=-&od=VVV.fromdoctopdf.com&ob=-&xkw=&om=referral&xrco=&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=&op=-&xbkw=&xrca=&xrcc=&xft=&xad=&xcid=&xuer="; Version=1; Domain=.tb.ask.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:53 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Content-Length: 469
Connection: close
Content-Type: text/html;charset=UTF-8
..........eR]o.0.}........ .#.K6...}.S....r..&..G.M!..........9.\._.(.
B|..>..r..zE. [email protected]$..`.D(1&..K...Q.T.!....5Sy.....!..z.....]...*
....UwT........9.%.h..F~8.....w}{0.MG...B.v?.....IE..p..W.5.T........'
~.$....e.T.} h.....:..h*..|.O..0..fQ5p....)m...*..[~A.....z&..<....
.....i.3.....f2....R%......&.&&&._L&...i....s.i_./...B..9....A........
R......I..K{...&.qO.)...m..cP......ya...D......n..jPk.......y!..K.J...
....59.......7.F..Oy.^..77.Gd...%.:&5J$o....>.o..Jx......



GET / HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:32 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="xrp=^Y6^yyyyyy^YYA^ua&xnt=&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&fv=1402654052847&xn=&xrm=&xtp=vhigh&xct=&xs=15493&lv=1402654052847&xp=vicinio&xrt=YYA&xt=rrdefaulta&nv=1&xu=&xrs=&oc=-&od=none&ob=-&xkw=&om=-&xrco=Y6&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe14.df.jabodo.com&xgc=false&op=-&xbkw=&xrca=yyyyyy&xrcc=ua&xft=&xad=&xcid=027382d5aeee4be8a36350dfd4a6412c&xuer=3"; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:32 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
1ff8..............{[.G.8.7.y.....%.A....<.b.1Yc8..0&<#.H.[.(3#..
.......E.'......#uWWWWWUW.........x...qt..e...........e/5...l4..G.....
..V....bo..i...a......A.N........J=........jaa.u).J...._..,...Z.)[email protected]
.....{Ad_....- ....sF...b.x.K,...0x....b.(H=..,..M......i0N...'.mu./.N
......Vw..I........V..,pLco...7M.Q....F.......d.L....e..I.(I........n.
PV...c0.boh=j .:..m.0............R&...............Z.Co.Xo..E..]......$
...@."......>.B....I.:}-..^.^...p...`...V..'.~Y..H........z......!$
[email protected] ..:RF...X..9....>......<#[email protected]
.B.....Pk.G..Y.......K..a....l>].t..~..b..n4&.N${.G....`.zN...H....
.5.F......\.P......SK.T.EO./....l....z&.....^......:...c.6qc.%...5..D.
.....#...{.$.NSAp.Mta....9..i..U.....'.[.G@..^KTEK.Q(.fc.41...*.L.. .A
........).nM^.2G.d....v.5u.....P...Y.t.....Xbh.5.....Q.!.N.m2...F#....
.(..]..OH.,..m*Q.\.'..lk......l.#.P..'.[.J6.?Y...L.P.%f.....u...Y...|.
qF......\.46...p4.....YV{..s.e...a8.....A.....B8.z..u..&`3...9.q9...t.
..0T......N4..9k.l.'B....#...4H<x.....8..w..yS..}.&.x..Y?.r>i.,.
........G..K...VM.8P.X.D..`.7..?b....'.........|#4."....!....F........
..N..5.....a.}r-.4b.4N..I.jC.H..h).....[.%>.}....].x.........C/..&.
,.....uTN..I.$U.Z._o.!.....*..L....3.3......CvlY....w....6ZO..A..9^.O6
..|I....r..i...RL.m]..'s.5).G^..w....{.>..Q....z7.5. i\..p.F.?.,..O
^....`2...P8...g.W.>k..7.?.O.}.....*..I@.".].*.......dk..H).......V
2fg......G.Y.=.<?..a.y....V.2.8.m...4.v.,F&..s;..^tu...HiX.}.....!%
...Q...8....Z..rw..".....>\#.q......A.).W....O.o$CD.[..K....y:.
<<< skipped >>>


GET /ga.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Jun 2014 23:42:41 GMT
Expires: Fri, 13 Jun 2014 11:42:41 GMT
Last-Modified: Thu, 29 May 2014 22:33:33 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15836
Cache-Control: public, max-age=43200
Age: 37457
Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f.....ZhiI..dY.iB.b.KI.o.gF.-'..9....n
byF..h4...../....z..|..y .b../......A_.S.....w......$2=.\..8e..:.G..].
.<.b....M_7.,.I...{..t<./s....x...,...(r4...8W|&N._K...M...p.\9.
..'.I.._.Jz.!.6.....8........P...F.......]H...-..!.M.t...?..6..5O..1..
p0..7.n$y*.z..Z...".W .8XE.....z.a....`.n....t....v.u..6.....A:H...=..
z.....!...5.u [email protected](;. ... W#.M..4
.0.u|.8..{..5...v.T.....5.@)..M..wr.....A>.v..%w..C.B..,Wjj8......j
.r./.Y..RI.6.(........T....Dq......Al...b...:.r.........}1.C...ZYv..y.
r.=d^.....T....L.U(.2 ...`..5......8.tD=..........c.#u.h...-..yu.....r
..?D....j.JQa.T.....f...G.q?r....7_llo>..@....].n;[email protected]_.@...
....#[email protected]...~.UL&...,X.a.Gl...C..c....W........i..2....w.V.{S
...T(w..KF........1.".......V..N.J V.y...K.....4....  .W...Y.......k$.
..r...P..H.J.^.......|... [email protected]..,|\AH`..._..k. x...A...d$.X.~.H
|.3..w>.@M"...s....1..Yi.#..G.........tO....v...1...{k.......np...8
y...Aa....V1.UvB...UJ.q.YC.=.W....1..Yns....s.8.....}..}.0h:......[.Q.
[email protected].}.(..Z.%..q....=Q.$HD....|.[Yq5A..rR.|.r...A....,....^.3
.w...4.:..3.=...>.Z_.A?2X.W..vl...Y.Q].....`VUv......9.R%<.k)..P
OLv..rm..Gc._j.cr/...yBjJ....:7....'....uQ.7.W..0s/K...|..*bY...&...pe
E.50.......&...T)-.-.)......A.."....aK...M.#.Y..... Js......ns.......V
....F;Q....0.P..S.L..l...B..&...nfX3d.....Z....5...6... :.[.{.".!.7*.0
...ylO..N...n ....r.M [email protected]..]W.u..D...m..J.5k..nT...t!.
..._..=..G.Y..^Y..f..]...d.N^....9....m1-0..`K.uB..R.MB.......%.!.
<<< skipped >>>


GET /images/vicinio/dsp-images/jason.pepping/background999/1384378039938.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 21:27:20 GMT
ETag: "5d8487-46da-4eb15a14fea73"
Accept-Ranges: bytes
Content-Length: 18138
Cache-Control: max-age=309353150
Expires: Sat, 11 Nov 2023 21:27:20 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR... ... .....T..?....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:E4A251F4555EE2118EE3C5B57A67443E" xmpMM:DocumentID="xmp.did:5D2D
5FC22B7611E3A077B6E01DD9B7E5" xmpMM:InstanceID="xmp.iid:5D2D5FC12B7611
E3A077B6E01DD9B7E5" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2932B5913D20681182
2A92B794F33EA1" stRef:documentID="xmp.did:E4A251F4555EE2118EE3C5B57A67
443E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.F.Z..C.IDATx.......a....>t. !.@'7..m06.
c.8......7.v..6mI..o...CK...18|h.c.........#...C6.....@..>vw...}...
..3;........W;3..>#...?..?.-;zc...8....@`...,..........X......... .
.........@`...,..........X......... ....yR...x...m.G..F..h]8.....g.zj.
o/..B.2...p~ko......|.........j....`..=.2.?..s..).m.......m...o......h
...~._tww....a.#........W.o......4....8....g_.vpZg..m.)......)....o.s.
.M.....x..R,.|......~........Ov.....Y<....g.}W..'..[.{.@...=.J.....
b...8..9...z....\..h.h..C......|....#.............#}....W_....s...
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/asset5/1370528117612.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 06 Jun 2013 14:15:08 GMT
ETag: "42370e-1d3a-4de7cf116fcf8"
Accept-Ranges: bytes
Content-Length: 7482
Cache-Control: max-age=287461575
Expires: Sun, 04 Jun 2023 14:15:08 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:58 GMT
Connection: keep-alive
.PNG........IHDR.......A.............tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:549D36B18EF011E1A2BBEFA444
46F2AE" xmpMM:DocumentID="xmp.did:549D36B28EF011E1A2BBEFA44446F2AE">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:549D36AF8EF011E1A2BB
EFA44446F2AE" stRef:documentID="xmp.did:549D36B08EF011E1A2BBEFA44446F2
AE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>~..8....IDATx..].t.U......}.....$d.........&g
t;.a.CG..8.. .......=3n.s.g.. "".B......-A..H.I k.....V.........s.?E.[
..}.n.......: ^.W".(?...#.ED.(".D.ED.(".D.ED.(".D.ED.(".D.ED.(".D.ED.(
".D..'.(".D..'.(".D..'.(".D..'.(".D.7..'..o.=B..U.4..("N....M....`6\C.
..."t*...1.PkhhX.fMMM...08.........Q...1...z.B29M=%Cs....[/.8...k...w.
.Z.j.td..X2E=1%|.r{..(7t3.N.I....#.t.}.J.. ....o...kA..._.X,..s..k.=KP
.X...H.....xA...&d..9..  Q..k..SSGT<x..GG.j ....H...........r.wB...
.}..Pf.qL.#G...=.n.....T...........L....#..t..Us....2.J?:_............
..%.$.='....<xg....OZ?l..x..3.V.....H.[<O...s....;v.......]n
<<< skipped >>>

GET /images/download/runrun/test/rebuttal/WPanel_P2_01.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 24 May 2012 14:45:10 GMT
ETag: "154cb6-f50-4c0c94c750bb4"
Accept-Ranges: bytes
Content-Length: 3920
Cache-Control: max-age=274128941
Expires: Sun, 22 May 2022 14:45:10 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:06:59 GMT
Connection: keep-alive
.PNG........IHDR.............F|.a....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/button1/1384361682725.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 16:54:43 GMT
ETag: "a9a324-bd5-4eb11d267ad5b"
Accept-Ranges: bytes
Content-Length: 3029
Cache-Control: max-age=300652212
Expires: Sat, 11 Nov 2023 16:54:43 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:08 GMT
Connection: keep-alive
.PNG........IHDR.......$......S......tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:2A37056610E911E3AC809FB54
AEE8879" xmpMM:DocumentID="xmp.did:2A37056710E911E3AC809FB54AEE8879"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A37056410E911E3AC8
09FB54AEE8879" stRef:documentID="xmp.did:2A37056510E911E3AC809FB54AEE8
879"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>.Z.L...JIDATx..\{PT.....eawY. .<\B$..E!Fk
..Nh..A....S....kkR.f.v........?j'.I..q....dL...I.5I......ty?va.w.....
.]!Eh..c~....{.;.~...;...J...Y".p-..0..............v.U./.F.7..&|.p=.Z.
.%.A.j.?}...9..lj.Z.:j$.!4 s.5...-.....A..l..'....$..2wQ. ....i...KQ.=
..z....%.:V..DM"..Xh....><~7.>.&....HB.).G..:.p.R...o.7....8.
....0i.)..D..;q...AO..j.pcS^w;k,..........L.$#/....F..hH.<Vt:..^.s.
o\...2^xX.B. ~.x...qyP.?...LF....n8.....7....J..B...'<..M..>.&..
.e.....z.zG."j=....A_....2i.".n.K..(D...[.>.h.]..8.J.E.w.'".2i..D$A
;.%...Y<..=(dW.~.....(LY. .Q...[....q...[.6.....o..u.l.F..&G...
<<< skipped >>>

GET /images/vicinio/dsp-images/207743773/asset1/1395069229875.png HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml?close=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 17 Mar 2014 15:13:51 GMT
ETag: "5cd9c-5081-4f4cede006fb5"
Accept-Ranges: bytes
Content-Length: 20609
Cache-Control: max-age=311972378
Expires: Thu, 14 Mar 2024 15:13:51 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:22 GMT
Connection: keep-alive
.PNG........IHDR.......#......3......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>


GET /pixel?google_nid=triggit1&cb=4gd7ho&google_hm=bGRGQlBwZ2hTMktpby12RV9vRUVVUQ== HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cm.g.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: test_cookie=CheckForPermission


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://a.triggit.com/pxgcm?id=&cb=4gd7ho
Date: Fri, 13 Jun 2014 10:07:28 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 241
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: id=221718b2db0100d7||t=1402654048|et=730|cs=002213fd48f1a68fe140990c99; expires=Sun, 12-Jun-2016 10:07:28 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://a.triggit.com/pxgcm?id=&cb=4gd7ho">here&l
t;/A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Location: hXXp://a.triggit.com/pxgcm?id=&cb=4gd7ho..Date
: Fri, 13 Jun 2014 10:07:28 GMT..Pragma: no-cache..Expires: Fri, 01 Ja
n 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content
-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Conten
t-Length: 241..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80
:quic..Set-Cookie: id=221718b2db0100d7||t=1402654048|et=730|cs=002213f
d48f1a68fe140990c99; expires=Sun, 12-Jun-2016 10:07:28 GMT; path=/; do
main=.doubleclick.net..Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2
008 23:59:00 GMT; path=/; domain=.doubleclick.net..<HTML><HEA
D><meta http-equiv="content-type" content="text/html;charset=utf
-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.
<H1>302 Moved</H1>.The document has moved.<A HREF="http
://a.triggit.com/pxgcm?id=&cb=4gd7ho">here</A>...</BOD
Y></HTML>....
<<< skipped >>>


GET /images/vicinio/dsp-images/211634648/background999/1372437932631.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/installComplete.jhtml
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ak.imgfarm.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 28 Jun 2013 16:45:31 GMT
ETag: "a1b209-890-4e0399b6934cd"
Accept-Ranges: bytes
Content-Length: 2192
Cache-Control: max-age=306837220
Expires: Mon, 26 Jun 2023 16:45:31 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:27 GMT
Connection: keep-alive
.PNG........IHDR...P............*....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:24A8CA07D82411E2B456F7
9AB3D903A2" xmpMM:DocumentID="xmp.did:24A8CA08D82411E2B456F79AB3D903A2
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24A8CA05D82411E2
B456F79AB3D903A2" stRef:documentID="xmp.did:24A8CA06D82411E2B456F79AB3
D903A2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>........IDATx..W]L\E.... `.K...].FK.....I
-aA./&.5......<..../.6.'..4.X}Y.BHS...&&.-$.!...-....e...XS....Y...
.../..dg...33.|..3s5..p...ii.G*]Up8..V...4]..N~eA.<.....z..d'c.....
U.........{...=..h.S.0.v......~._w....b....7.....Q...WH*..LP).!'..G..C
e.j3..a.....AFXQ 0K:^Fnu....|<..M.Q#...P>.e .._. B(L!.d{|T......
.n...J..I...5x...*nU.w..O#v..f.~?.G.X..V.....'.."..z............}..2..
..0.3.....X.|...oS..d".J..m........=...u....D..x....~*..../..b....z..I
<&.:]\{y...r..?.A..<wTY'D.D..../Y..<G.L.U.I......i"....%{P..g
X.3..{.RZ4...$6..K,...0_..s..`..S......N.0(....~.k..W.....?...~.aQ
<<< skipped >>>


GET /anemone.jhtml?anxuu=245A566E-8953-4A13-83EC-4C8ED5D14DF5&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe20.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654073026&anxrd=VVV.fromdoctopdf.com&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=6&optIn=true&searchAssistantOption=true&searchAssistantOptIn=true&homePageOption=true&homePageOptIn=true&anxe=InstallerAccepted&anxr=145020026 HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: cookieEnabled=true; sessionData="sxZ4ZF5IibvfSKqfgLj09lPDxOA0GrOWgLMfK f0kOsxTSv4AM5ACMGb3V/9n1s5jnQpZXvQCbrkFUXEm2v5PM/kayNqKg bt71TqA61sFBKeNv78faqxk0X4yCoMubCeK3HSeoU0wBv9s30tNheQXLWE 5aLvbKiW PHM0QQqSjDmSmPMMvPPCHTSlEn6QEH2YcZlex/IQ6m1XVSZNlQetZJbxHljw46hrTFxrrdKtSeDuNu9kirXHmJovMbdYR/iujY0c4hxR0K5wIfcZiPZ6BgpwPpwzkvPFHaEGoeZjfYapa4hsA9KFI hpSEy8pXyq5fuWXUZUcgoSXWyZJmwhEXZ0D0HmiDcR1WCq9gseIVj/RsYq7dB5X5jJ3IuzdXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIvCRhivhu5/Q3TzU6hz51TyJSZQJTjpeI8t p6EkYWTzl22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=49F19948-7BCF-4240-BFE9-02783025B89B
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:08:03 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET / HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:06:56 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="1KwlOL99CBUb/cm kLnwq9/feNfFDOkQCthghC9WPd84390vaUA8Lj4jM8zroAlXxuQWljAedxSdh SiFsGi4Ha8OPh5ArtmDARBGpQdFqf5J8v4vQNQAIBJnfgkI3VAjZfjct3YpO4X2eAmWIH0QQTahOyEzICj7kdI Mx1ztsS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="xrp=^Y6^yyyyyy^YYA^ua&xnt=&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&fv=1402654016034&xn=&xrm=&xtp=vhigh&xct=&xs=15493&lv=1402654016034&xp=vicinio&xrt=YYA&xt=rrdefaulta&nv=1&xu=&xrs=&oc=-&od=none&ob=-&xkw=&om=-&xrco=Y6&ok=-&xit=&xg=&os=-&g=-&sn=dfprdsndlfe21.df.jabodo.com&xgc=false&op=-&xbkw=&xrca=yyyyyy&xrcc=ua&xft=&xad=&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3"; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:06:56 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
1ff8..............m{.6.0.Y.....u..bI...I..].VZ...}l...I..J.l&..%).l..~
...A.....>O..X"..`0.....o...............]d..w......Wm....ho}}.l....
.W.^.......FY.....z.u..^d.|{}....}...'..g'........V..l.YP.^ ...B...T.K
......P.....t2K{.D...=c.ck./B?..keQ6........i....h..ZD...^<..Y.:...
Uo.~..Yx..#..ot.'i.....l=.z....!..i....."N..U*....t.Ds$Ki....U..i.P..L
B/.49v.4.W.....Y.....:Rk..7.'F....G.m.3..aO.~.D.s.........ko7..I..).\.
Y4..^...J.$.C.[...(..wg#.4.S..l...p.g.e.% WQ.]l?.d.T8"...r..V{<...0
.g.cz..M..Y.$:..K%.L..MB?.%...7......,...J..e({.. . .[.$:...`8..../...
^.....(....9.z.A>..A...a....x....v:O6.C.n....'...I.sI...V..;...Q.T.
8e....O.)t%...-.4..~..d.......'.6d..B.....}*.I...]....Ua........7.....
:..T=i..P.#.....4.,2.p..uf....9..Y..T.NH......3@..^-j...p2........X#..
d.f%.T...G. .".....s...pr..VXW.=e..b8.T9...$';L..b`74.....a.K..l..3...
O.cV}....wv.7i.y../.....MX....9.%U.....QF.M9.jJv.=Y.{....&......ow..,o
...y.......fAx....x...<N2...... .$...'.h.::m. ..h..!.L...;..s...%`.
...I..9...0.0M. .L..$..I..c9...c..I.G....7..?..)..A..E.%..".......97;9
...ua..>.'[email protected]@.*D...hdv#..M..&.d..d~....?.
.....l.J.g.^{.?.....F.iD.E.b..8..^...VK.0.ol...$......b.S....bN.......
0.....%..6NN..i.8U..._?.B..../.p.2Q.s}.f...hB.X......j6..N.K..n....GS.
@.\'..{..K...[i../$.0.Z..'S.5....9..E2.s.......c?..G.t......(.E.z..[..
.?.g.y8...YW0....>~..igk...Y{>;G.....x..CR..o.........f.....d0.J
#.b..0..g..?..:I.-{98....i...s..K.....fi.,F...q?.|.%.8.........>.*.
.bI.?.9jv.".....*.A..._....J..g.S._...vt.X5.f..#....I.1.....$..Y.O
<<< skipped >>>


GET /pixel?google_nid=triggit1&cb=qbaf3c&google_hm=ZU5tZXFYSzhTT3FXaFNtaFdLckJEUQ== HTTP/1.1
Host: cm.g.doubleclick.net
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: test_cookie=CheckForPermission


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://a.triggit.com/pxgcm?id=&cb=qbaf3c
Date: Fri, 13 Jun 2014 10:08:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 241
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: id=2244b0b8db01003f||t=1402654084|et=730|cs=002213fd4852390dee32fa1e99; expires=Sun, 12-Jun-2016 10:08:04 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://a.triggit.com/pxgcm?id=&cb=qbaf3c">here&l
t;/A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policy
ref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa
 ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC 
NOI DSP COR"..Location: hXXp://a.triggit.com/pxgcm?id=&cb=qbaf3c..Date
: Fri, 13 Jun 2014 10:08:04 GMT..Pragma: no-cache..Expires: Fri, 01 Ja
n 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content
-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Conten
t-Length: 241..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80
:quic..Set-Cookie: id=2244b0b8db01003f||t=1402654084|et=730|cs=002213f
d4852390dee32fa1e99; expires=Sun, 12-Jun-2016 10:08:04 GMT; path=/; do
main=.doubleclick.net..Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2
008 23:59:00 GMT; path=/; domain=.doubleclick.net..<HTML><HEA
D><meta http-equiv="content-type" content="text/html;charset=utf
-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.
<H1>302 Moved</H1>.The document has moved.<A HREF="http
://a.triggit.com/pxgcm?id=&cb=qbaf3c">here</A>...</BOD
Y></HTML>....
<<< skipped >>>


GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052847&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=68E760C8-462C-4F26-9CF2-EA1EEB257FB3&anxe=backFill&anxr=1854133171 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654052851&nv=2&t=-&v=-&p=-&si=-&sn=dfprdsndlfe14.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=X
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654016034&anxrd=none&anxrp=-&anxrk=-&anxrm=-&anxrb=-&anxrc=-&anxrs=-&anxsq=1&anxi=FC261152-5CED-495D-A898-4A9A960C441A&anxe=backFill&anxr=1023458378 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="1KwlOL99CBUb/cm kLnwq9/feNfFDOkQCthghC9WPd84390vaUA8Lj4jM8zroAlXxuQWljAedxSdh SiFsGi4Ha8OPh5ArtmDARBGpQdFqf5J8v4vQNQAIBJnfgkI3VAjZfjct3YpO4X2eAmWIH0QQTahOyEzICj7kdI Mx1ztsS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654016053&nv=2&t=-&v=-&p=-&si=-&sn=dfprdsndlfe21.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:00 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /images/download/runrun/test/rebuttal/Alert.png HTTP/1.1
Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 24 May 2012 14:59:50 GMT
ETag: "154cb8-bff-4c0c980e38966"
Accept-Ranges: bytes
Content-Length: 3071
Cache-Control: max-age=274129925
Expires: Sun, 22 May 2022 14:59:50 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR...2...,.....'..Z....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:494CC4B8A5A511E19155B5BA
1D593A6F" xmpMM:DocumentID="xmp.did:494CC4B9A5A511E19155B5BA1D593A6F"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:494CC4B6A5A511E191
55B5BA1D593A6F" stRef:documentID="xmp.did:494CC4B7A5A511E19155B5BA1D59
3A6F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>V......sIDATx..Z{l[......I.4....$7~.o'N..4}
@C..X M.4.M.16&.i [email protected]{.P.".?L.g.&M.....=...0:Q....&l.e@K...}...s..
.qZ..F?]..{.=.......r....F..q...A.9.8.x..W.!{...\.F$&...v......km-,...
f.....7....>.HW...5 .F...{O.:......~..l......#.......P.......w5v.T0
..QDW.0...pHTTP/1.1 200 OK..Server: Apache..Last-Modified: Thu, 24 May
 2012 14:59:50 GMT..ETag: "154cb8-bff-4c0c980e38966"..Accept-Ranges: b
ytes..Content-Length: 3071..Cache-Control: max-age=274129925..Expires:
 Sun, 22 May 2022 14:59:50 GMT..Content-Type: image/png..Date: Fri, 13
 Jun 2014 10:07:33 GMT..Connection: keep-alive...PNG........IHDR..
<<< skipped >>>


GET /images/vicinio/dsp-images/jason.pepping/asset14/1394830119959.png HTTP/1.1
Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 14 Mar 2014 20:48:39 GMT
ETag: "abaa75-c10d-4f49731cc18a3"
Accept-Ranges: bytes
Content-Length: 49421
Cache-Control: max-age=315233058
Expires: Mon, 11 Mar 2024 20:48:39 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR...8...........n.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background1/1370528215804.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 06 Jun 2013 14:16:46 GMT
ETag: "635700-1ae0-4de7cf6ee5c67"
Accept-Ranges: bytes
Content-Length: 6880
Cache-Control: max-age=287535728
Expires: Sun, 04 Jun 2023 14:16:46 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:34 GMT
Connection: keep-alive
[email protected] ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:7A86773D6BD411E2BFD9E432
700E40AC" xmpMM:DocumentID="xmp.did:7A86773E6BD411E2BFD9E432700E40AC"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7A86773B6BD411E2BF
D9E432700E40AC" stRef:documentID="xmp.did:7A86773C6BD411E2BFD9E432700E
40AC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.$.....TIDATx.....$.]...S.=3;k.qbG.'.......
../J..C.p..)....p! .@H"..p..n.A..H..$ ..y1...{./3..PU..]=......n=....=
3=.....o?.T=....gq..}.....=q..Q.Y.h....HUD..R............X_.......w.f.
u.W.>..............?.~...R.?/.8.....^.B.9..3.L....].....j.....<.
..A..[7....x.>n.....?...}v.6..8^......s..E...fQ....S....8h.........
z..q.}.._..{......x....3....M/..Kr{.i..v{y.;..xZ?`..W...O.....i....]0u
W..?.z....z.vC..q ..../.5.F.1{[email protected]...~..;w..8..u..B._U.{
.}..-...2..y...c.,.(..Q........rq....o.SO]....?Mw..7....W?...........4
..q;.|......ut...]R........o.\^......?......./<.s.A.d#.<....
<<< skipped >>>

GET /images/download/wb/fftest_arrow_lrg_up.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 28 Jan 2013 14:56:30 GMT
ETag: "3854dc-dea-4d45a7b774e1e"
Accept-Ranges: bytes
Content-Length: 3562
Cache-Control: max-age=275011125
Expires: Thu, 26 Jan 2023 14:56:30 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:35 GMT
Connection: keep-alive
.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:1DC8C455390211E2878D81FE
B4164471" xmpMM:DocumentID="xmp.did:1DC8C456390211E2878D81FEB4164471"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1DC8C453390211E287
8D81FEB4164471" stRef:documentID="xmp.did:1DC8C454390211E2878D81FEB416
4471"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...N...^IDATx..._.]E....s..l..< .`...D..
.hb..`...,-.rCc.[..J.[ ....BY...........L\.........o..y.`......{.....9
s...9..{w.EOrz..33...|.7..........p......C.E.oh.Q......c......e.._.S.s
o......9]..K.X.."...I.....|.."..O....Gt6G...............|n3. .C.7...:.
H?5....~....O.P.P...b....;A..~Qj.g*}...%..S.R....q...5.....:.Y.4....U#
.d.&..3.UR..l_...R...,..I.u........^_.......B'....e.7K`..{...u.>.n.
...vm.n3-.X...-..O......P.a...<.s.UW.P.tu.h.......e.S.{.._..B......
..3...P}...!.gz..~....>.._................q2........P.RW?.{...].i..
..}...[Y......"T.t....Ot.y.S.3'...w.l.@[email protected]_j...b.{`..=.....u
<<< skipped >>>

GET /images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/65ffxtbr-rsl@FromDocToPDF_65.com.xpi HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 04 Jun 2014 18:33:45 GMT
ETag: "15e4061-9328b-4fb06de57f090"
Accept-Ranges: bytes
Content-Length: 602763
Cache-Control: max-age=315223016
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/x-xpinstall
Date: Fri, 13 Jun 2014 10:07:37 GMT
Connection: keep-alive
PK........7t.D..o.............META-INF/zigbert.rsa0.....*.H..........0
......1.0... ......0...*.H.........i0...0..k............d..{2...ze.0..
.*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSi
gn Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rp
a (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...12041000000
0Z..150506235959Z0..1.0...U....US1.0...U....NewYork1.0...U....White Pl
ains1&0$..U....Mindspark Interactive Network1>0<..U...5Digital I
D Class 3 - Microsoft Software Validation v21&0$..U....Mindspark Inter
active Network0.."0...*.H.............0.........]V.}.>...<.s`...
...\U.idS=..b.o%.....Cu.`..z.........vK....'Q.p..;.......m......3..>
;..&..$......L..$..l..^....H,q).'.....sGk.....*.8.T.r.=U.(l...s}....t.
b.%.s.Y.....$...5...J6._.M..j.V.....mh0^.7..-....cl...U.....!|]."}....
.i...}/Xc..d|t...hw...v.6......g........{0..w0...U....0.0...U.........
[email protected]./hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
..U. .=0;09..`.H...E....0*0(.. .........hXXps://VVV.verisign.com/rpa0.
..U.%..0... .......0q.. ........e0c0$.. .....0...hXXp://ocsp.verisign.
com0;.. .....0../hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0...U.
#..0.......{&.K......&.....0...`.H...B........0... .....7.....0.......
0...*.H................h.6.I..%.....a.:.O<.]./...a.W.}..%P"....g...
..\..a1..G~.[.....x........?J.\...8Sa6..L..Q.7.5@[email protected].}.p3..&l
t;f";.;.......hJ|<...Hk.C..5..l....,b..F...@9cB...;..Y..>F..J$`.
.....0 ....w....?!}.....<[email protected].
<<< skipped >>>

GET /images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/65ffxtbr-rsl@FromDocToPDF_65.com.xpi HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive
If-Modified-Since: Wed, 04 Jun 2014 18:33:45 GMT
If-None-Match: "15e4061-9328b-4fb06de57f090"


HTTP/1.1 304 Not Modified
Content-Type: application/x-xpinstall
Expires: Sat 02 Apr 1977 17:15:00 GMT
Last-Modified: Wed, 04 Jun 2014 18:33:45 GMT
ETag: "15e4061-9328b-4fb06de57f090"
Cache-Control: max-age=315223016
Date: Fri, 13 Jun 2014 10:07:59 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/x-xpinstall..Expi
res: Sat 02 Apr 1977 17:15:00 GMT..Last-Modified: Wed, 04 Jun 2014 18:
33:45 GMT..ETag: "15e4061-9328b-4fb06de57f090"..Cache-Control: max-age
=315223016..Date: Fri, 13 Jun 2014 10:07:59 GMT..Connection: keep-aliv
e......


GET /images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/65ffxtbr-rsl@FromDocToPDF_65.com.xpi HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
If-Modified-Since: Wed, 04 Jun 2014 18:33:45 GMT
If-None-Match: "15e4061-9328b-4fb06de57f090"


HTTP/1.1 304 Not Modified
Content-Type: application/x-xpinstall
Expires: Sat 02 Apr 1977 17:15:00 GMT
Last-Modified: Wed, 04 Jun 2014 18:33:45 GMT
ETag: "15e4061-9328b-4fb06de57f090"
Cache-Control: max-age=315223016
Date: Fri, 13 Jun 2014 10:08:00 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/x-xpinstall..Expi
res: Sat 02 Apr 1977 17:15:00 GMT..Last-Modified: Wed, 04 Jun 2014 18:
33:45 GMT..ETag: "15e4061-9328b-4fb06de57f090"..Cache-Control: max-age
=315223016..Date: Fri, 13 Jun 2014 10:08:00 GMT..Connection: keep-aliv
e..



GET /images/anx/anemone-1.2.7.js HTTP/1.1
Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 08 Jul 2013 20:02:48 GMT
ETag: "774114-a236-4e105875b5290"
Accept-Ranges: bytes
Content-Length: 41526
Cache-Control: max-age=309572103
Expires: Thu, 06 Jul 2023 20:02:48 GMT
Content-Type: application/javascript
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
// You can define an _AnemoneParams global var with the following memb
ers (all are optional):..// uniqueUser: unique user ID (${eventRecord.
uniqueUserId}) -- if missing, will generate a value..// appId: applica
tion ID (${eventRecord.application}) -- if missing, will use current h
ostname..// appVersion: application build version (${eventRecord.appBu
ildVersion})..// appDate: application build date (${eventRecord.appBui
ldDate}) -- if missing, will attempt to use document.lastModified..// 
logPageView: if true, each page view will be logged (only do this if y
ou are not using server-side logging -- otherwise each page view will 
be logged twice)..// updateSession: if true, the session and referrer 
info in the cookie will be updated (only do this if you are not using 
server-side logging at all, or not using the Java servlet filter -- ot
herwise events may be double-counted and sessions may expire unexpecte
dly)..// domain: cookie domain (if not present, will use the last two 
components of the current hostname)..// url: base URL for callback (if
 not present, will use the current URL with "anemone.jhtml" instead of
 the page)..// getAppParams: function which returns an object whose pr
operty names/values will be logged for page views and events (values w
ill be URL-encoded)..// getAppCookieChips: function which returns an o
bject whose property names/values will be added to the Anemone cookie 
(names should begin with "x")..// getUserSegments: function which acce
pts an array of segment IDs and returns the array, possibly adding
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background999/1384378039938.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 21:27:20 GMT
ETag: "5d8487-46da-4eb15a14fea73"
Accept-Ranges: bytes
Content-Length: 18138
Cache-Control: max-age=309353150
Expires: Sat, 11 Nov 2023 21:27:20 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR... ... .....T..?....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:E4A251F4555EE2118EE3C5B57A67443E" xmpMM:DocumentID="xmp.did:5D2D
5FC22B7611E3A077B6E01DD9B7E5" xmpMM:InstanceID="xmp.iid:5D2D5FC12B7611
E3A077B6E01DD9B7E5" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2932B5913D20681182
2A92B794F33EA1" stRef:documentID="xmp.did:E4A251F4555EE2118EE3C5B57A67
443E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.F.Z..C.IDATx.......a....>t. !.@'7..m06.
c.8......7.v..6mI..o...CK...18|h.c.........#...C6.....@..>vw...}...
..3;........W;3..>#...?..?.-;zc...8....@`...,..........X......... .
.........@`...,..........X......... ....yR...x...m.G..F..h]8.....g.zj.
o/..B.2...p~ko......|.........j....`..=.2.?..s..).m.......m...o......h
...~._tww....a.#........W.o......4....8....g_.vpZg..m.)......)....o.s.
.M.....x..R,.|......~........Ov.....Y<....g.}W..'..[.{.@...=.J.....
b...8..9...z....\..h.h..C......|....#.............#}....W_....s...
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background2/1372348471308.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 27 Jun 2013 15:54:25 GMT
ETag: "6bf69d-40ba-4e024c6c94e4c"
Accept-Ranges: bytes
Content-Length: 16570
Cache-Control: max-age=289355986
Expires: Sun, 25 Jun 2023 15:54:25 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:34 GMT
Connection: keep-alive
.PNG........IHDR...8...........n.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:C5A00533DF3311E299A5E69B1
262A3E9" xmpMM:DocumentID="xmp.did:C5A00534DF3311E299A5E69B1262A3E9"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C5A00531DF3311E299A
5E69B1262A3E9" stRef:documentID="xmp.did:C5A00532DF3311E299A5E69B1262A
3E9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>.I6...=/IDATx...i......|2....7.7H.$.C"%@...u
.=.i...=...z6$.........3.....GX.].........]yG...f$.C..H. ......h.YG..?
.dee]}.....Ot...........'.|R...^..U..:....;e.......F..=.}..6JU....T...
..6\.sU...0YOX..V._......~..u..WO^:.&\f3.`...X...?\p.s......)-x..._z,{
RuJK.N).eGm}.Q..I...E..Z...b.....*H.U*?.....j....\.o.e^7.^1....g.A....
...^W. .y36. ...K.|:.r'..m.z.[y;.g.:.c ....Ra=q.<7l.s.o.x...#.<.
.\.~k[..j.........t.%o.d.]..$...)..*....,x.H.....nlJE?.Q.K...b7...MZ..
B..R...K..\..%S..Pc..T.X.S.$.`........uV.....Hg..l....R.l.l.jH.Va.L>
;..>9P4/....G.......".*....w.?{..W..6......'>...{_N)UK).D...
<<< skipped >>>

GET /images/download/wb/allow_xpi_box_white.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 13 Mar 2014 18:19:46 GMT
ETag: "9d8930-3eb-4f480ff851308"
Accept-Ranges: bytes
Content-Length: 1003
Cache-Control: max-age=310166230
Expires: Sun, 10 Mar 2024 18:19:46 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:35 GMT
Connection: keep-alive
.PNG........IHDR...z...r......f|H....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS6.......eIDATx...1n.....gWYb:F...[}
......U(..c..EF..............%{#.f....Y<}.......p8$I...wI>$.:.W.
....)..$....G....C.....|..b..l6....qg...".....&wwwy||.4...o....}....WW
W....L&......M&......."....j..k......L..c.....M..,..$.0Nr9...<.....
.v..$o}...z<...........z......@)...PJ.....z......@)...PJ.....z.....
.@)...PJ.....z......@)...PJ.....z......@)...PJ.....z......@)...PJ.....
z......@)...PJ.....z......@)...PJ.....z......@)...PJ.....z......@)...P
J.....z......@)...PJ.....z......@)...PJ.....z......@)...PJ.....z......
@)...PJ.....z......@)...PJ.....z......@)...PJ.....z......@)...PJ.....z
......@)...PJ.....z......@)...PJ.....z......@)...PJ.....z......@)...PJ
.....z......@)...PJ.....z......@)...PJ.....z......@)...PJ.....z......@
)[email protected].......>..\...l..#O...Km
.....$.~s{{..Z.N.....h........{#../...s......<<<|......pH.,..
......$.c......I.g..a.~O.....hE..vF....IEND.B`.HTTP/1.1 200 OK..Server
: Apache..Last-Modified: Thu, 13 Mar 2014 18:19:46 GMT..ETag: "9d8930-
3eb-4f480ff851308"..Accept-Ranges: bytes..Content-Length: 1003..Cache-
Control: max-age=310166230..Expires: Sun, 10 Mar 2024 18:19:46 GMT..Co
ntent-Type: image/png..Date: Fri, 13 Jun 2014 10:07:35 GMT..Connection
: keep-alive...PNG........IHDR...z...r......f|H....sBIT....|.d.....pHY
s...........~.....tEXtSoftware.Adobe Fireworks CS6.......eIDATx...1n..
...gWYb:F...[}......U(..c..EF..............%{#.f....Y<}.......p
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654021561&anxsq=5&anxe=SplashLandingClicked&anxr=1414323696 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654024251&nv=6&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rr
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:08 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /images/vicinio/dsp-images/scott.schaffer/asset2/1389111048923.png HTTP/1.1
Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 07 Jan 2014 16:10:48 GMT
ETag: "6dc121-1ae0-4ef639ea0b377"
Accept-Ranges: bytes
Content-Length: 6880
Cache-Control: max-age=309410901
Expires: Fri, 05 Jan 2024 16:10:48 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR.......^.....C..G....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:F6D9E057205CE3119FA5D062CD2A31F7" xmpMM:DocumentID="xmp.did:32E0
9A6877B611E3A07AD8BC64C1F550" xmpMM:InstanceID="xmp.iid:32E09A6777B611
E3A07AD8BC64C1F550" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:641D6C47AC77E3118D9A
9B4FBB9BB8D7" stRef:documentID="xmp.did:F6D9E057205CE3119FA5D062CD2A31
F7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>........IDATx....|....w.......w.H(.T.*"..OE.X
@.R,.(MDDA|R...)....>)[email protected]........{.=.7..
)!x.........\........JBE[H............%..q..........H...F."i.z...,...l
v.f..[....N|...v"A........b....xe...........s.%. I.......YXP....w=7..C
.F....= U..Gb...._..A|....k...`z..TD.IR..t..}....=B...=t..U....4mb0...
..h$.z._....3...w....J>.H\.1oi..Y..7....... PX.M.x......q....%IY.x.
...H.3.ur..)....@.\......6'w...Q.$.=..(s...3.$'..C...@.$.C.).Ko...bt}.
.......2.L`G...B..K.~}.}<.$IEIR.#.aN....tk\.X. ..a..s....].....
<<< skipped >>>

GET /images/vicinio/dsp-images/jason.pepping/background/1384378062049.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 13 Nov 2013 21:27:42 GMT
ETag: "127106-3f6-4eb15a29ffefe"
Accept-Ranges: bytes
Content-Length: 1014
Cache-Control: max-age=309353172
Expires: Sat, 11 Nov 2023 21:27:42 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR....... .....mo......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:E4A251F4555EE2118EE3C5B57A67443E" xmpMM:DocumentID="xmp.did:960B
E3D22AD911E3A077B6E01DD9B7E5" xmpMM:InstanceID="xmp.iid:960BE3D12AD911
E3A077B6E01DD9B7E5" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A7B1D6E4220681180
83A29412ECA1E7" stRef:documentID="xmp.did:E4A251F4555EE2118EE3C5B57A67
443E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>]Y.G...$IDATx...1.........9A.*.....J.......
.B...A.......IEND.B`.....


GET /images/vicinio/dsp-images/jason.pepping/asset3/1395254553071.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 19 Mar 2014 18:42:33 GMT
ETag: "3bba5a-384f-4f4fa0403d930"
Accept-Ranges: bytes
Content-Length: 14415
Cache-Control: max-age=315293991
Expires: Sat, 16 Mar 2024 18:42:33 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:33 GMT
Connection: keep-alive
.PNG........IHDR... ...F.....45......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:EEDFF4AA302068118083CF9F6CF47C99" xmpMM:DocumentID="xmp.did:C259
FD41764611E3AD6DE92B10AFB3D2" xmpMM:InstanceID="xmp.iid:C259FD40764611
E3AD6DE92B10AFB3D2" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EEDFF4AA3020681180
83CF9F6CF47C99" stRef:documentID="xmp.did:EEDFF4AA302068118083CF9F6CF4
7C99"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.\ER..4}IDATx....`TU....Kf.{.$.P#..((E...(J
....*..gY...m.Q......"6P@qEz.$.R!...$..;......P..|?=d..3w.)s..?.w..-[.
.m....,Mf..K...A..A..At.;K.,.f.-..Z.T.x.fi.K..2d.<........... .. ..
 ...v.5....%%%...o..mZ..\..-.....ddd\...d2....QWS...M.H..A..A.D.....h.
..O.0}!..c.]YYYi."..M.d1..C..E...6..j. .. .. ...;0l.Z........;.;;.G[.#
g..e......A..A..A.g...,4............C.*x..... .. .. .$\cp..5...<.kR
ll.....D.A..[Sy...A..A..qv.Z.k..=..I1..... .q....#...>..8`..c...9. 
"J.[z.`.%..y..c..A..At#<. $,..L..D%...u......X:..o.laN."d..6l..
<<< skipped >>>

GET /images/download/firefox/InstallOnFirefox.png HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 06 Dec 2013 21:03:05 GMT
ETag: "ae35b6-1604-4ece3f8fb566d"
Accept-Ranges: bytes
Content-Length: 5636
Cache-Control: max-age=311341818
Expires: Mon, 04 Dec 2023 21:03:05 GMT
Content-Type: image/png
Date: Fri, 13 Jun 2014 10:07:34 GMT
Connection: keep-alive
.PNG........IHDR...Z...B......-......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS6.......~IDATx...{.T...?{.S..~V7...
...y..$..f..1...q...`\.n..:.....hL.,c...;...........^2#.Fy)" m...44...
QU..s..Guwx.>(2......:..}~.....g.}~Bk.).../.R^..^,.l.BT..S..g......
......e.....[.v...8..h.O.I..?..zS........d..5.\...[.,..=z....B...v....
.h<.Q.t~.?/. ... f..R.5.....m..-.^.x..@p....... L..5.v.&.i..:.f..$e
JR!AD..R.].v}f..9...c|.(.}...4...p...:._...].P.1H.........Y.f=.x.!.<
;..&.4W.....9'.i...' . ....3f.....~..:...G.Z..B....O>...&b.4..Ba..y
..j........G.A.Y!.|Gi......s.....bs.|.....hDh...z.....Q...wI...D$.....
.^.....O...T..h...]\...|.k_y.'.c..<...S.kkm....g......."9_a..H$..j.
....j).....J?.}...ik}....iF.lnn......Z/.(..L......<.....0o.B*...F..
.... ?........ m.-4653....-...6L.FcS.[.u..OV....`.s..mkm!.O..o...K.^A4
.?j.]}.)5)....TVV^HQh..R....C.^...._..q.?.....N......M.........=.]...`
...l.......|.......U......kkO....?V....'...eK...H..b..<.(.w........
../..\F..2..O.8'$........~.-.\........-.hkma...\v.5.\....}....v.z....0
o.%|..Gy........w...u...o......V...h....w.r.F.....x....U.....~....[x..
.-cW...~..>s..q"F.4...0.i22..n{....I...d. ....U...1..s..1O.%U^AcS3.
.&.`.e....<.,...........V=...f....b.../:..?..s..KXx.R.....G])....dT
K!D.b.-..>....eGRY......_...._... .......k.*...[..?........`..)G}..
?.........i"x/.>...}..ts....`Y.......C........w.......x/.F..u......
jjy..W....S.x.e.b..{d..........u~t..~......!.H.E.G9.......A.....=.....
Q....%......&m.-<..q..~.iM...I.........>.g...^.............j
<<< skipped >>>

GET /images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/65ffxtbr-rsl@FromDocToPDF_65.com.xpi HTTP/1.1


Host: ak.imgfarm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 04 Jun 2014 18:33:45 GMT
ETag: "15e4061-9328b-4fb06de57f090"
Accept-Ranges: bytes
Content-Length: 602763
Cache-Control: max-age=315223016
Expires: Sat 02 Apr 1977 17:15:00 GMT
Pragma: no-cache
Content-Type: application/x-xpinstall
Date: Fri, 13 Jun 2014 10:07:35 GMT
Connection: keep-alive
PK........7t.D..o.............META-INF/zigbert.rsa0.....*.H..........0
......1.0... ......0...*.H.........i0...0..k............d..{2...ze.0..
.*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSi
gn Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rp
a (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...12041000000
0Z..150506235959Z0..1.0...U....US1.0...U....NewYork1.0...U....White Pl
ains1&0$..U....Mindspark Interactive Network1>0<..U...5Digital I
D Class 3 - Microsoft Software Validation v21&0$..U....Mindspark Inter
active Network0.."0...*.H.............0.........]V.}.>...<.s`...
...\U.idS=..b.o%.....Cu.`..z.........vK....'Q.p..;.......m......3..>
;..&..$......L..$..l..^....H,q).'.....sGk.....*.8.T.r.=U.(l...s}....t.
b.%.s.Y.....$...5...J6._.M..j.V.....mh0^.7..-....cl...U.....!|]."}....
.i...}/Xc..d|t...hw...v.6......g........{0..w0...U....0.0...U.........
[email protected]./hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
..U. .=0;09..`.H...E....0*0(.. .........hXXps://VVV.verisign.com/rpa0.
..U.%..0... .......0q.. ........e0c0$.. .....0...hXXp://ocsp.verisign.
com0;.. .....0../hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0...U.
#..0.......{&.K......&.....0...`.H...B........0... .....7.....0.......
0...*.H................h.6.I..%.....a.:.O<.]./...a.W.}..%P"....g...
..\..a1..G~.[.....x........?J.\...8Sa6..L..Q.7.5@[email protected].}.p3..&l
t;f";.;.......hJ|<...Hk.C..5..l....,b..F...@9cB...;..Y..>F..J$`.
.....0 ....w....?!}.....<[email protected].
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMzHSa1N197z/b7EyALt0CEA7P9DjI/r81bgTYapgbGlA= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ts-ocsp.ws.symantec.com


HTTP/1.1 200 OK
Last-Modified: Wed, 11 Jun 2014 15:18:15 GMT
Expires: Wed, 18 Jun 2014 15:18:15 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1601
Cache-Control: max-age=450866, public, no-transform, must-revalidate
Date: Fri, 13 Jun 2014 10:07:18 GMT
Connection: keep-alive
0..=......60..2.. .....0.....#0...0........o0m1.0...U....US1.0...U....
Symantec Corporation1?0=..U...6Symantec Time Stamping Services CA - G2
 OCSP Responder..20140611151815Z0s0q0I0... ........b.c.a......Srx.....
..._..n\..t...}.?..L........8...5n..j...P....20140611151815Z....201406
18151815Z0...*.H.............N{./ZEFf.1,U.q....SM'.../Q..q...`<D:C.
..}...Sg....^U..."...<<..f..q.#&]{....Nc5..`C.[))\#p.t....v.d.`.
..[m......!...g..f.=.....][email protected])rhb.5..>...p.6.Y..R]...
i>.\..;[email protected]
j.A.{......tm..f.:......0...0...0.................%.0x..oY.0...*.H....
....0^1.0...U....US1.0...U....Symantec Corporation100...U...'Symantec 
Time Stamping Services CA - G20...140407000000Z..140706235959Z0m1.0...
U....US1.0...U....Symantec Corporation1?0=..U...6Symantec Time Stampin
g Services CA - G2 OCSP Responder0.."0...*.H.............0............
..9.....9.S.N.Q..HL..C5M..,g..C../.eR...v..C<qxY&'..\.h.=..h...t2.2
[email protected].../..% C...#.....Y....PL...=j.....r..X5
J./).Mg..&.o.2.L&.;,~.VJ ....c..c.K.....c...N...>?...})jP.RR2|, ..[
.....S.......g}[email protected]..! ..Pr.)<.a..{.:.......W........0..0... ...
..0......0!..U....0...0.1.0...U....TGV-B-6590...U.#..0..._..n\..t...}.
?..L...0...U.......VP...j..8.R..kL\...0...U.......0.0...U.%..0... ....
...0...U...........0...*.H.............%8..T.8.:[email protected]..}f>..P.
...Nd.6j.~l..P...a.g..e.._,.....Y..6P.lC5h..r..M.f.......).[..n-6.Q...
[email protected]@F.LhV9..%../..#........a..j.5....k|.......Q.i.&..X/U...f....
<<< skipped >>>


GET /installComplete.jhtml?close=true HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654036929&nv=12&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; anxs="s=486774368&sv=1402654016035&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; __CT_Data=gpv=1&apv_177_www06=1; WRUID=0; tbinstalled=false; dlput=YYA; cookie
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:21 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="/UhhXZj JXP8vWlpsd2HeZ6TbjmVBUbWkFvGCiEYAhDgRptlLIlXFkBjJMCo y33cCfCHIZ4TzBgM bjk11tGR54TrvXB1 Xfv2KO0d7WlK3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxeVh9iUDi 6MbKN/VlsvVmr6MdhiR ts3I xHVXBH7BogVvowqo2tM9gAL5aqIdBu5ikLdboZrOf AJ9JM7xpZdHSUdNflqpoe3zUzSwOvRJ98o/MevqZSv l8hLzICOEQ7bSLvwgPBy H5GpbxDpvrnpWOwlQe8abXDxNvxpVa3CDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFWkVUjXj4NFLpt9zwThtnQZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654041710&nv=13&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:21 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
2002.............}.w.F....9.?L.n%5z.o[.:...w..7v...7G."G...TI.........
C..l7..=.ncq..`0.......[......=...g'l..|v.....#f5....G....1....o^.n...
";......o.O~..5M..^.}}}.....h..x..A\],,.6..d.M\...&.73?...x.......@{..
L.......t..OZ..\..W...... ............9.8d.J.......Q.$<H...sn1G....
.$mdm.9S;.y28=......mv-...'v.......G.ln'..7....Nf..N...... ........;E.
.{..V...$6P............V............q|...F~....%.....cS....c....l.}...
...-.$.fv4..=.........^01........7.0.l..~...O<.n..4..............=.
.i.!..<....q..w...r...to{S..HF....$T.Zc?...|.(.)a.....z.M.y...4..s;
R.....5...2A.p]$2...Y.#....i...d.@{.Hf.W<.....=6.\....o.F.......?..
v5....._w:....,.r'.l.x.2.b...-.....=.K...4......|.U...|[email protected]
....5.r.......4.x.. Jb..*..d..!`..|;...."...&-..)...f.....H..I87..[G.K
./.$.R.......'o....y5.D7.Q....V.5..%........T.^.....C../E..p~..IM[.U..
.8...-..R].K.#.9..m.....{.k.I|.f.iP.$..dQ|..I^....$.b....DAu....l]....
T.N.....1o.fMM.#.)(.a2.C$J..3...C...y.t7......M.mP.;......(..$/j[5..GY
@....^P.\.......<...[v.gs.ws.f8.6.n0....%c.d.....B.._.f.Lw....s;Z..
N..w...........h...|_.. .j....97;K.s....v>N....)eO....x...i...|..w.
[.`Fe @,e.k.q..X...Px>(.0...v-.......T..$)..XkS..^.mr..4.."....b...
U.S.-..`.H..V.B.sW).j..f..N....9.....P...J.B....E..MM.z...D..MI}....x1
..PX^6.0.N.w..-}mjy|C4.\......5....|..._b._Y.j..{i..#.h..B.........~!.
.`..^P....x..-.D.^.O684s..p...............>...)....0.;7......(.Jp.=
.B......<..*........z.k..g....!u..$.d......(t..M"....I.d....n......
..........;.C..~.S..e-...=:...."....J...y.m-.:C..aI".".*.vt....."r
<<< skipped >>>


GET /images/anx/anemone-1.2.7.js HTTP/1.1
Host: ak.imgfarm.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 08 Jul 2013 20:02:48 GMT
ETag: "774114-a236-4e105875b5290"
Accept-Ranges: bytes
Content-Length: 41526
Cache-Control: max-age=309572103
Expires: Thu, 06 Jul 2023 20:02:48 GMT
Content-Type: application/javascript
Date: Fri, 13 Jun 2014 10:07:48 GMT
Connection: keep-alive
// You can define an _AnemoneParams global var with the following memb
ers (all are optional):..// uniqueUser: unique user ID (${eventRecord.
uniqueUserId}) -- if missing, will generate a value..// appId: applica
tion ID (${eventRecord.application}) -- if missing, will use current h
ostname..// appVersion: application build version (${eventRecord.appBu
ildVersion})..// appDate: application build date (${eventRecord.appBui
ldDate}) -- if missing, will attempt to use document.lastModified..// 
logPageView: if true, each page view will be logged (only do this if y
ou are not using server-side logging -- otherwise each page view will 
be logged twice)..// updateSession: if true, the session and referrer 
info in the cookie will be updated (only do this if you are not using 
server-side logging at all, or not using the Java servlet filter -- ot
herwise events may be double-counted and sessions may expire unexpecte
dly)..// domain: cookie domain (if not present, will use the last two 
components of the current hostname)..// url: base URL for callback (if
 not present, will use the current URL with "anemone.jhtml" instead of
 the page)..// getAppParams: function which returns an object whose pr
operty names/values will be logged for page views and events (values w
ill be URL-encoded)..// getAppCookieChips: function which returns an o
bject whose property names/values will be added to the Anemone cookie 
(names should begin with "x")..// getUserSegments: function which acce
pts an array of segment IDs and returns the array, possibly adding
<<< skipped >>>


GET /www/delivery/ti.php?trackerid=317 HTTP/1.1
Host: ads.ad4game.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8


HTTP/1.1 200 OK
Server: nginx
Date: Fri, 13 Jun 2014 10:08:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: close
X-Powered-By: PHP/5.3.3
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: OA4GUA=mozilla/5.0 (windows nt 6.1; wow64) applewebkit/537.36 (khtml, like gecko) chrome/35.0.1916.114  /537.36; expires=Sun, 13-Jul-2014 10:08:04 GMT; path=/; domain=ads.ad4game.com
Set-Cookie: OA4GBR=ch#35.0.1916.114#35#.0.1916.114##win#nt6.1#193.138.244.231#en-us,en#chrome; expires=Sun, 13-Jul-2014 10:08:04 GMT; path=/; domain=ads.ad4game.com
X-host: ads.ad4game.com
X-serveraddr: 10.57.60.90
X-servername: ads.ad4game.com\ 80\ 81
GIF89a.............!.......,...........D..;..



GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2HeZ6TbjmVBUbWkFvGCiEYAhDgRptlLIlXFkBjJMCo y33cCfCHIZ4TzBgM bjk11tGR54TrvXB1 Xfv2KO0d7WlK3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxeVh9iUDi 6MbKN/VlsvVmr6MdhiR ts3I xHVXBH7BogVvowqo2tM9gAL5aqIdBu5ikLdboZrOf AJ9JM7xpZdHSUdNflqpoe3zUzSwOvRJ98o/MevqZSv l8hLzICOEQ7bSLvwgPBy H5GpbxDpvrnpWOwlQe8abXDxNvxpVa3CDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFWkVUjXj4NFLpt9zwThtnQZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anxs="s=486774368&sv=1402654016035&sd=none&sp=-&sk=-&sm=-&sb=-&sc=-&ss=-"; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654042240&nv=14&t=-&v=-&p=-&si=-&sn=dfprdsndlfe5.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=32&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^yyyyyy^YYA^ua&xi=RUN_RUN&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=02b19170367349cab9cd8e64cea1ceff&xuer=3&xx=install"; __CT_Data=gpv=3&apv_177_www06=3; WRUID=0; tbinstalled=false; dlput=YYA; cookieEnabled=true


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:24 GMT
Server: Apache
Accept-Ranges: bytes
ETag: W/"894-1401391120000"
Last-Modified: Thu, 29 May 2014 19:18:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 241
Connection: close
Content-Type: image/x-icon
..........c``.B... )..... ......@!....8..sC0........DX........~.......
([email protected][email protected]...... ..b.....|[email protected].[..0. ..:
.b2.z.-@)..H8...T..._....."...&'.........l.........z..,........10.930.
[email protected]?..7O...4.~.....



GET /anemone.jhtml?anxuu=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe14.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654052862&anxsq=5&anxe=SplashLandingClicked&anxr=475871741 HTTP/1.1
Host: VVV.fromdoctopdf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Cookie: sessionData="RCxMB5msf8u5GsSwm4 kyTY5E6bbIJC4YvJo/el4rtcxWBDGbjVRYchQyyxWARpLxuQWljAedxSdh SiFsGi4Hh2pVaczSgB Vk5u3otxcP5J8v4vQNQAIBJnfgkI3VAC3L6jvaCWG481TBXkMQ7FnZWY3la6 ece4aE3Gwv7SES5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; anx="u=83CA3DF6-BF38-4CF8-920A-23F94EFD4E72&fv=1402654052847&lv=1402654053025&nv=5&t=-&v=-&p=-&si=-&sn=dfprdsndlfe14.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^foxyyy^YYA^ua&xi=XPI&xtp=vhigh&xs=15493&xp=vicinio&xrt=YYA&xt=rrdefaulta&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:35 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /ga.js HTTP/1.1
Host: VVV.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: hXXp://VVV.fromdoctopdf.com/
Connection: keep-alive


HTTP/1.1 200 OK
Date: Thu, 12 Jun 2014 23:42:41 GMT
Expires: Fri, 13 Jun 2014 11:42:41 GMT
Last-Modified: Thu, 29 May 2014 22:33:33 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15836
Cache-Control: public, max-age=43200
Age: 37492
Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f.....ZhiI..dY.iB.b.KI.o.gF.-'..9....n
byF..h4...../....z..|..y .b../......A_.S.....w......$2=.\..8e..:.G..].
.<.b....M_7.,.I...{..t<./s....x...,...(r4...8W|&N._K...M...p.\9.
..'.I.._.Jz.!.6.....8........P...F.......]H...-..!.M.t...?..6..5O..1..
p0..7.n$y*.z..Z...".W .8XE.....z.a....`.n....t....v.u..6.....A:H...=..
z.....!...5.u [email protected](;. ... W#.M..4
.0.u|.8..{..5...v.T.....5.@)..M..wr.....A>.v..%w..C.B..,Wjj8......j
.r./.Y..RI.6.(........T....Dq......Al...b...:.r.........}1.C...ZYv..y.
r.=d^.....T....L.U(.2 ...`..5......8.tD=..........c.#u.h...-..yu.....r
..?D....j.JQa.T.....f...G.q?r....7_llo>..@....].n;[email protected]_.@...
....#[email protected]...~.UL&...,X.a.Gl...C..c....W........i..2....w.V.{S
...T(w..KF........1.".......V..N.J V.y...K.....4....  .W...Y.......k$.
..r...P..H.J.^.......|... [email protected]..,|\AH`..._..k. x...A...d$.X.~.H
|.3..w>.@M"...s....1..Yi.#..G.........tO....v...1...{k.......np...8
y...Aa....V1.UvB...UJ.q.YC.=.W....1..Yns....s.8.....}..}.0h:......[.Q.
[email protected].}.(..Z.%..q....=Q.$HD....|.[Yq5A..rR.|.r...A....,....^.3
.w...4.:..3.=...>.Z_.A?2X.W..vl...Y.Q].....`VUv......9.R%<.k)..P
OLv..rm..Gc._j.cr/...yBjJ....:7....'....uQ.7.W..0s/K...|..*bY...&...pe
E.50.......&...T)-.-.)......A.."....aK...M.#.Y..... Js......ns.......V
....F;Q....0.P..S.L..l...B..&...nfX3d.....Z....5...6... :.[.{.".!.7*.0
...ylO..N...n ....r.M [email protected]..]W.u..D...m..J.5k..nT...t!.
..._..=..G.Y..^Y..f..]...d.N^....9....m1-0..`K.uB..R.MB.......%.!.
<<< skipped >>>


GET /serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^yyyyyy^YYA^ua&coId=02b19170367349cab9cd8e64cea1ceff&cake_id=&offer_id=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pixel.fetchback.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:27 GMT
Set-Cookie: fbid=hlA1LoyqkQpmabCWFbORtV; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:07:27 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Fri, 13 Jun 2014 10:07:27 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close
Transfer-Encoding: chunked
8e8.............X[s...~....2g...B.....(./J...c M3......L.*..vm....P.,.
.C...e`..],...........^.S...q.y..`.a.u./.{............c.a.....{ss..l8y
...3w F..[."..a.Y.WmI.....N[$"...\.............0^.]..v5o...N..E2..q7..
%..p.dJ4..LI. A6IS...5....'x.O...'.'..yF..3?"i...o....A..&...........w
/.]<..oF.............}..~_#9V..7.G.9..2./3.(.Q.2....M..........j_.z
.......j......;.|F."..!....ZR...M.A.....)..,<...............v..~...
..5....3|..O}.(.E^..p.8:....Z..HF<....$jB@...]Cv$.,8..e...[n..)w...
S.].).^...|.1.c.....T:6<....g..!.A.M2*.<...(..%.. v....o9.32Mb".
......g.....4.v.....%.....^.]!,.,...p:0P..Hw..b..{.~....o.1.Q...)..i..
.M...........p...>...bRd...4..t(D...s..0bC..<..t...3..b^ 3...E..
Wr..>......th.....x..,=|....P..Z....$M.?.....v..........I)x.....L..
.S..g[.'G{y&$M...J4..e.x.5......6Zp.U....A...............(...g...Lt@..
.M.....k. l.A....9`..R.......r<.h......u......^...M..p...d.....G.~.
.i..x.N..gX.f.2.A...SI./xi...%..A..)...$`...W.ho...?.(.a..;..#..... ..
... ...s.K.tc.{.'.1.a....B...|.:...gk.DN.....$)kEya..k.v..<...E..AJ
.....z......HE..d.I..X..X....u.l.. ..R.2..a........X0..J.R)O..\. y&=..
.Sw?...^V...;s.....B./..9.....v..."%[email protected]....
L{r....s..H. ...m..x>hZ.,...gC4....u.Q#......;...p"..av.]A-Q.....p.
...gL...Z.JO.[&.....- Ym.....p.!.21....'.@. ....|of..h.m#..........a.U
..I..V.[.3.~.......".o...!a3....L..-.us.:.w.a.G..G.B9.)........!.B..8%
. ..b..Yz..kX<[email protected]=......`...W...p.C...%...i...E....9i.
...y`....[[email protected].....'..IK.c.....d...f.*...P5...YY.~...|".....%&g
<<< skipped >>>


GET / HTTP/1.1
Host: VVV.fromdoctopdf.com
Connection: keep-alive
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: sessionData="KUDvVVAQLxDyVTTFzN4rcCwpMhvhfvV8Mqp6752LwC2X/zsVqvYOPkJYtkbuWdd3xuQWljAedxSdh SiFsGi4L0xKKYtjSSNfJw50jjYZQL5J8v4vQNQAIBJnfgkI3VAF7rdxM5BN2XUK05w6xLTztd//C4QT0cjief49K3MHMoS5sSUDVupjcLu0fmBSNV7wTkVYREC9dxMh2JJy7R8kUpkvjkpFtTzx RZ3yRmlYEAgWO3AM0ewUvlIm5VajI  48xI0oNt6IlYdivzZ6FqoSLMJloCN8pweqwNAuxuLuek245lQVG1pBbxgohGAIQ4EabZSyJVxZAYyTAqPst93AnwhyGeE8wYDPm45NdbRkeeE671wdfl379ijtHe1pS6oEmi3gXb9RF2xW2NkqZarfGMGl8xltYsZOj7yMzqrSLxjnccqzPuk71fgBajT00C/tpoCc597wpTJVBYqG GqY1o9LoXVQSI90JiAqPqU1YlcfeV/cyH74JAznZ7Q0cowBf6HL5 FVq0pHaSnmXsW6fb3bVQf D3xOFt/YpjgDXL9BYMsTAwc6rm/AjAUge9xA46QWI0dcj6RFzKYyBzg=="; partnerId=^Y6^chryyy^YYA^ua; installDate=2014061301; toolbarId=062329B0-5521-4737-A396-00ACFB474D4F; partnerSubId=; dlput=YYA; installType=CRX_WEBSTORE; pixelUrl=hXXp://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id=; successUrl=hXXp://VVV.fromdoctopdf.com/installComplete.jhtml; defaultSearchOption=true; defaultSearch=true; homePageOption=true; homePage=true; cookieEnabled=true; anx="u=245A566E-8953-4A13-83EC-4C8ED5D14DF5&fv=1402654068215&lv=140265
HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:07:50 GMT
Server: Apache
P3P: CP='CURa ADMa DEVa PSA PSD OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Set-Cookie: sessionData="b9HzKn44fQ916lYP0279s20CXp3Rsg/8xJ9cRob2SskrlqFVgWLktLXejfDjgTlTxGNOIxeyb2U0YYZ6dhDCHvrogh9jWDG5KpRa/dvKl65SNT9 QBEu4zB0FdHqzG3HW7UETwxFhzl8v2vYulSm8SlA71VQEC8Q8lU0xczeK3AsKTIb4X71fDKqeu di8Atl/87Far2Dj5CWLZG7lnXd37d9LddRB6WdJds9bOFaLxx18j2KUQf60LmWyrlwTw1UjaI2JBHG3bbHTgunCNQTHK0tPxYgE5h13zKzOlm4eLlQ73f/Q0HV9rBUCa4aokeD2m/B78jEFemrbthfh/TnAddkFGTk4YPLMWxd 6qJtiiIaYGgcxclIi/5mIUvLTfXGNF9KgMJevA30iQY34SZBn4gA/7TAQXkKXWJ 4qJeojhldwgEUttcJyo7wj31pjSHjMizXDMWaqOj/UyczrV4BmHzcCGoLQhR W5Uk2lqktj3DeGUK5TdAqt2CkFxIv SfaUQHy90X1sxm jcyPhrZaVY9ePe7m6XNQDpex8QF22759ZZzDU5JV2ShMfrAr/ADGN/85vJ54BvlqhS2m1pPfbKkLqjNmvN/yjiNTXls="; Version=1; Domain=.fromdoctopdf.com; Path=/
Set-Cookie: anx="u=245A566E-8953-4A13-83EC-4C8ED5D14DF5&fv=1402654068215&lv=1402654070874&nv=5&t=-&v=-&p=-&si=-&sn=dfprdsndlfe20.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=13.0 r0&g=-&xrp=^Y6^yyyyyy^YYA^ua&xh=7998&xpp=^Y6^chryyy^YYA^ua&xi=CRX_WEBSTORE&xtp=vhigh&xs=22641&xp=vicinio&xrt=YYA&xt=intdefaultcrx&xrco=Y6&xgc=false&xrca=yyyyyy&xrcc=ua&xcid=a32478ee78164a828a23db60ad1f373f&xuer=3&xx=install&xnt=&xn=&xrm=&xct=&xu=&xrs=&xkw=&xit=&xg=&xbkw=&xft=&xad="; Version=1; Domain=.fromdoctopdf.com; Max-Age=7776000; Expires=Thu, 11-Sep-2014 10:07:50 GMT; Path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Language: en-US
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
1ff8.............}.[.........AQ{b9...!...C.4.....B...-.V"[.$s).......v
u.!.iO.7>............~.?.).{.`so..d.............a.4..,o4..G......7F
..h...(.. ..a....4.A..........r#........jaa.u!UJ6..3_.....H..)s2S..s..
..{N$_..Q....z.....k{>.]...J.4._<[email protected].].
.1S.*m".....q..........D<s.......N.A. .M.QA<?.....2....}..^R.J..
.7R .S.M..j>2~.G~....&r..y...c.....h.X._.Y....`.W.zP...Z._..q......
/.4....@w.$~............Q......#..k...ip....e....'.Y5s...e.."....#7}..
RA1%[email protected]:Q:hkeF...Eb.)#.X^.X..^p...<.Bw.1......
^.\.........*..(W..Q..w@u<[email protected].:....w..%.k.I&c.....$.._3.Q...
..y.ol.....pq..K.j... .}j(......%.....X3V[Oe..<..s.c...X'.>bL.&n
.n...JCZ...4 ...H.%.n'..I*.N..*..;.7g.$M.QVg)&&...........U...(....s..
H.b.t&a..Sh......B0E... V.(.o.rR.....?ep...[...:...C.......BY8......d.
&...i4...x/........T......%.Ux.`....!n.Z....5......L%..?Y...L.P..f.P..
.u...y.....qF......_.4......8.Sw..Y..N.X.....`..4:7.,i.... ....8..c..~
........A:..~h*L.~..I'..v..-i..P.....|\^.H<x.....8..w..ES..}%&.|.)X
?.r>^,X..J.:n.S?....8........cc............D...J...v.z3..P.. .!.B..
.......k..f..'Y...x.S. .>..C.1v.'X.8...W..`....~c.-..........O\....
..@e......(.....B....E..I.~-......_..3..D&H@.....~.bt..!?.,KU..;G..y..
.y...Q./.'..P. .{.w9W.4P. )&......9....C...;.C.{...F0...x..F.&.$......
..%.....M.Qc...`s...fk....m......Q.ekN|..c....H...*...onn=.Z......%...
.V2fg......GKY.=.<?....<.9.s.N.p..6vFI.O.i.#.~....~/.:[email protected]..>
;%\......H....A...?.V......(2.0 ..........}w..J....#.S..........".
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654026464&anxsq=10&searchAssistantOptIn=true&homePageOptIn=true&tbUID=7BE109F9-E265-40DB-885D-AC3553B091B9&tbVer=2.5.14.85&anxe=InstallerFinished&anxr=1803291899 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654036891&nv=11&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy%
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:21 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain



GET /serve/fb/pdc?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID&xr=2972455870849468926&referer=http://VVV.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^chryyy^YYA^ua&coId=a32478ee78164a828a23db60ad1f373f&cake_id=&offer_id= HTTP/1.1
Host: pixel.fetchback.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Accept: */*
Referer: hXXp://pixel.fetchback.com/serve/fb/pdj?cat=&name=success&sid=4242&crv=CLIENT_REVENUE&oid=ORDER_ID
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: fbid=4kZRj2AIpsCP4lfVOnSLkI


HTTP/1.1 200 OK
Date: Fri, 13 Jun 2014 10:08:05 GMT
Set-Cookie: fbid=4kZRj2AIpsCP4lfVOnSLkI; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: uid=2_1402654085_1402654085045-2886897097294093; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: kwd=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: uat=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: bpd=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: cmp=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: clk=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: afl=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: sit=2_1402654085_4242-0-0; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: cre=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: scg=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: apd=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: fbid=4kZRj2AIpsCP4lfVOnSLkI; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: eng=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: ppd=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Set-Cookie: act=2_1402654085; Domain=.fetchback.com; Expires=Wed, 12-Jun-2019 10:08:05 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Fri, 13 Jun 2014 10:08:05 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close
Transfer-Encoding: chunked
238.............T]k.0.}7.?...M....8.....B..eo..Y.....YNj.....<.m.i/
.#..]K.....r6#.W-W..\...M....j....l.q....N.. .i?.A....%.Qd\...........
...=7..4.S...\...`H.7.p;aq. .U...][email protected].#.1..>` J...i8@...........,~
.....E.E..I...d.b.. A....'...{..x<.R7U........VugxY.F]..Z.....-....
.,....Q.a.l4p.{n..x..E..`....',.,....|..e(m&....l.Hy....?x.....2.). ..
.f..~......s...E....Z ...n..<.,^D..:Z...$X"K.E...*t.....E&.......i.
.l4&..G.*7E..=R...f\..g.....Y_~U.\>=....J'.j.)y....R........ZD....'
x....F551...7..oe....5.%.p...w....{...N.........R:.s.....%.u...I.6....
5. .\.t.l'...sC8.;............a......N.4.....0..
<<< skipped >>>


GET /anemone.jhtml?anxuu=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&anxa=CAPDownloadProcess&anxv=1.0.0&anxd=2011-06-01T04:00:00Z&anxsn=dfprdsndlfe21.df.jabodo.com&anxu=http://VVV.fromdoctopdf.com/&anxl=en-US&anxlv=1402654036891&anxsq=11&popStyle=up&url=http://VVV.fromdoctopdf.com/ieEnable.jhtml?successurl=installComplete.jhtml&anxe=PostInstallPop&anxr=869555314 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.fromdoctopdf.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.fromdoctopdf.com
DNT: 1
Connection: Keep-Alive
Cookie: sessionData="/UhhXZj JXP8vWlpsd2Hefe4Btdi3wD1t4uMbRKMNjXcUdck9EAhY4CILC4uwrSzaBOjRqt2qybk0VJpc7ji7k7EoAYVt9Mx3gPYa0G0Cny3SiG3e2lVftdFKDemtcMFsaMrbJZjGRACWMKdVQevupyBKdDwMxzj0NxFRnxBmxcB9y8ttHrU7XNVlI6hzCbuj6fV3egGMJJ/suHllaouPeu b98O/YNgkLlx hYzTHl6K/TqWhf0 wikLiWI08bB73zY1UHaeFQR/oaYEifjC P8qAowwoiTGvMoZDi00aO0qfXfXwnYsIIVCfOhY934YYmNsvboNqn   xRjGH/QSDXhtSy573XO1MdcDxAuEEC0vyGExmUV85CRKson2Yw8PUKkucquRa7cCLEB2knJ4FMDndDXnC68P 42GOGfkg5ZTdupTFEDuAa 3Fw3YGMvy7OmlSoCb pavIwPBssjvMhDr09QEfWObUIULksUVFt5BnAZzTCs1E 76vqi ObZNebsDC2yru4b3W2b5PsdXBL/Dif6mpoWVZdy9k9m3uLjgrUpelvAn8ttx/YBhg64n08jI1FkBdNjHhKhbGJ1w=="; anx="u=EFBCF44A-9E82-40AA-8DC7-8C3E544E09EB&fv=1402654016034&lv=1402654036929&nv=12&t=-&v=-&p=-&si=-&sn=dfprdsndlfe24.df.jabodo.com&od=none&op=-&ok=-&om=-&ob=-&oc=-&os=-&w=1716&h=901&cd=24&f=-&g=-&xrp=^Y6^yyyyyy^YY
HTTP/1.1 204 No Content
Date: Fri, 13 Jun 2014 10:07:21 GMT
Server: Apache
Content-Length: 0
Connection: close
Content-Type: text/plain







The Trojan connects to the servers at the folowing location(s):







65srchmn.exe_3928:




.text
`.rdata
@.data
.rsrc
@.reloc
GetProcessWindowStation
operator
t8res.dll
srchmr.dll
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\t8SrchMn.pdb
GetCPInfo
KERNEL32.dll
C:\PROGRA~2\FROMDO~2\bar\1.bin\65srchmn.exe
C:\PROGRA~2\FROMDO~2\bar\1.bin\t8res.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
KERNEL32.DLL
WUSER32.DLL
1, 0, 1, 0
t8SrchMn.exe
2, 3, 0, 0

65barsvc.exe_3956:




.text
`.rdata
@.data
.rsrc
@.reloc
t%SVW
GetProcessWindowStation
operator
%s error: %d
Unable to install %s - %s
%s installed.
Starting %s.
%s started.
%s failed to start.
CreateService failed - %s
OpenSCManager failed - %s
Stopping %s.
%s stopped.
%s failed to stop.
%s removed.
DeleteService failed - %s
OpenService failed - %s
%s (0x%x)
t8res.dll
\\.\pipe\
Unable to create named pipe
STUB.DLL
TRACE.LOG
MEDINT.EXE
HIGHIN.EXE
FFXTBR.MANIFEST
FFXTBR.JAR
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{
advapi32.dll
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\t8barsvc.pdb
SHDeleteKeyA
SHLWAPI.dll
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
GetCPInfo
KERNEL32.dll
USER32.dll
ReportEventA
ImpersonateNamedPipeClient
RegCreateKeyExA
RegCloseKey
ADVAPI32.dll
C:\PROGRA~2\FROMDO~2\bar\1.bin\65barsvc.exe
C:\PROGRA~2\FROMDO~2\bar\1.bin\t8res.dll
%ProgramFiles%\Mozilla Firefox\chrome
%ProgramFiles%\Mozilla Firefox\plugins
%ProgramFiles%\Windows Live\Messenger
%ProgramFiles%\Netscape\Netscape Browser\chrome
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
mscoree.dll
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
kernel32.dll
1, 0, 1, 0
2009, 2010, 2011, 2012
TWOLETTERPREFIXVERSsvc.exe
2, 3, 0, 0

65brmon.exe_3984:




.text
`.rdata
@.data
.rsrc
@.reloc
operator
GetProcessWindowStation
SetProcessShutdownParameters
t8res.dll
brstub.dll
9E107788-A2C8-4ff7-A5E6-8052455B4AED
19D1D781-6DA9-4781-BC16-9017E355E2F9
67DE0C3F-8D3D-4347-808F-D4CE05C7A6B8
advapi32.dll
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\t8brmon.pdb
KERNEL32.dll
UnhookWindowsHookEx
SetWindowsHookExA
USER32.dll
SHLWAPI.dll
GetCPInfo
C:\PROGRA~2\FROMDO~2\bar\1.bin\65brmon.exe
C:\PROGRA~2\FROMDO~2\bar\1.bin\t8res.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
KERNEL32.DLL
WUSER32.DLL
kernel32.dll
VER_EXE_FILENAME
VER_EXE_FILENAME.exe

65HighIn.exe_4016:




.text
`.rdata
@.data
.rsrc
@.reloc
SHLWAPI.dll
KERNEL32.dll
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\t8HighIn.pdb
t8HighIn.exe

IEXPLORE.EXE_3092:




.text
`.data
.idata
.rsrc
@.reloc
u\j.Xf9
j.Xf9
USER32.dll
api-ms-win-downlevel-shell32-l1-1-0.dll
IEFRAME.dll
SHELL32.dll
iexplore.pdb
api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey
name="Microsoft.InternetExplorer"
true
KEYW
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
imm32.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
Kernel32.dll
"%s" %s
kernel32.dll
IEXPLORE.EXE
{00000000-0000-0000-0000-000000000000}
\\?\Volume
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows_TabProc
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute
IMTravelLogMVC_TravelURL
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
Windows
10.00.9200.16521

65medint.exe_3432:




.text
`.rdata
@.data
.rsrc
@.reloc
SHLWAPI.dll
KERNEL32.dll
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\t8MedInt.pdb
t8MedInt.exe

IEXPLORE.EXE_3092_rwx_05D77000_00001000:




origURL
igURL

firefox.exe_3420:




.text
`.rdata
@.data
.rsrc
@.reloc
https://crash-reports.mozilla.com/submit?id={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&version=29.0.1&buildid=20140506152807
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
20140506152807
29.0.1
Firefox
Mozilla
Couldn't read application.ini
Couldn't set %s.
XUL_APP_FILE=%s
application.ini path not recognized: '%s'
Incorrect number of arguments passed to -app
Invalid path found: '%s'
Could not find the Mozilla runtime.
xul.dll
.gtest
dependentlibs.list
\dependentlibs.list
c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb
KERNEL32.dll
_amsg_exit
MSVCR100.dll
mozglue.dll
_crt_debugger_hook
version="1.0.0.0"
name="Firefox"
Firefox
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
f^.mHuQ8
.KscP
yy.QG
c"=Ýp
.CE&I8
%d>ZZ
\LMQ!)%C
Wuser32.dll
kernel32.dll
Firefox and Mozilla Developers; available under the MPL 2 license.
Mozilla Corporation
Firefox is a Trademark of The Mozilla Foundation.
firefox.exe

assist.exe_3624:




.text
`.rdata
@.data
.rsrc
@.reloc
operator
GetProcessWindowStation
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\IEDefaultSearchProvider.pdb
OLEACC.dll
KERNEL32.dll
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
RegCloseKey
RegOpenKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
GdiplusShutdown
gdiplus.dll
MSIMG32.dll
GetProcessHeap
GetCPInfo
zcÁ
.?AV?$CAtlExeModuleT@VCIEDefaultSearchProviderModule@IEDefaultSearchProvider@AssistMonitor@IAC@@@ATL@@
qiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        y
!iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        ;
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
document.getElementById('content').innerHTML = 'Select "Change to '   location.search.substring(1)   '" at right to enable your browser\'s default search provider.';
document.getElementById('content').innerHTML = 'To keep your default search provider from changing, select "Keep using '   location.search.substring(1)   '" at right.';
To get help manually changing your default search settings, click here.
PADtruePAD
9%9.9@9^9
8&9,949{9
5P54595
> ><>@>\>`>
ekernel32.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
wKERNEL32.DLL
WUSER32.DLL
companyKey
Mscoree.dll
C:\PROGRA~2\FROMDO~2\bar\1.bin\assists\ie_default_search_provider\assist.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
1.0.7.183
assist.exe
IEDefaultSearchProvider.exe

CrExtP65.exe_2788:




.text
`.rdata
@.data
.rsrc
@.reloc
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
QVSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
SHELL32.dll
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\bidirectionalcommunicationprotocol\CIdentifierTrait.h
CBcp.cpp
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\bidirectionalcommunicationprotocol\CRpcCall.h
CCommunicationTrait.cpp
CSharedMemoryTrait.cpp
CRpcBingdingHandle.cpp
FreeRpcString::operator ()
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
MaxPolicyElementKey
()$^.* ?[]|\-{},:=!
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPMessage.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPBcpHelper.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPLocalBcp.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPEvent.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPImpl.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPHandshake.h
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Common\ResultInfo.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\services\extensioninternalapi\ScreenInfo.h
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Toolbar\ChromeExtAPI\Services\ExtensionInternalApi\CExtensionInternalApi.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPProviderImplBase.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPLocalProviderImplBase.h
IAC::ExtensionInternalApi::Internal::CDispatchImpl::get_WebBrowserHostManager
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
JavaScriptDebugTrace.cpp
JavaScriptTraceLog.cpp
ServiceManager.cpp
CommandLineParameters.cpp
([^"]{1,64})
ExtensionInformationManager.cpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/json_parser_read.hpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/ptree_implementation.hpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/string_path.hpp
ExtensionLifetime.cpp
EventMonitoring.cpp
IAC::EventMonitoringService::`anonymous-namespace'::::operator ()
IAC::EventMonitoringService::CEventMonitoring::CThreadPoolWorker::Execute
MRPLib.cpp
IAC::WebBrowserHostManagerService::CWebBrowserTraits::GetExternal
WebBrowserHostManager.cpp
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::FinalConstruct
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::Get
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::GetAll
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::CWebBrowserHost::GetProperty
IAC::WebBrowserHostManagerService::CChromeExtensionTraits::GetExtensionScriptCode
PluggableNamespaceHandler.cpp
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::Start
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::Read
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::ParseUrl
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::CombineUrl
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::QueryInfo
ButtonWindowProvider.cpp
ButtonWindow.cpp
IAC::ExtensionInternalApi::Internal::CDispatchImpl::get_WebBrowserHostManager
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/json_parser_write.hpp
WidgetStorage.cpp
WidgetPropertyBag.cpp
Clipboard.cpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\CrExtProc.pdb
DisconnectNamedPipe
SetNamedPipeHandleState
CreateIoCompletionPort
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CallMsgFilterW
EnumChildWindows
USER32.dll
GDI32.dll
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
UrlCanonicalizeW
UrlUnescapeW
UrlCreateFromPathW
UrlIsW
SHRegCloseUSKey
SHRegEnumUSKeyW
SHDeleteKeyW
SHRegOpenUSKeyW
SHRegDeleteEmptyUSKeyW
SHRegCreateUSKeyW
SHLWAPI.dll
USERENV.dll
VERSION.dll
CoInternetGetSecurityUrl
urlmon.dll
RPCRT4.dll
GetProcessHeap
GetCPInfo
zcÁ
.?AV?$IDispatchImpl@UIEventMonitoringSink@@$1?_GUID_606969f9_21d6_41dc_ac9f_8c3a6211daf0@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserEvents@CExtensionProcess@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AVCWebBrowserEvents@CExtensionProcess@@
.?AV?$CComObject@VCWebBrowserEvents@CExtensionProcess@@@ATL@@
.?AV?$CAtlExeModuleT@VCExtensionProcess@@@ATL@@
.?AV?$IDispatchImpl@UIClipboard@@$1?_GUID_028531e1_5078_4242_81cb_7cc385af4d6f@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPProvider@@$1?IID_IMRPProvider@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIScreenInfo@@$1?_GUID_277c85f9_1df0_4f37_bd20_c8e0c9724c35@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRP@@$1?IID_IMRP@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPEvent@@$1?IID_IMRPEvent@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPIdentifier@@$1?IID_IMRPIdentifier@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPListener@@$1?_GUID_c300902d_0d9c_41d7_ae6f_850c508e3b37@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIExtensionInternalApi@@$1?_GUID_7d292731_4f6a_4e24_8da5_fddb3bcd6b29@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIJavaScriptDebugTrace@@$1?_GUID_f1d98e10_c66e_4303_b17e_debc666339ca@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIJavaScriptTraceLog@@$1?_GUID_b01322d8_dcd1_4404_af09_fd6e098504e0@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIScreenRect@@$1?IID_IScreenRect@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIResultInfo@@$1?_GUID_a042acb5_d06f_40e6_9e8f_6fd46d6c9805@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIPersistentStorage@@$1?_GUID_c152443c_6576_47df_a3a7_5bb882bea699@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$CExtensionInformationManagerServiceConsumer@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@IAC@@
.?AUIWebBrowserHostManager@@
.?AV?$IDispatchImpl@UIWebBrowserHostManager@@$1?_GUID_dff2bf4a_3ac4_478c_b12b_d1573ffcd07f@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IObjectWithSiteImpl@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$IDispatchImpl@UITraceFilter@@$1?_GUID_54594249_f9cc_4304_8c93_defa2a0b94da@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIExtensionInfo@@$1?_GUID_04c7b726_0fae_4dc5_b1e8_bc53e6d2d72f@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AV?$CThreadPool@VCThreadPoolWorker@CEventMonitoring@EventMonitoringService@IAC@@VCRTThreadTraits@ATL@@VWin32WaitTraits@6@@ATL@@
.?AVCPluggableNamespaceHandlerClassFactory@WebBrowserHostManagerService@IAC@@
.?AV?$CComObjectNoLock@VCPluggableNamespaceHandlerClassFactory@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CWindowImpl@VCSublassedChildWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AVCSublassedChildWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CWindowImpl@VCParentWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AVCParentWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AV?$CWindowImpl@VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AUIWebBrowserHost@@
.?AV?$IDispatchImpl@UIWebBrowserHost@@$1?_GUID_2182956c_9e99_42ab_ab3d_e0e9f630991d@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AVCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CComContainedObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CComAggObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$IDispatchImpl@UIRichButtonWindow@@$1?_GUID_d3335624_ab87_4419_82c8_113318ec36be@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIUntrustedButtonWindow@@$1?_GUID_fc992dd0_3c68_432a_8925_d99dadb06736@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIInternalApiForUntrustedButtonWindow@@$1?IID_IInternalApiForUntrustedButtonWindow@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIInternalApiForButtonWindow@@$1?_GUID_6122aea5_a1b7_4ce5_b908_91bd0d271c28@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UISecureHTMLChild@@$1?_GUID_b6c6d0da_8dfc_4e05_ab76_73ecbb568c29@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AUIHTMLOMWindowServices@@
.?AV?$IServiceProviderImpl@VCWebBrowserHost@ButtonWindow@IAC@@@ATL@@
.?AV?$CWindowImpl@VCWebBrowserHost@ButtonWindow@IAC@@VCWindow@ATL@@V?$CWinTraits@$0MPAAAA@$0A@@5@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserHost@ButtonWindow@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AV?$IDispEventImpl@$00VCWebBrowserHost@ButtonWindow@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B$1?LIBID_SHDocVw@@3U_GUID@@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@
.?AVCWebBrowserHost@ButtonWindow@IAC@@
.?AV?$CComObject@VCWebBrowserHost@ButtonWindow@IAC@@@ATL@@
.?AV?$IDispatchImpl@UIPropertyBagDisp@@$1?_GUID_878d78ad_8fe3_4c7c_bf55_16d3458c011e@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
stdole2.tlbWWW
ChromeExtLib
muMsgType
.IBrowserInformationWL
btFirefoxWWW
keys
KCoLaunchEXEW(
tagMSGWW
pMsg(
IEXELauncher
sendLaunchExeWWW
sendDetectExeWWW
WebBrowserHostManagerWWW
r.UserData
|IWebBrowser2
%IWebBrowserAppWW$
8;'IWebBrowserW$
URLW
LocationURLW$
OLECMDID
OLECMDID_OPENWWW
`OLECMDID_NEW
OLECMDID_SAVEWWW
gOLECMDID_SAVEASW
OLECMDID_SAVECOPYASW
OLECMDID_PRINTPREVIEWWWW
OLECMDID_PAGESETUPWW
0>QOLECMDID_SPELLWW
0yGOLECMDID_PROPERTIESW
(OLECMDID_CUT
OLECMDID_COPYWWW
0VROLECMDID_PASTEWW
EOLECMDID_PASTESPECIALWWW
OLECMDID_UNDOWWW
OLECMDID_REDOWWW
OLECMDID_SELECTALLWW
OLECMDID_CLEARSELECTIONW
0gdOLECMDID_ZOOMWWW
0.wOLECMDID_GETZOOMRANGEWWW
;OLECMDID_UPDATECOMMANDSW
OLECMDID_REFRESH
OLECMDID_STOPWWW
OLECMDID_HIDETOOLBARSWWW
OLECMDID_SETPROGRESSMAXW
OLECMDID_SETPROGRESSPOSW
9OLECMDID_SETPROGRESSTEXT
OLECMDID_SETTITLEWWW
SOLECMDID_SETDOWNLOADSTATEWWW
VOLECMDID_STOPDOWNLOADWWW
|OLECMDID_ONTOOLBARACTIVATEDW
OLECMDID_FINDWWW
OLECMDID_DELETEW
#OLECMDID_HTTPEQUIVWW
!OLECMDID_HTTPEQUIV_DONEW
pOLECMDID_ENABLE_INTERACTIONW
OLECMDID_ONUNLOADWWW
OLECMDID_PROPERTYBAG2WWW
0DZOLECMDID_PREREFRESHW
OLECMDID_SHOWSCRIPTERROR
OLECMDID_SHOWMESSAGE
OLECMDID_SHOWFINDWWW
0?BOLECMDID_SHOWPAGESETUPWW
OLECMDID_SHOWPRINTWW
0dROLECMDID_CLOSEWW
OLECMDID_ALLOWUILESSSAVEASWW
OLECMDID_DONTDOWNLOADCSS
OLECMDID_UPDATEPAGESTATUSWWW
OLECMDID_PRINT2W
vOLECMDID_PRINTPREVIEW2WW
rOLECMDID_SETPRINTTEMPLATEWWW
0_sOLECMDID_GETPRINTTEMPLATEWWW
0OLECMDID_PAGEACTIONBLOCKEDWW
0cmOLECMDID_PAGEACTIONUIQUERYWW
OLECMDID_FOCUSVIEWCONTROLSWW
OLECMDID_FOCUSVIEWCONTROLSQUERYW
OLECMDID_SHOWPAGEACTIONMENUW
OLECMDID_ADDTRAVELENTRYW
OLECMDID_UPDATETRAVELENTRYWW
OLECMDID_UPDATEBACKFORWARDSTATEW
OLECMDID_OPTICAL_ZOOMWWW
0snOLECMDID_OPTICAL_GETZOOMRANGEWWW
OLECMDID_WINDOWSTATECHANGEDW
OLECMDID_ACTIVEXINSTALLSCOPE
OLECMDID_UPDATETRAVELENTRY_DATARECOVERYW
OLECMDID_SHOWTASKDLG
OLECMDID_POPSTATEEVENTWW
pOLECMDID_VIEWPORT_MODEWW
OLECMDID_LAYOUT_VIEWPORT_WIDTHWW
'0]mOLECMDID_VISUAL_VIEWPORT_EXCLUDE_BOTTOMW
OLECMDID_USER_OPTICAL_ZOOMWW
OLECMDID_PAGEAVAILABLEWW
0$6OLECMDID_GETUSERSCALABLE
OLECMDID_UPDATE_CARETWWW
OLECMDID_ENABLE_VISIBILITYWW
0W%OLECMDID_MEDIA_PLAYBACKW
OLECMDID_SETFAVICONW
OLECMDID_SET_HOST_FULLSCREENMODE
5OLECMDID_EXITFULLSCREENW
OLECMDID_SCROLLCOMPLETEW
OLECMDID_ONBEFOREUNLOADW
OLECMDFW
KOLECMDF_SUPPORTEDWWW
OLECMDF_ENABLEDW
OLECMDF_LATCHEDW
OLECMDF_NINCHEDW
09vOLECMDF_INVISIBLEWWW
$OLECMDF_DEFHIDEONCTXTMENUWWW\
cmdIDWWW
npcmdfWWWP
OLECMDEXECOPTWWWP
OLECMDEXECOPT_DODEFAULTWP
OLECMDEXECOPT_PROMPTUSERP
0:*OLECMDEXECOPT_DONTPROMPTUSERP
OLECMDEXECOPT_SHOWHELPWW\
cmdexecoptWW
webBrowserWW
{ppWebBrowser
8[.IMRPResponseCallback
81YIWebBrowserHostManagerWWd
IWebBrowserHostW
ppWebBrowserHost
pUnkWebBrowserHostEvents
gpvarWebBrowserHostsW
-8Xd__MIDL___MIDL_itf_ChromeExtLib_0001_0045_0001WWW
ct_ComplexEdgeWW
0z.ct_ViewObjWW,
Chrome Extension LibraryWW
Version of the browser as a string (major.minor.build.revision&
An empty property bag that can be filled and then stored by passing it to SaveStoredDataWW
IEXELauncher Interface
Web Browser Interface for IE4."
Web Browser Application Interface.
Web Browser interfaceW3
Navigates to the previous item in the history list.WWW/
Navigates to the next item in the history list.WWW
Go home/start page.WWW
Go Search Page.WWW
Navigates to a URL or file.WWW"
Returns the application automation object if accessible, this automation object otherwise..WWW^
Returns the container/parent automation object, if any.WWW6
The vertical position (pixels) of the frame window relative to the screen/container.WW=
The vertical dimension (pixels) of the frame window/object.WWWC
Gets the short (UI-friendly) name of the URL/file currently viewed.WWW(
Gets the full URL/path currently viewed.WW/
Query to see if something is still in progress.WWW/
Exits application and closes the open document.WWW(
Converts client sizes into window sizes.WWI
Associates vtValue with the name szProperty in the context of the object.WT
Retrieve the Associated value for the property vtValue in the context of the object.WW
Returns name of the application.WW*
Returns the path to the application.WW8
Determines whether the application is visible or hidden.WW
Controls which toolbar is shown.WW"
Navigates to a URL or file or pidl.WWW
IOleCommandTarget::ExecWWW
Reports the results of a read operationWWW'
IWebBrowserHostManager InterfaceWW
IWebBrowserHost InterfaceW
Created by MIDL version 7.00.0555 at Fri Mar 14 20:00:13 2014
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
//Replace window.alert so that the message box window does not take over
window.external.alert(message);
window.alert = alertDebug;
2011-10-19
See http://www.JSON.org/js.html
See http://javascript.crockford.com/jsmin.html
JSON.stringify(value, replacer, space)
will be passed the key associated with the value, and this will be
Date.prototype.toJSON = function (key) {
return this.getUTCFullYear()   '-'  
f(this.getUTCMonth()   1)   '-'  
f(this.getUTCDate())   'T'  
f(this.getUTCHours())   ':'  
f(this.getUTCMinutes())   ':'  
f(this.getUTCSeconds())   'Z';
You can provide an optional replacer method. It will be passed the
key and value of each member, with this bound to the containing
such that only members with keys listed in the replacer array are
JSON.stringify(undefined) returns undefined.
text = JSON.stringify(['e', {pluribus: 'unum'}]);
text = JSON.stringify(['e', {pluribus: 'unum'}], null, '\t');
text = JSON.stringify([new Date()], function (key, value) {
return this[key] instanceof Date ?
'Date('   this[key]   ')' : value;
JSON.parse(text, reviver)
transform the results. It receives each of the keys and values,
myData = JSON.parse(text, function (key, value) {
/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2}(?:\.\d*)?)Z$/.exec(value);
return new Date(Date.UTC( a[1],  a[2] - 1,  a[3],  a[4],
myData = JSON.parse('["Date(09/09/2001)"]', function (key, value) {
value.slice(0, 5) === 'Date(' &&
value.slice(-1) === ')') {
d = new Date(value.slice(5, -1));
getUTCMinutes, getUTCMonth, getUTCSeconds, hasOwnProperty, join,
if (typeof Date.prototype.toJSON !== 'function') {
return isFinite(this.valueOf())
? this.getUTCFullYear()   '-'  
f(this.getUTCDate())   'T'  
f(this.getUTCHours())   ':'  
f(this.getUTCMinutes())   ':'  
f(this.getUTCSeconds())   'Z'
String.prototype.toJSON =
Number.prototype.toJSON =
Boolean.prototype.toJSON = function (key) {
return this.valueOf();
'"': '\\"',
'\\': '\\\\'
escapable.lastIndex = 0;
return escapable.test(string) ? '"'   string.replace(escapable, function (a) {
: '\\u'   ('0000'   a.charCodeAt(0).toString(16)).slice(-4);
function str(key, holder) {
// Produce a string from holder[key].
k, // The member key.
value = holder[key];
typeof value.toJSON === 'function') {
value = value.toJSON(key);
value = rep.call(holder, key, value);
if (Object.prototype.toString.apply(value) === '[object Array]') {
length = value.length;
// Join all of the elements together, separated with commas, and wrap them in
v = partial.length === 0
? '[\n'   gap   partial.join(',\n'   gap)   '\n'   mind   ']'
: '['   partial.join(',')   ']';
length = rep.length;
partial.push(quote(k)   (gap ? ': ' : ':')   v);
// Otherwise, iterate through all of the keys in the object.
if (Object.prototype.hasOwnProperty.call(value, k)) {
// Join all of the member texts together, separated with commas,
? '{\n'   gap   partial.join(',\n'   gap)   '\n'   mind   '}'
: '{'   partial.join(',')   '}';
if (typeof JSON.stringify !== 'function') {
JSON.stringify = function (value, replacer, space) {
// that can replace values, or an array of strings that will select the keys.
typeof replacer.length !== 'number')) {
throw new Error('JSON.stringify');
// Make a fake root object containing our value under the key of ''.
if (typeof JSON.parse !== 'function') {
JSON.parse = function (text, reviver) {
function walk(holder, key) {
var k, v, value = holder[key];
return reviver.call(holder, key, value);
// Parsing happens in four stages. In the first stage, we replace certain
cx.lastIndex = 0;
if (cx.test(text)) {
text = text.replace(cx, function (a) {
('0000'   a.charCodeAt(0).toString(16)).slice(-4);
// We split the second stage into 4 regexp operations in order to work around
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
// JavaScript structure. The '{' operator is subject to a syntactic ambiguity
// In the optional fourth stage, we recursively walk the new structure, passing
throw new SyntaxError('JSON.parse');
failureInfo.description = e;
failureInfo.number = e;
failureInfo.description = e.toString();
if (e.number != undefined)
failureInfo.number = e.number.toString();
if (e.description != undefined && typeof e.description == 'string')
failureInfo.description = e.description;
else if (e.message != undefined && typeof e.message == 'string')
failureInfo.description = e.message;
var ButtonWindowSendMessageID = 2; //This message ID is being used for all SendRequest message in untrusted button window
this.onMessage = function (callback) {
mrp.GetEvent(ButtonWindowPostMessageID).AddListener(
{ OnMessage: function (type, msg, messageexchangeId, mrpIdentifier, handled) {
callback({ message: msg });
this.onRequest = function (callback) {
mrp.GetEvent(ButtonWindowSendMessageID).AddListener(
callback({ message: msg }, function (message) {
mrp.SendResponse(message, messageexchangeId);
this.postMessage = function (message) {
mrp.PostMessage(ButtonWindowPostMessageID, message);
this.sendRequest = function (message, callback) {
mrp.SendRequest(ButtonWindowSendMessageID, message, {
OnResponse: function (msg) {
OnError: function (err, msg) {
P// the only global variable that should be defined by the chrome extension. All others fall under a
var iacbar = { adapter: { traceLog: window.external.TraceLog } };
var XMLHttpRequestCallID = 2;
this.top = top;
this.left = left;
this.width = width;
this.height = height;
var extID = window.external.ExtensionInfo.extensionId;
this.m_internalAPI_MRP = window.external.InterprocessCommunicationService.Get("EBP_"   extID, "EC_"   extID, "Ticker");
iacbar.adapter.traceLog.sendLogError(" Error #"   failureInfo.number   " Description"   failureInfo.description);
InternalAPI.InitializeMRP();
// iacbar.adapter.manifest
iacbar.adapter.manifest = JSON.parse(window.external.ExtensionInfo.manifest);
iacbar.adapter.debugTrace = window.external.DebugTrace;
var JavaScriptCritical = iacbar.adapter.debugTrace.JavaScriptCritical;
var JavaScriptError = iacbar.adapter.debugTrace.JavaScriptError;
var JavaScriptWarning = iacbar.adapter.debugTrace.JavaScriptWarning;
var JavaScriptInformational = iacbar.adapter.debugTrace.JavaScriptInformational;
var JavaScriptVerbose = iacbar.adapter.debugTrace.JavaScriptVerbose;
var TestError = iacbar.adapter.debugTrace.TestError;
var TestWarning = iacbar.adapter.debugTrace.TestWarning;
backgroundpage: window.external.ExtensionInfo.background_page
iacbar.adapter.extension = {
// iacbar.adapter.extension.getBackgroundPage
var background_page = iacbarExt.backgroundpage;
if (background_page.length > 0) {
var webControlHost = window.external.WebBrowserHostManager.GetAll(); // SAFEARRAYs are of type VBArray in JScript
background_page = background_page.toLowerCase();
for (var nCntr = webControlHost.lbound(1); nCntr <= webControlHost.ubound(1);   nCntr) {
var item = webControlHost.getItem(nCntr);
if (item.resource.toLowerCase() == background_page) {
return item.webBrowser.document.parentWindow;
if (background_page.length == 0 || item.resource.toLowerCase() != background_page) {
views[i] = item.webBrowser.document.parentWindow;
// iacbar.adapter.extension.localPath
localPath: window.external.ExtensionInfo.installDirectory
ToolbarSettings: window.external.ToolbarSettings
// For details on the following APIs see the latest version of Mindspark Widget API*.docx
iacbar.adapter.toolbar = {
sendGetToolbarSettings : function(keys, callback) {
allSettings.toolbarId = settings.ToolbarId;
allSettings.partnerId = settings.PartnerId;
allSettings.partnerSubId = settings.PartnerSubId;
allSettings.installDate = settings.InstallDate;
allSettings.toolbarVersion = settings.ToolbarVersion;
allSettings.toolbarLanguage = settings.ToolbarLanguage;
allSettings.apiVersion = "1.5";
}(iacbarExt.ToolbarSettings);
if (undefined == keys) {
if (typeof keys == "string") {
keys = new Array(keys);
} else if (Object.prototype.toString.call(keys) !== "[object Array]") {
for (var iKeys = 0; iKeys < keys.length; iKeys   )
var key = keys[iKeys];
if (typeof key != "string")
throw new Error("Array element #"   iKeys   " is not 'string'");
if (undefined == toolbarSettings[key])
throw new Error("Invalid element in array '"   key   "'");
ret[key] = toolbarSettings[key];
if (undefined != ret.toolbarLanguage) {
if (ret.toolbarLanguage < 0 || ret.toolbarLanguage >= arLanguage.length) {
ret.toolbarLanguage = navigator.userLanguage;
var lang = arLanguage[ret.toolbarLanguage];
if (0 == navigator.userLanguage.indexOf(lang))
ret.toolbarLanguage = lang;
ICS: window.external.InterprocessCommunicationService,
extensionId: window.external.ExtensionInfo.extensionId
oErr.description = "Not a valid ticker update property object.";
if (oProp.effect == 'fade' || oProp.effect == 'scrollLeft' || oProp.effect == 'scrollRight') {
tickerProp.effect = oProp.effect;
tickerProp.effect = 'fade';
if (undefined != oProp.fontFace) {
if (typeof oProp.fontFace !== 'string') {
oErr.description = "Type mismatch - fontFace";
tickerProp.fontFace = oProp.fontFace;
if (undefined != oProp.scrollSpeed) {
if (typeof oProp.scrollSpeed !== 'number') {
oErr.description = "Type mismatch - scrollSpeed";
tickerProp.scrollSpeed = oProp.scrollSpeed;
tickerProp.scrollSpeed = 1;
if (typeof oProp.displayDuration != 'undefined') {
if (typeof oProp.displayDuration !== 'number') {
oErr.description = "Type mismatch - displayDuration";
tickerProp.duration = oProp.displayDuration;
tickerProp.duration = 3000;
if (typeof oProp.fadeInDuration != 'undefined') {
if (typeof oProp.fadeInDuration !== 'number') {
oErr.description = "Type mismatch - fadeInDuration";
tickerProp.fadeIn = oProp.fadeInDuration;
tickerProp.fadeIn = 0;
if (typeof oProp.fadeOutDuration != 'undefined') {
if (typeof oProp.fadeOutDuration !== 'number') {
oErr.description = "Type mismatch - fadeOutDuration";
tickerProp.fadeOut = oProp.fadeOutDuration;
tickerProp.fadeOut = 0;
if (typeof oProp.scrollSpeed != 'undefined') {
tickerProp.scrollSpeed = 0;
if (typeof oProp.width != 'undefined') {
if (typeof oProp.width != 'object') {
oErr.description = "Type mismatch - width";
if (typeof oProp.width.fitText != 'undefined') {
if (typeof oProp.width.fitText != 'boolean') {
oErr.description = "Type mismatch - width-fitText";
if (true == oProp.width.fitText)
tickerProp.size = 1; //fit text
tickerProp.size = 2; //Use specified width
if (typeof oProp.width.custom != 'undefined') {
if (typeof oProp.width.custom != 'number') {
oErr.description = "Type mismatch - width-custome";
tickerProp.width = oProp.width.custom;
tickerProp.size = 0; //No change
tickerProp.width = 0;
if (typeof oProp.backgroundColor != 'undefined') {
if (typeof oProp.backgroundColor !== 'string') {
oErr.description = "Type mismatch -backgroundColor";
tickerProp.backgroundColor = oProp.backgroundColor;
if (typeof oProp.xhtmlFragments != 'undefined') {
if (Object.prototype.toString.call(oProp.xhtmlFragments) != '[object Array]') {
oErr.description = "Type mismatch -xhtmlFragments";
tickerProp.text = oProp.xhtmlFragments.join("\n");
oErr.description = "Property missing - xhtmlFragments";
if (typeof oProp.fontColor != 'undefined') {
if (typeof oProp.fontColor !== 'string') {
oErr.description = "Type mismatch - fontColor";
tickerProp.textColor = oProp.fontColor;
InternalAPI.BroadcastTickerUpdate = function (oProp) {
var jsonStr = JSON.stringify(oProp);
this.m_internalAPI_MRP.BroadcastMessage(TickerUpdateMessageID, jsonStr);
InternalAPI.BroadcastBarItemProxyCall = function (oProp) {
this.m_internalAPI_MRP.BroadcastMessage(BarItemProxyCallID, jsonStr);
iacbar.adapter.barItem = {
// iacbar.adapter.barItem.ticker.update
An XHTML fragment, lacking any tags (i.e. plain text) is also supported.
//iacbar.adapter.barItem.ticker.update(object updateProperties, function(object result) {...})
var tickerProp = Ticker.ConvertUpdatePropObjToTickerDll(updateProperties);
InternalAPI.BroadcastTickerUpdate(tickerProp);
// iacbar.adapter.barItem.ticker.onClicked.addListener
var extID = iacbarExt.extensionId;
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "ticker.onClicked");
var event = mrp.GetEvent(TickerOnClickEventID);
event.addListener({ OnMessage: function(type, message, messageexchangeid, mrpIdentifier, handled) {
var prop = JSON.parse(message);
callback({information : {tabId : parse2Int(prop.tabId), callbackId : prop.id}});
// iacbar.adapter.barItem.update
//iacbar.adapter.barItem.update(object updateProperties, function(object result) {...})
inParams.action = "update";
if (typeof updateProperties.text === 'string')
inParams.text = updateProperties.text;
if (typeof updateProperties.title === 'string')
inParams.title = updateProperties.title;
if (typeof updateProperties.imagePath === 'string')
inParams.imagePath = updateProperties.imagePath;
if (!InternalAPI.BroadcastBarItemProxyCall(inParams))
// iacbar.adapter.barItem.onClicked.addListener
this.m_BarItem_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "baritem");
this.m_BarItem_Event = this.m_BarItem_MRP.GetEvent(BarItemProxyCallID);
this.m_BarItem_Event.AddListener(
// iacbar.adapter.barItem.onHover.addListener
// iacbar.adapter.barItem.onHover.addListener(function(Tab tab) {
url (string)
The URL the tab is displaying.
function Tab(id, windowId, url, screenRect) {
if (windowsId == undefined)
if (url == undefined)
throw new Error("The url of the Tab is a required parameter");
this.id = id;
this.windowsId = windowsId
this.url = url;
this.screenRect = screenRect;
SendRequest(2, "{"url":"https://xml.gasbuddy.com/GasBuddy_Mindspark_Zip.ashx?xml=n","method":"POST","header":"undefinedContent-Type\napplication/json\n","action":"send","body":"{\"Zip\":\"98101\",\"City\":\"\",\"State\":\"\",\"CustomerName\":\"Mindspark\",\"Key\":\"m5d8c1we9bas\",\"Time\":\"Fri, 11 May 2012 17:34:35 GMT\"}"}", 0x0270EE44)
iacbar.adapter.tabs = {
// iacbar.adapter.tabs.create
The URL to navigate the tab to initially. The URL will not be processed, but simply passed to IE and loaded as it will.
// iacbar.adapter.tabs.create(object createProperties, function(object result) {...});
if (prop.url == undefined)
throw new Error("Url is a required parameter");
if (typeof prop.url != 'string')
throw new Error("Url is not string");
prop.method = "create";
var jsonMsg = JSON.stringify(prop);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(TabsServiceCallID, jsonMsg);
// iacbar.adapter.tabs.get
if (undefined != window.external.ButtonWindow) {
requestId  = " "   iacbar.adapter.thisButtonWindow.id;
throw new Error("Exception 'window.external.ButtonWindow.id'");
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "tabs.get");
var event = mrp.GetEvent(TabsGetEventID);
var tab = JSON.parse(message);
if (tab.requestId != requestId)
delete tab.requestId;
tab.id = parse2Int(tab.id);
tab.windowId = parse2Int(tab.windowId);
tab.left = parse2Int(tab.left);
tab.top = parse2Int(tab.top);
tab.right = parse2Int(tab.right);
tab.bottom = parse2Int(tab.bottom);
tab.active = tab.active == "true";
tab.screenRect = new ScreenRect(tab.top, tab.left, tab.right - tab.left, tab.bottom - tab.top);
delete tab.left;
delete tab.top;
delete tab.right;
delete tab.bottom;
tab.wndLeft = parse2Int(tab.wndLeft);
tab.wndTop = parse2Int(tab.wndTop);
tab.wndRight = parse2Int(tab.wndRight);
tab.wndBottom = parse2Int(tab.wndBottom);
tab.windowScreenRect = new ScreenRect(tab.wndTop, tab.wndLeft, tab.wndRight - tab.wndLeft, tab.wndBottom - tab.wndTop);
delete tab.wndLeft;
delete tab.wndTop;
delete tab.wndRight;
delete tab.wndBottom;
result.tab = tab;
event.RemoveListener(this);
prop.method = "get";
prop.tabId = tabId;
prop.requestId = requestId;
// iacbar.adapter.tabs.update
url (optional string)
A URL to navigate the tab to.
// iacbar.adapter.tabs.update(integer tabId, object updateProperties, function(object result) {...});
if (undefined == prop.url)
prop.method = "update";
// iacbar.adapter.tabs.onUpdated
The tab's URL if it has changed.
// iacbar.adapter.tabs.onUpdated.addListener(function(integer tabId, object changeInfo) {...});
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "tabs.onUpdated");
var event = mrp.GetEvent(TabsOnUpdatedEventID);
var obj = JSON.parse(message);
var tabId = parse2Int(obj.tabId);
delete obj.tabId;
if ("true" == obj.removed)
obj.removed = true;
else if ("true" == obj.active)
obj.active = true;
else if ("false" == obj.active)
obj.active = false;
// iacbar.adapter.tabs.searchBoxText.get
if (retrievalParams.tabId) {
if (typeof(retrievalParams.tabId) != "number")
throw { description: "The optional retrievalParams.tabId parameter must be a number" };
tabID = retrievalParams.tabId;
var extensionID = iacbarExt.extensionId;
var mrp = iacbarExt.ICS.Get("EBP_"   extensionID, "EC_"   extensionID, tabIdentifier);
mrp.SendRequest(TabIDSearchBoxContentMessageID, "\\", {
iacbar.adapter.tabs.get(null, function (result) {
f(result.tab.id);
// iacbar.adapter.tabs.executeScript
// Have the script engine running in the WebBrowser of the specified tab window execute the specified JavaScript code.
JavaScript code to execute in the tab.
Called after all the JavaScript has been executed or an error occurred
// iacbar.adapter.tabs.executeScript(object scriptProperties, function(object result) {...});
if (scriptProperties.tabId != undefined && typeof scriptProperties.tabId != "number")
throw new Error("'scriptProperties.tabId' is not a number");
if (scriptProperties.script == undefined)
throw new Error("'scriptProperties.script' is a required property");
if (typeof scriptProperties.script != 'string')
throw new Error("Property 'scriptProperties.script' is not a string");
inParams.action = "execScript";
inParams.code = scriptProperties.script;
var jsonMsg = JSON.stringify(inParams);
mrp.SendRequest(PageServiceCallID, jsonMsg, {
var info = JSON.parse(message);
if (info.HRESULT != undefined) {
callback({failureInfo : {HRESULT : parseInt(info.HRESULT, 10)}});
if (scriptProperties.tabId == undefined) {
f(scriptProperties.tabId);
PAD// window.XMLHTTPRequest
http://msdn.microsoft.com/en-us/library/windows/desktop/ms759148(v=vs.85).aspx
For this method only a true value is supported for the varAsync parameter.
This is not supported
This is currently not supported
window.XMLHttpRequest = function () {
// Assigns method, destination URL, and other optional attributes of a pending request.
// open(sMethod, sUrl [, bAsync] [, sUser] [, sPassword])
this.open = function (sMethod, sUrl, bAsync, sUser, sPassword) {
this.initialize();
if (typeof sUrl == 'undefined')
throw { description: "sUrl is required." };
this.onreadystatechange = null;
this.onReadyStateChange = null;
payload.url = sUrl;
payload.method = sMethod;
if (typeof sUser != 'undefined' && typeof sUser == 'string' && sUser.length > 0) {
payload.user = sUser;
if (typeof sPassword != 'undefined')
payload.password = sPassword;
this.readyState = 1; //A request has been opened, but the send method has not been called.
// Sends an HTTP request to the server and receives a response.
this.send = function (varBody) {
if (this.readyState != 1)
this.XMLHttpRequestSendListener = {
if (this.XMLHttpRequestObj !== null) {
var msg = JSON.parse(Message);
this.XMLHttpRequestObj.responseText = msg.responseText;
this.XMLHttpRequestObj.status = msg.status;
this.XMLHttpRequestObj.statusText = msg.statusText;
this.XMLHttpRequestObj.allResponseHeaders = msg.allResponseHeaders;
if (typeof this.XMLHttpRequestObj.responseText === 'string') {
this.XMLHttpRequestObj.responseXML = new window.ActiveXObject("Microsoft.XMLDOM");
this.XMLHttpRequestObj.responseXML.async = false;
var m = this.XMLHttpRequestObj.responseText.match(/^\s*]*>/i);
this.XMLHttpRequestObj.responseText = ""   this.XMLHttpRequestObj.responseText.slice(m[0].length);
this.XMLHttpRequestObj.responseXML.loadXML(this.XMLHttpRequestObj.responseText);
this.XMLHttpRequestObj.readyState = 4; //All the data has been received.
if ((this.XMLHttpRequestObj.onreadystatechange !== null) &&
(typeof this.XMLHttpRequestObj.onreadystatechange == 'function')) {
this.XMLHttpRequestObj.onreadystatechange();
} else if ((this.XMLHttpRequestObj.onReadyStateChange !== null) &&
(typeof this.XMLHttpRequestObj.onReadyStateChange == 'function')) {
this.XMLHttpRequestObj.onReadyStateChange();
this.XMLHttpRequestObj.readyState = 3;
if (typeof this.XMLHttpRequestObj.onreadystatechange == 'function') {
this.XMLHttpRequestObj.onreadystatechange = null;
} else if (typeof this.XMLHttpRequestObj.onReadyStateChange == 'function') {
this.XMLHttpRequestObj.onReadyStateChange = null;
XMLHttpRequestObj: null
this.XMLHttpRequestSendListener.XMLHttpRequestObj = this;
payload.action = "send";
payload.body = varBody;
var jsonMsg = JSON.stringify(payload);
InternalAPI.m_internalAPI_MRP.SendRequest(XMLHttpRequestCallID, jsonMsg, this.XMLHttpRequestSendListener);
this.readyState = 2; //The send method has been called. No data is available yet.
//Cancels the current HTTP request.
this.abort = function () {
this.readyState = 4;
if (this.XMLHttpRequestObj.onreadystatechange !== null) {
var callback1 = this.XMLHttpRequestObj.onreadystatechange;
} else if (this.XMLHttpRequestObj.onReadyStateChange !== null) {
var callback2 = this.XMLHttpRequestObj.onReadyStateChange;
this.readyState = 0;
//Adds custom HTTP headers to the request.
this.setRequestHeader = function (sName, sValue) {
if (typeof this._payload.headers === 'undefined')
this._payload.headers = "";
this._payload.headers  = sName   '\n'   sValue   '\n';
this.getResponseHeader = function (sName) {
if (typeof this.allResponseHeaders == 'undefined')
this._responseHeaders = this.allResponseHeaders.split("\n");
nameWithColon = nameWithColon.toLowerCase();
for (var i = 0; i < this._responseHeaders.length; i  ) {
var first = this._responseHeaders[i].slice(0, nameWithColon.length).toLowerCase();
return this._responseHeaders[i].slice(nameWithColon.length);
this.responseBody = null;
this.responseText = null;
this.status = null;
this.statusText = null;
this.allResponseHeaders = null;
this.responseXML = null;
// Retrieves the current state of the request operation.
this.aborted = false;
this.XMLHttpRequestSendListener = null;
this.initialize = function () {
if (this.XMLHttpRequestSendListener !== null)
this.XMLHttpRequestSendListener.XMLHttpRequestObj = null;
iacbar.adapter.shell = {
// iacbar.adapter.shell.sendLaunchExe
The url of the manifest file to download. The manifest is accompanied by a signature file, which has the same name as the manifest, with ".signature" attached on the end.
sendLaunchExe: function (properties, callback) {
if (typeof properties.url != 'string') {
throw new Error("url is a required string");
if (typeof properties.template != 'string') {
if (properties.commandLine && typeof properties.commandLine != 'string') {
if (!iacbarExt.Shell) {
iacbarExt.Shell = window.external.Shell;
iacbarExt.Shell.sendLaunchExe(properties, typeof callback == 'function' ? function (result) {
// iacbar.adapter.shell.sendDetectExe
sendDetectExe: function (properties, callback) {
iacbarExt.Shell.sendDetectExe(properties, callback);
Clipboard: window.external.Clipboard
iacbar.adapter.clipboard = {
// iacbar.adapter.clipboard.getText
callback({clipboardText: iacbarExt.Clipboard.GetText()});
// iacbar.adapter.clipboard.putText
iacbarExt.Clipboard.SetText(text);
Piacbar.adapter.localKeyValueStore = {
keys (optional)
A string or array of strings containing the name of the stored keys to
variables[key] == value for each key/value retrieved
Contains a property for each requested key with the corresponding
sendGetStoredData : function(keys, callback) {
var translatedKeys;
if (keys === null) {
translatedKeys = "";
} else if (Object.prototype.toString.call(keys) === "[object Array]") {
for (var i = 0; i < keys.length; i  ) {
translatedKeys  = keys[i]   "\n";
} else if (typeof keys == 'function' && callback === undefined) {
callback = keys;
translatedKeys = keys;
responseHandler.OnReadCompletion = function(bag, result) {
for (var i = 0; i < bag.CountProperties(); i  ) {
var name = bag.GetPropertyName(i);
var value = bag.GetPropertyValue(i);
// now call the api with the translated keys
window.external.PersistentStorage.GetStoredData(translatedKeys, responseHandler);
var bag = window.external.PersistentStorage.CreatePropertyBagInstance();
bag.Write(property, variables[property]);
responseHandler.OnWriteCompletion = function(result) {
window.external.PersistentStorage.UpdateStoredData(bag, responseHandler);
ScreenInfo: window.external.ScreenInfo,
iacbar.adapter.anchors = {
// iacbar.adapter.anchors.getInfo
//iacbar.adapter.anchors.getInfo(string anchorName, function(object result) {...})
if ((result.tab != null) && (typeof InternalAPI.m_internalAPI_MRP === 'object')) {
var tabID_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, result.tab.id);
var tabID_ScreenRectMsgEvt = tabID_MRP.GetEvent(TabIDScreenRectMessageID);
tabID_ScreenRectMsgEvt.AddListener({OnMessage: function (type, message, messageexchangeid, mrpIdentifier, handled) {
if (typeof info.HRESULT != "undefined") {
info.screenRect = new ScreenRect(parse2Int(info.top), parse2Int(info.left), parse2Int(info.width), parse2Int(info.height));
delete info.left;
delete info.top;
delete info.height;
delete info.width;
info.anchorName = anchorNameParam;
tabID_ScreenRectMsgEvt.RemoveListener(this);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(BarItemCallId, JSON.stringify({ action: "getscreenrect" }));
iacbar.adapter.tabs.get(null, function(result) {
if(result.failureInfo) {
callback({information : {anchorName : anchorNameParam, screenRect : result.tab.screenRect}});
callback({information : {anchorName : anchorNameParam, screenRect : result.tab.windowScreenRect}});
this.m_ToolbarUIInformation_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "toolbaruiinformation");
this.m_ToolbarUIInformation_Event = this.m_ToolbarUIInformation_MRP.GetEvent(ToolbarUIInformationCallID);
event.RemoveListener(listener);
info.left = parse2Int(info.left);
info.top = parse2Int(info.top);
info.right = parse2Int(info.right);
info.bottom = parse2Int(info.bottom);
info.screenRect = new ScreenRect(info.top, info.left, info.right - info.left, info.bottom - info.top);
delete info.right;
delete info.bottom;
event.AddListener(listener);
inParams.action = "getInfo";
inParams.anchorName = anchorNameParam;
var jsonStr = JSON.stringify(inParams);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(ToolbarUIInformationCallID, jsonStr);
iacbarExt.ScreenInfo.getAnchorRect(anchorNameParam, function(retVal) {
var rect = retVal.screenInfo.getItem(0);
callback({information: {anchorName : anchorNameParam, screenRect: new ScreenRect(parse2Int(rect.top),parse2Int(rect.left),parse2Int(rect.width),parse2Int(rect.height))}});
ScreenInfo: window.external.ScreenInfo
iacbar.adapter.screen = {
// iacbar.adapter.screen.getInfo
Same valid values as parameter with this name taken by anchors.getInfo
if ( anchorInfoResult.failureInfo != undefined )
result.failureInfo = anchorInfoResult.failureInfo;
if ( anchorInfoResult.screenInfo != undefined )
result.screenInfo = anchorInfoResult.screenInfo.toArray();
if ( anchorInfoResult.status != undefined )
result.status = anchorInfoResult.status;
if ( anchorInfoResult.exitCode != undefined )
result.exitCode = anchorInfoResult.exitCode;
var screenInfo = iacbarExt.ScreenInfo;
if (screenSelectionInfo.buttonWindowId != null) {
var buttonId = window.external.WebBrowserHostManager.GetButtonWindow(screenSelectionInfo.buttonWindowId);
screenInfo.getScreenRects(buttonId.ScreenRect, AnchorInfoResultToResultCallbackWrapper);
else if (screenSelectionInfo.anchorName != null) {
iacbar.adapter.anchors.getInfo(screenSelectionInfo.anchorName, function (anchorInfoResult) {
if (anchorInfoResult.failureInfo != null) {
screenInfo.getScreenRects(anchorInfoResult.information.screenRect, AnchorInfoResultToResultCallbackWrapper);
screenInfo.getScreenRects(null, AnchorInfoResultToResultCallbackWrapper);
Piacbar.adapter.windows = {
// iacbar.adapter.windows.create
// Creates (opens) a new browser with any optional sizing, position or default URL provided.
url (string or array of string)
A URL or list of URLs to open as tabs in the window.
Fully-qualified URLs must include a scheme (i.e. 'http://www.google.com', not 'www.google.com').
Relative URLs will be relative to the current page within the extension.
var rect = prop.screenRect;
prop.left = rect.left;
prop.top = rect.top;
prop.width = rect.width;
prop.height = rect.height;
prop.method = "createWindow";
ButtonWindow: window.external.ButtonWindow
iacbar.adapter.windowClipping = {
// iacbar.adapter.windowClipping.addOpaqueChild
if (typeof data.child !== 'object')
throw new Error("Type mismatch - data.child");
if (data.clippingType === undefined)
data.clippingType = 'roundRect';
if (typeof data.clippingType !== 'string')
throw new Error("Type mismatch - data.clippingType");
if (data.clippingType !== "roundRect" && data.clippingType !== "complex" && data.clippingType !== "iviewobject")
throw new Error("Invalid clippingType - supported clipping type are [roundRect, complex, iviewobject]");
if (data.clippingType === "roundRect") {
if (data.roundedEdgeWidth === undefined)
data.roundedEdgeWidth = 0;
if (data.roundedEdgeHeight === undefined)
data.roundedEdgeHeight = 0;
if (typeof data.roundedEdgeWidth !== 'number')
throw new Error("Type mismatch - data.roundedEdgeWidth");
if (typeof data.roundedEdgeHeight !== 'number')
throw new Error("Type mismatch - data.roundedEdgeHeight");
var clipType = data.clippingType == "roundRect" ? 0 : (data.clippingType == "complex" ? 1 : 2);
iacbarExt.ButtonWindow.HTMLChild.RegisterChildEx(data.child, data.roundedEdgeWidth, data.roundedEdgeHeight, clipType, true);
// iacbar.adapter.windowClipping.removeOpaqueChild
iacbarExt.ButtonWindow.HTMLChild.RegisterChildEx(child, 0, 0, 0, false);
iacbarExt.ButtonWindow.HTMLChild.UpdateClip();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(627):STDMETHODIMP CSkinWindowDisp::RemoveClip()
iacbarExt.ButtonWindow.HTMLChild.RemoveClip();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(647):STDMETHODIMP CSkinWindowDisp::SaveShape(long* pIdentifier)
var shapeId = iacbarExt.ButtonWindow.HTMLChild.SaveShape();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(657):STDMETHODIMP CSkinWindowDisp::CopyShape(long identifier)
iacbarExt.ButtonWindow.HTMLChild.CopyShape(shapeIdentifier);
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(667):STDMETHODIMP CSkinWindowDisp::DeleteShape(long identifier)
iacbarExt.ButtonWindow.HTMLChild.DeleteShape(shapeIdentifier);
this.id = buttonWindow.ID;
this.type = buttonWindow.Type;
this.title = buttonWindow.Title;
this.sizeIsClientArea = buttonWindow.SizeIsClientArea;
this.focused = buttonWindow.Focused;
this.hidden = buttonWindow.Hidden;
this.scrollable = buttonWindow.Scrollable;
this.screenRect = { top: buttonWindow.ScreenRect.Top, left: buttonWindow.ScreenRect.Left, height: buttonWindow.ScreenRect.Height, width: buttonWindow.ScreenRect.Width };
this.closed = buttonWindow.Closed;
this.commEndPoint = new MRPJSWrapper(buttonWindow.MRPRemote);
this.type = type;
this.title = title;
this.focused = focused;
this.closed = closed;
WebBrowserHostManager: window.external.WebBrowserHostManager,
responceHandler.OnResponse = function (message) {
callback(JSON.parse(message), data);
responceHandler.OnError = function (err, message) {
prop.method = "getHWND";
prop.windowId = windowId;
InternalAPI.m_internalAPI_MRP.SendRequest(WindowMapperServiceCallId, jsonMsg, responceHandler);
iacbar.adapter.buttonWindows = {
// iacbar.adapter.buttonWindows.create
// Creates (opens) a new button window with any optional sizing, position or default URL provided.
A URL to open in the button window.
For isolate & untrusted window - url must be an http/https that includes a domain name
If specified, the iacbar.data attribute will be set to this parameter (for the DOM of the button window).
The url must be an http/https that includes a domain name.
The url must be relative to the extension installation directory.
The url must be a relative to the extension installation directory.
if (createData.api && typeof createData.api == 'string') {
if (createData.api === 'none')
else if (createData.api === 'post-loaded communication')
else if (createData.api !== 'rich')
if (createData.url == undefined)
throw new Error("url is a required parameter for button window");
if (typeof createData.url != 'string')
throw new Error("Invalid datatype - url");
var url;
if (createData.url.length >= 7) {
url = createData.url.substr(0, 8).toLowerCase();
if (url.slice(0, -1) == "http://" || url == "https://")
throw new Error("URL must be relative to the extension installation directory");
url = "iacbarcx://extension/"   createData.url
url = createData.url;
// URL rather than remote URL, rather than trying to do rigorous and thorough
// validation on the URL.
if (url.length < 4 || url.substring(0, 4).toLowerCase() != "http")
throw new Error("URL protocol must be HTTP or HTTPS");
if (createData.tabDependentCreateData == undefined && createData.tabIndependentCreateData == undefined)
if (typeof createData.tabDependentCreateData != 'object' && typeof createData.tabIndependentCreateData != 'object')
if (createData.screenRect != undefined && typeof createData.screenRect == 'object')
screenRect = createData.screenRect;
var sizeIsClientArea = typeof createData.sizeIsClientArea != 'boolean' ? false : createData.sizeIsClientArea;
if (createData.focused != undefined && typeof createData.focused == 'boolean')
focused = createData.focused;
if (createData.hidden != undefined && typeof createData.hidden == 'boolean')
hidden = createData.hidden;
if (createData.scrollable != undefined && typeof createData.scrollable == 'boolean')
scrollable = createData.scrollable;
if (createData.data != undefined && typeof createData.data == 'object')
data = createData.data;
if (createData.tabDependentCreateData != undefined) {
if (createData.tabDependentCreateData.tabId != undefined) {
if (typeof createData.tabDependentCreateData.tabId != 'number')
throw new Error("Invalid datatype - tabDependentCreateData.tabId");
tabId = createData.tabDependentCreateData.tabId;
if (createData.tabDependentCreateData.modal != undefined) {
if (typeof createData.tabDependentCreateData.modal != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.modal");
modal = createData.tabDependentCreateData.modal;
if (createData.tabDependentCreateData.modlessToTab != undefined) {
if (typeof createData.tabDependentCreateData.modlessToTab != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.modlessToTab");
modlessToTab = createData.tabDependentCreateData.modlessToTab;
if (createData.tabDependentCreateData.menuLike != undefined) {
if (typeof createData.tabDependentCreateData.menuLike != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.menuLike");
menuLike = createData.tabDependentCreateData.menuLike;
buttonWnd.apiType = apiType;
buttonWnd.url = url;
buttonWnd.modal = modal;
buttonWnd.modlessToTab = modlessToTab;
buttonWnd.menuLike = menuLike;
buttonWnd.screenRect = screenRect;
buttonWnd.sizeIsClientArea = sizeIsClientArea;
buttonWnd.focused = focused;
buttonWnd.hidden = hidden;
buttonWnd.scrollable = scrollable;
buttonWnd.data = data;
buttonWnd.callback = callback;
buttonWnd.tabServicecallback = function (result) {
if (result.HRESULT != undefined) {//There is an error
if (typeof buttonWnd.callback == 'function') {
buttonWnd.callback({ failureInfo: { number: result.HRESULT} });
if (result.tab === undefined)
if (typeof result.tab !== 'object')
if (typeof result.tab.id !== 'number')
if (typeof result.tab.windowId !== 'number')
if ((true === buttonWnd.modal) || ((true !== buttonWnd.menuLike) && (true !== buttonWnd.modlessToTab))) {//for modal/modless browser window
WindowMapperHelper.GetWindowHandleFromWindowId(result.tab.windowId, buttonWnd.windowMappercallback);
else {//For tabDependent window non modal pass tabID
if (buttonWnd.data != null)
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, result.tab.id, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, result.tab.id, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
if (!buttonWnd.hidden) {
if (result.tab != null) {
var barItemProxyMRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, result.tab.id);
var message = { action: "ForButtonWindow", HWND: btnWnd.ID };
if (buttonWnd.menuLike)
message.SetForegroundWindow = true;
if (buttonWnd.focused)
message.focused = true;
barItemProxyMRP.PostMessage(BarItemTabIDCallID, JSON.stringify(message));
buttonWindowMap[buttonWindow.id] = buttonWindow;
buttonWnd.callback({ buttonWindow: buttonWindow });
buttonWnd.callback({ failureInfo: ErrorObjectTofailureInfo(e) });
buttonWnd.windowMappercallback = function (result) {
if (result.hWnd === undefined)
var hWnd = parse2Int(result.hWnd);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, hWnd, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, hWnd, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
if ((tabId === null) || (true === buttonWnd.modal) || ((true !== buttonWnd.menuLike) && (true !== buttonWnd.modlessToTab))) {
iacbar.adapter.tabs.get(tabId, buttonWnd.tabServicecallback);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, parse2Int(tabId), buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, parse2Int(tabId), buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
var barItemProxyMRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, tabId);
if (createData.tabIndependentCreateData.title != undefined && typeof createData.tabIndependentCreateData.title == 'string')
title = createData.tabIndependentCreateData.title;
if (createData.tabIndependentCreateData.alwaysOnTop != undefined && typeof createData.tabIndependentCreateData.alwaysOnTop == 'boolean')
alwaysOnTop = createData.tabIndependentCreateData.alwaysOnTop;
if (createData.tabIndependentCreateData.taskBarPresence != undefined && typeof createData.tabIndependentCreateData.taskBarPresence == 'boolean')
taskBarPresence = createData.tabIndependentCreateData.taskBarPresence;
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabIndependentButtonWindow(apiType, url, title, alwaysOnTop, taskBarPresence, screenRect, sizeIsClientArea, focused, hidden, scrollable, data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabIndependentButtonWindow(apiType, url, title, alwaysOnTop, taskBarPresence, screenRect, sizeIsClientArea, focused, hidden, scrollable);
// iacbar.adapter.buttonWindows.remove
iacbarExt.WebBrowserHostManager.RemoveButtonWindow(buttonWindowId);
delete buttonWindow.id;
delete buttonWindow.type;
delete buttonWindow.title;
delete buttonWindow.sizeIsClientArea;
delete buttonWindow.focused;
delete buttonWindow.hidden;
delete buttonWindow.scrollable;
delete buttonWindow.screenRect;
delete buttonWindow.closed;
if (buttonWindow.commEndPoint) {
buttonWindow.commEndPoint.onMessage = null;
buttonWindow.commEndPoint.onRequest = null;
buttonWindow.commEndPoint.postMessage = null;
buttonWindow.commEndPoint.sendRequest = null;
delete buttonWindow.commEndPoint;
var s = { failureInfo: "iacbar.adapter.buttonWindows.remove() failed" };
if (typeof e == 'object' && typeof (e.message) == 'string')
s.failureInfo  = " ('"   e.message   "')";
// iacbar.adapter.buttonWindows.update
var buttonWindow = new ButtonWindowType(iacbarExt.WebBrowserHostManager.GetButtonWindow(buttonWindowId));
var s = { failureInfo: "iacbar.adapter.buttonWindows.update() failed" };
var ticd = updateProperties.tabIndependentCreateData;
throw new Error("updateProperties.tabIndependentCreateData must be an object");
if (ticd.title !== undefined) {
if (typeof ticd.title != 'string')
throw new Error("updateProperties.tabIndependentCreateData.title must be string");
buttonWindow.title = ticd.title;
var r = updateProperties.screenRect;
throw new Error("updateProperties.screenRect must an object");
if (r.left !== undefined) {
if (typeof r.left != 'number')
throw new Error("updateProperties.screenRect.left must a number");
buttonWindow.screenRect.left = r.left;
if (r.top !== undefined) {
if (typeof r.top != 'number')
throw new Error("updateProperties.screenRect.top must a number");
buttonWindow.screenRect.top = r.top;
if (r.height !== undefined) {
if (typeof r.height != 'number')
throw new Error("updateProperties.screenRect.height must a number");
buttonWindow.screenRect.height = r.height;
if (r.width !== undefined) {
if (typeof r.width != 'number')
throw new Error("updateProperties.screenRect.width must a number");
buttonWindow.screenRect.width = r.width;
var b = updateProperties.sizeIsClientArea;
throw new Error("If specified, updateProperties.sizeIsClientArea must a boolean");
buttonWindow.sizeIsClientArea = b;
b = updateProperties.focused;
throw new Error("updateProperties.focused must a boolean");
buttonWindow.focused = b;
b = updateProperties.hidden;
throw new Error("updateProperties.hidden must a boolean");
buttonWindow.hidden = b;
b = updateProperties.scrollable;
throw new Error("updateProperties.scrollable must a boolean");
buttonWindow.scrollable = b;
status = iacbarExt.WebBrowserHostManager.UpdateButtonWindow(buttonWindowId, buttonWindow.title, buttonWindow.screenRect, buttonWindow.sizeIsClientArea, buttonWindow.focused, buttonWindow.hidden, buttonWindow.scrollable);
if (!buttonWindow.hidden) {
if (buttonWindow.focused)
if (typeof status == 'string' && status.length > 0) {
callback({ failureInfo: "iacbar.adapter.buttonWindows.update() partially failed:\n"   status });
// iacbar.adapter.buttonWindows.onUpdated
iacbarExt.WebBrowserHostManager.AddButtonWindowUpdateListener(buttonWindowId, { OnUpdate: function (buttonWindow) {
screenRect: { top: buttonWindow.ScreenRect.Top, left: buttonWindow.ScreenRect.Left, height: buttonWindow.ScreenRect.Height, width: buttonWindow.ScreenRect.Width },
sizeIsClientArea: buttonWindow.SizeIsClientArea,
focused: buttonWindow.Focused,
hidden: buttonWindow.Hidden,
scrollable: buttonWindow.Scrollable,
closed: buttonWindow.Closed
var t = buttonWindow.Title;
changeInfo.title = t;
btnWndJS = buttonWindowMap[buttonWindow.ID];
if (changeInfo.title) {
btnWndJS.title = changeInfo.title;
btnWndJS.sizeIsClientArea = changeInfo.sizeIsClientArea;
btnWndJS.focused = changeInfo.focused;
btnWndJS.hidden = changeInfo.hidden;
btnWndJS.scrollable = changeInfo.scrollable;
btnWndJS.screenRect = { top: changeInfo.screenRect.top, left: changeInfo.screenRect.left, height: changeInfo.screenRect.height, width: changeInfo.screenRect.width };
btnWndJS.closed = changeInfo.closed;
if (iacbarExt.ButtonWindow != undefined && typeof iacbarExt.ButtonWindow === 'object') {
var data = iacbarExt.ButtonWindow.UserData;
iacbar.data = data;
iacbar.adapter.thisButtonWindow = new ButtonWindowType(iacbarExt.ButtonWindow);
window.open = function (open) {
return function (url, name, features, replace) {
orgWnd = open(url, name, features, replace);
this.orgWnd = org;
this.close = function () {
if (this.orgWnd.close)
this.orgWnd.close();
this.orgWnd.window.close();
} (window.open);
var ButtonWindow = window.external.ButtonWindow;
var data = ButtonWindow.UserData;
var mrpWrapper = new MRPJSWrapper(ButtonWindow.MRP);
iacbar.adapter = {
//iacbar.adapter.commEndPoint
buttonWindows : {
riacbar.adapter.buttonWindows.update() method exposed by the Rich API - should be set to 0.
for (var i = 0; i < props.length;   i) {
throw new Error("updateProperties.screenRect."   props[i]   " must a number");
if (typeof params.hidden != undefined && params.hidden != false)
throw new Error("When specified updateProperties.hidden must be set to false");
status = ButtonWindow.Update(r, params.sizeIsClientArea, params.focused, params.hidden);
error = { failureInfo: "iacbar.adapter.buttonWindows.update() partially failed:\n"   status };
error = { failureInfo: "iacbar.adapter.buttonWindows.update() failed" };
error.failureInfo  = " ('"   e.message   "')";
} //iacbar.adapter
var InterWidgetMRP = window.external.InterprocessCommunicationService.Get("EBPToEBP", "EBPToEBP", "ForInterWidgetCommunication");
iacbar.adapter.traceLog.sendLogError(" Error #"   failureInfo.number   " Description "   failureInfo.description);
iacbar.adapter.InterWidget = {
InterWidgetMRP.GetEvent(InterWidgetCommunicationMessageID).AddListener(
OnMessage: function (type, msg, messageexchangeId, mrpIdentifier, handled) {
async(function () { callback({ message: msg }) });
InterWidgetMRP.BroadcastMessage(InterWidgetCommunicationMessageID, message);
78
3$3-3E3v3}3
78u8
=:> ?5?;?
8094989<9
1O4X4Y6
F1X1 2F2V2
;$; ;2;9;
0-0A0M0a0}0
00
:":):2:7:
7074787<7
$0-040;0
3-363@3_3
11&282
4L4
=*>0>4>8><>
7 7$7(7,7074787
;$;*;0;6;];
9094989<9
4 4$4(4,40444
> >@>\>`>
? ?@?`?|?
7$7,747<7`7
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:Semaphore:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:NewBcpEventToken:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:NewBcpEvent:
.Release() failed!!! (
eCould not create the event %s
m_NewBcpEvent.Set() failed (
Error in extension Id - extension Id is over 48 characters long. Count: %d
Error in extension Id - non-hex character encountered, treating as zero: %x
Cookie 0xX removed!
Cookie 0xX not found!
Rpcrt4
RpcAsyncInitializeHandle() returned %d
RpcServerRegisterIfEx() returned %d
CAtlException X
Are we under attack? Nill value passed to RPC server
QueueUserAPC() failed with 0xX
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:SharedMemory:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:Mutex:
RpcStringFree() returned %d
gRpcBindingFromStringBinding() returned %d
RpcStringBindingCompose() returned %d
nKERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
HRESULT is 0xx
GetIdentifiers failed with error code 0xx
Error in Advise with Bcp. Error code is 0xx
Error in Unadvise with Bcp. Error code is 0xx
Error in CLocalBcp::PostData. Error code is 0xx
t8ExtPEx.dll
t8ExtPEx.dll is missing
EXEManager.dll
\StringFileInfo\XX\OriginalFilename
Mscoree.dll
Advapi32.dll
W.tlb
OLEAUT32.DLL
\\.\pipe\IAC.DebugTraceNamedPipe.6420F383-BCB1-4D5D-BFD9-BB977497E2E1
kernel32.dll
0.0.0.0
SetCurrentExtensionInfo [Invalid Version: %s]
\manifest.json
SetCurrentExtensionInfo wrong manifest version: %s]
Failed to read or parse the manifest [ExtensionDir: %s]
manifest.json
shell32.dll
%ls_%ls_xx%ls_%ls
ntdll.dll
cookie: %d
Failed to convert the stream's marshaling data into an interface pointer [HRESULT: 0xlx, cookie: %d, IStream: %p]
Exception thrown by executing a task on the thread pool
NULL IDispatch passed to DispInvokeHelper()
IAC-WatchedProcessEvent:%d
iacbarcxWebBrowserHost
iacbarcxWebBrowserHostParent
WBH.EnableJSErrorsDisplay.txt
.comm
#%d/#%d
tabs.onUpdated
wtabs.get
t8Html.dll
l#4 /p="%d" /c="%d"
9BFE145C-09C8-4696-AC31-73D9F4D63792:Mutex:
).Integrity(
.Browser(
).Bar
ieframe.dll
rgb(%d,%d,%d)
TraceLog.cfg
^(. ?)\=(. ?)$
).csv
WebBrowserHostManagerService
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CrExtP65.exe
CrExtProc.exe
CrExtP65.exe
1.0.7.183

CrExtP65.exe_3852:




.text
`.rdata
@.data
.rsrc
@.reloc
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
QVSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
SHELL32.dll
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\bidirectionalcommunicationprotocol\CIdentifierTrait.h
CBcp.cpp
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\bidirectionalcommunicationprotocol\CRpcCall.h
CCommunicationTrait.cpp
CSharedMemoryTrait.cpp
CRpcBingdingHandle.cpp
FreeRpcString::operator ()
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
MaxPolicyElementKey
()$^.* ?[]|\-{},:=!
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPMessage.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPBcpHelper.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPLocalBcp.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPEvent.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPImpl.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPHandshake.h
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Common\ResultInfo.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\services\extensioninternalapi\ScreenInfo.h
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Toolbar\ChromeExtAPI\Services\ExtensionInternalApi\CExtensionInternalApi.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPProviderImplBase.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPLocalProviderImplBase.h
IAC::ExtensionInternalApi::Internal::CDispatchImpl::get_WebBrowserHostManager
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
JavaScriptDebugTrace.cpp
JavaScriptTraceLog.cpp
ServiceManager.cpp
CommandLineParameters.cpp
([^"]{1,64})
ExtensionInformationManager.cpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/json_parser_read.hpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/ptree_implementation.hpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/string_path.hpp
ExtensionLifetime.cpp
EventMonitoring.cpp
IAC::EventMonitoringService::`anonymous-namespace'::::operator ()
IAC::EventMonitoringService::CEventMonitoring::CThreadPoolWorker::Execute
MRPLib.cpp
IAC::WebBrowserHostManagerService::CWebBrowserTraits::GetExternal
WebBrowserHostManager.cpp
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::FinalConstruct
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::Get
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::GetAll
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::CWebBrowserHost::GetProperty
IAC::WebBrowserHostManagerService::CChromeExtensionTraits::GetExtensionScriptCode
PluggableNamespaceHandler.cpp
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::Start
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::Read
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::ParseUrl
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::CombineUrl
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::QueryInfo
ButtonWindowProvider.cpp
ButtonWindow.cpp
IAC::ExtensionInternalApi::Internal::CDispatchImpl::get_WebBrowserHostManager
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/json_parser_write.hpp
WidgetStorage.cpp
WidgetPropertyBag.cpp
Clipboard.cpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\CrExtProc.pdb
DisconnectNamedPipe
SetNamedPipeHandleState
CreateIoCompletionPort
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CallMsgFilterW
EnumChildWindows
USER32.dll
GDI32.dll
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
UrlCanonicalizeW
UrlUnescapeW
UrlCreateFromPathW
UrlIsW
SHRegCloseUSKey
SHRegEnumUSKeyW
SHDeleteKeyW
SHRegOpenUSKeyW
SHRegDeleteEmptyUSKeyW
SHRegCreateUSKeyW
SHLWAPI.dll
USERENV.dll
VERSION.dll
CoInternetGetSecurityUrl
urlmon.dll
RPCRT4.dll
GetProcessHeap
GetCPInfo
zcÁ
.?AV?$IDispatchImpl@UIEventMonitoringSink@@$1?_GUID_606969f9_21d6_41dc_ac9f_8c3a6211daf0@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserEvents@CExtensionProcess@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AVCWebBrowserEvents@CExtensionProcess@@
.?AV?$CComObject@VCWebBrowserEvents@CExtensionProcess@@@ATL@@
.?AV?$CAtlExeModuleT@VCExtensionProcess@@@ATL@@
.?AV?$IDispatchImpl@UIClipboard@@$1?_GUID_028531e1_5078_4242_81cb_7cc385af4d6f@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPProvider@@$1?IID_IMRPProvider@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIScreenInfo@@$1?_GUID_277c85f9_1df0_4f37_bd20_c8e0c9724c35@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRP@@$1?IID_IMRP@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPEvent@@$1?IID_IMRPEvent@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPIdentifier@@$1?IID_IMRPIdentifier@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPListener@@$1?_GUID_c300902d_0d9c_41d7_ae6f_850c508e3b37@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIExtensionInternalApi@@$1?_GUID_7d292731_4f6a_4e24_8da5_fddb3bcd6b29@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIJavaScriptDebugTrace@@$1?_GUID_f1d98e10_c66e_4303_b17e_debc666339ca@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIJavaScriptTraceLog@@$1?_GUID_b01322d8_dcd1_4404_af09_fd6e098504e0@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIScreenRect@@$1?IID_IScreenRect@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIResultInfo@@$1?_GUID_a042acb5_d06f_40e6_9e8f_6fd46d6c9805@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIPersistentStorage@@$1?_GUID_c152443c_6576_47df_a3a7_5bb882bea699@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$CExtensionInformationManagerServiceConsumer@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@IAC@@
.?AUIWebBrowserHostManager@@
.?AV?$IDispatchImpl@UIWebBrowserHostManager@@$1?_GUID_dff2bf4a_3ac4_478c_b12b_d1573ffcd07f@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IObjectWithSiteImpl@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$IDispatchImpl@UITraceFilter@@$1?_GUID_54594249_f9cc_4304_8c93_defa2a0b94da@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIExtensionInfo@@$1?_GUID_04c7b726_0fae_4dc5_b1e8_bc53e6d2d72f@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AV?$CThreadPool@VCThreadPoolWorker@CEventMonitoring@EventMonitoringService@IAC@@VCRTThreadTraits@ATL@@VWin32WaitTraits@6@@ATL@@
.?AVCPluggableNamespaceHandlerClassFactory@WebBrowserHostManagerService@IAC@@
.?AV?$CComObjectNoLock@VCPluggableNamespaceHandlerClassFactory@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CWindowImpl@VCSublassedChildWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AVCSublassedChildWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CWindowImpl@VCParentWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AVCParentWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AV?$CWindowImpl@VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AUIWebBrowserHost@@
.?AV?$IDispatchImpl@UIWebBrowserHost@@$1?_GUID_2182956c_9e99_42ab_ab3d_e0e9f630991d@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AVCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CComContainedObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CComAggObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$IDispatchImpl@UIRichButtonWindow@@$1?_GUID_d3335624_ab87_4419_82c8_113318ec36be@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIUntrustedButtonWindow@@$1?_GUID_fc992dd0_3c68_432a_8925_d99dadb06736@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIInternalApiForUntrustedButtonWindow@@$1?IID_IInternalApiForUntrustedButtonWindow@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIInternalApiForButtonWindow@@$1?_GUID_6122aea5_a1b7_4ce5_b908_91bd0d271c28@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UISecureHTMLChild@@$1?_GUID_b6c6d0da_8dfc_4e05_ab76_73ecbb568c29@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AUIHTMLOMWindowServices@@
.?AV?$IServiceProviderImpl@VCWebBrowserHost@ButtonWindow@IAC@@@ATL@@
.?AV?$CWindowImpl@VCWebBrowserHost@ButtonWindow@IAC@@VCWindow@ATL@@V?$CWinTraits@$0MPAAAA@$0A@@5@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserHost@ButtonWindow@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AV?$IDispEventImpl@$00VCWebBrowserHost@ButtonWindow@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B$1?LIBID_SHDocVw@@3U_GUID@@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@
.?AVCWebBrowserHost@ButtonWindow@IAC@@
.?AV?$CComObject@VCWebBrowserHost@ButtonWindow@IAC@@@ATL@@
.?AV?$IDispatchImpl@UIPropertyBagDisp@@$1?_GUID_878d78ad_8fe3_4c7c_bf55_16d3458c011e@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
stdole2.tlbWWW
ChromeExtLib
muMsgType
.IBrowserInformationWL
btFirefoxWWW
keys
KCoLaunchEXEW(
tagMSGWW
pMsg(
IEXELauncher
sendLaunchExeWWW
sendDetectExeWWW
WebBrowserHostManagerWWW
r.UserData
|IWebBrowser2
%IWebBrowserAppWW$
8;'IWebBrowserW$
URLW
LocationURLW$
OLECMDID
OLECMDID_OPENWWW
`OLECMDID_NEW
OLECMDID_SAVEWWW
gOLECMDID_SAVEASW
OLECMDID_SAVECOPYASW
OLECMDID_PRINTPREVIEWWWW
OLECMDID_PAGESETUPWW
0>QOLECMDID_SPELLWW
0yGOLECMDID_PROPERTIESW
(OLECMDID_CUT
OLECMDID_COPYWWW
0VROLECMDID_PASTEWW
EOLECMDID_PASTESPECIALWWW
OLECMDID_UNDOWWW
OLECMDID_REDOWWW
OLECMDID_SELECTALLWW
OLECMDID_CLEARSELECTIONW
0gdOLECMDID_ZOOMWWW
0.wOLECMDID_GETZOOMRANGEWWW
;OLECMDID_UPDATECOMMANDSW
OLECMDID_REFRESH
OLECMDID_STOPWWW
OLECMDID_HIDETOOLBARSWWW
OLECMDID_SETPROGRESSMAXW
OLECMDID_SETPROGRESSPOSW
9OLECMDID_SETPROGRESSTEXT
OLECMDID_SETTITLEWWW
SOLECMDID_SETDOWNLOADSTATEWWW
VOLECMDID_STOPDOWNLOADWWW
|OLECMDID_ONTOOLBARACTIVATEDW
OLECMDID_FINDWWW
OLECMDID_DELETEW
#OLECMDID_HTTPEQUIVWW
!OLECMDID_HTTPEQUIV_DONEW
pOLECMDID_ENABLE_INTERACTIONW
OLECMDID_ONUNLOADWWW
OLECMDID_PROPERTYBAG2WWW
0DZOLECMDID_PREREFRESHW
OLECMDID_SHOWSCRIPTERROR
OLECMDID_SHOWMESSAGE
OLECMDID_SHOWFINDWWW
0?BOLECMDID_SHOWPAGESETUPWW
OLECMDID_SHOWPRINTWW
0dROLECMDID_CLOSEWW
OLECMDID_ALLOWUILESSSAVEASWW
OLECMDID_DONTDOWNLOADCSS
OLECMDID_UPDATEPAGESTATUSWWW
OLECMDID_PRINT2W
vOLECMDID_PRINTPREVIEW2WW
rOLECMDID_SETPRINTTEMPLATEWWW
0_sOLECMDID_GETPRINTTEMPLATEWWW
0OLECMDID_PAGEACTIONBLOCKEDWW
0cmOLECMDID_PAGEACTIONUIQUERYWW
OLECMDID_FOCUSVIEWCONTROLSWW
OLECMDID_FOCUSVIEWCONTROLSQUERYW
OLECMDID_SHOWPAGEACTIONMENUW
OLECMDID_ADDTRAVELENTRYW
OLECMDID_UPDATETRAVELENTRYWW
OLECMDID_UPDATEBACKFORWARDSTATEW
OLECMDID_OPTICAL_ZOOMWWW
0snOLECMDID_OPTICAL_GETZOOMRANGEWWW
OLECMDID_WINDOWSTATECHANGEDW
OLECMDID_ACTIVEXINSTALLSCOPE
OLECMDID_UPDATETRAVELENTRY_DATARECOVERYW
OLECMDID_SHOWTASKDLG
OLECMDID_POPSTATEEVENTWW
pOLECMDID_VIEWPORT_MODEWW
OLECMDID_LAYOUT_VIEWPORT_WIDTHWW
'0]mOLECMDID_VISUAL_VIEWPORT_EXCLUDE_BOTTOMW
OLECMDID_USER_OPTICAL_ZOOMWW
OLECMDID_PAGEAVAILABLEWW
0$6OLECMDID_GETUSERSCALABLE
OLECMDID_UPDATE_CARETWWW
OLECMDID_ENABLE_VISIBILITYWW
0W%OLECMDID_MEDIA_PLAYBACKW
OLECMDID_SETFAVICONW
OLECMDID_SET_HOST_FULLSCREENMODE
5OLECMDID_EXITFULLSCREENW
OLECMDID_SCROLLCOMPLETEW
OLECMDID_ONBEFOREUNLOADW
OLECMDFW
KOLECMDF_SUPPORTEDWWW
OLECMDF_ENABLEDW
OLECMDF_LATCHEDW
OLECMDF_NINCHEDW
09vOLECMDF_INVISIBLEWWW
$OLECMDF_DEFHIDEONCTXTMENUWWW\
cmdIDWWW
npcmdfWWWP
OLECMDEXECOPTWWWP
OLECMDEXECOPT_DODEFAULTWP
OLECMDEXECOPT_PROMPTUSERP
0:*OLECMDEXECOPT_DONTPROMPTUSERP
OLECMDEXECOPT_SHOWHELPWW\
cmdexecoptWW
webBrowserWW
{ppWebBrowser
8[.IMRPResponseCallback
81YIWebBrowserHostManagerWWd
IWebBrowserHostW
ppWebBrowserHost
pUnkWebBrowserHostEvents
gpvarWebBrowserHostsW
-8Xd__MIDL___MIDL_itf_ChromeExtLib_0001_0045_0001WWW
ct_ComplexEdgeWW
0z.ct_ViewObjWW,
Chrome Extension LibraryWW
Version of the browser as a string (major.minor.build.revision&
An empty property bag that can be filled and then stored by passing it to SaveStoredDataWW
IEXELauncher Interface
Web Browser Interface for IE4."
Web Browser Application Interface.
Web Browser interfaceW3
Navigates to the previous item in the history list.WWW/
Navigates to the next item in the history list.WWW
Go home/start page.WWW
Go Search Page.WWW
Navigates to a URL or file.WWW"
Returns the application automation object if accessible, this automation object otherwise..WWW^
Returns the container/parent automation object, if any.WWW6
The vertical position (pixels) of the frame window relative to the screen/container.WW=
The vertical dimension (pixels) of the frame window/object.WWWC
Gets the short (UI-friendly) name of the URL/file currently viewed.WWW(
Gets the full URL/path currently viewed.WW/
Query to see if something is still in progress.WWW/
Exits application and closes the open document.WWW(
Converts client sizes into window sizes.WWI
Associates vtValue with the name szProperty in the context of the object.WT
Retrieve the Associated value for the property vtValue in the context of the object.WW
Returns name of the application.WW*
Returns the path to the application.WW8
Determines whether the application is visible or hidden.WW
Controls which toolbar is shown.WW"
Navigates to a URL or file or pidl.WWW
IOleCommandTarget::ExecWWW
Reports the results of a read operationWWW'
IWebBrowserHostManager InterfaceWW
IWebBrowserHost InterfaceW
Created by MIDL version 7.00.0555 at Fri Mar 14 20:00:13 2014
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
//Replace window.alert so that the message box window does not take over
window.external.alert(message);
window.alert = alertDebug;
2011-10-19
See http://www.JSON.org/js.html
See http://javascript.crockford.com/jsmin.html
JSON.stringify(value, replacer, space)
will be passed the key associated with the value, and this will be
Date.prototype.toJSON = function (key) {
return this.getUTCFullYear()   '-'  
f(this.getUTCMonth()   1)   '-'  
f(this.getUTCDate())   'T'  
f(this.getUTCHours())   ':'  
f(this.getUTCMinutes())   ':'  
f(this.getUTCSeconds())   'Z';
You can provide an optional replacer method. It will be passed the
key and value of each member, with this bound to the containing
such that only members with keys listed in the replacer array are
JSON.stringify(undefined) returns undefined.
text = JSON.stringify(['e', {pluribus: 'unum'}]);
text = JSON.stringify(['e', {pluribus: 'unum'}], null, '\t');
text = JSON.stringify([new Date()], function (key, value) {
return this[key] instanceof Date ?
'Date('   this[key]   ')' : value;
JSON.parse(text, reviver)
transform the results. It receives each of the keys and values,
myData = JSON.parse(text, function (key, value) {
/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2}(?:\.\d*)?)Z$/.exec(value);
return new Date(Date.UTC( a[1],  a[2] - 1,  a[3],  a[4],
myData = JSON.parse('["Date(09/09/2001)"]', function (key, value) {
value.slice(0, 5) === 'Date(' &&
value.slice(-1) === ')') {
d = new Date(value.slice(5, -1));
getUTCMinutes, getUTCMonth, getUTCSeconds, hasOwnProperty, join,
if (typeof Date.prototype.toJSON !== 'function') {
return isFinite(this.valueOf())
? this.getUTCFullYear()   '-'  
f(this.getUTCDate())   'T'  
f(this.getUTCHours())   ':'  
f(this.getUTCMinutes())   ':'  
f(this.getUTCSeconds())   'Z'
String.prototype.toJSON =
Number.prototype.toJSON =
Boolean.prototype.toJSON = function (key) {
return this.valueOf();
'"': '\\"',
'\\': '\\\\'
escapable.lastIndex = 0;
return escapable.test(string) ? '"'   string.replace(escapable, function (a) {
: '\\u'   ('0000'   a.charCodeAt(0).toString(16)).slice(-4);
function str(key, holder) {
// Produce a string from holder[key].
k, // The member key.
value = holder[key];
typeof value.toJSON === 'function') {
value = value.toJSON(key);
value = rep.call(holder, key, value);
if (Object.prototype.toString.apply(value) === '[object Array]') {
length = value.length;
// Join all of the elements together, separated with commas, and wrap them in
v = partial.length === 0
? '[\n'   gap   partial.join(',\n'   gap)   '\n'   mind   ']'
: '['   partial.join(',')   ']';
length = rep.length;
partial.push(quote(k)   (gap ? ': ' : ':')   v);
// Otherwise, iterate through all of the keys in the object.
if (Object.prototype.hasOwnProperty.call(value, k)) {
// Join all of the member texts together, separated with commas,
? '{\n'   gap   partial.join(',\n'   gap)   '\n'   mind   '}'
: '{'   partial.join(',')   '}';
if (typeof JSON.stringify !== 'function') {
JSON.stringify = function (value, replacer, space) {
// that can replace values, or an array of strings that will select the keys.
typeof replacer.length !== 'number')) {
throw new Error('JSON.stringify');
// Make a fake root object containing our value under the key of ''.
if (typeof JSON.parse !== 'function') {
JSON.parse = function (text, reviver) {
function walk(holder, key) {
var k, v, value = holder[key];
return reviver.call(holder, key, value);
// Parsing happens in four stages. In the first stage, we replace certain
cx.lastIndex = 0;
if (cx.test(text)) {
text = text.replace(cx, function (a) {
('0000'   a.charCodeAt(0).toString(16)).slice(-4);
// We split the second stage into 4 regexp operations in order to work around
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
// JavaScript structure. The '{' operator is subject to a syntactic ambiguity
// In the optional fourth stage, we recursively walk the new structure, passing
throw new SyntaxError('JSON.parse');
failureInfo.description = e;
failureInfo.number = e;
failureInfo.description = e.toString();
if (e.number != undefined)
failureInfo.number = e.number.toString();
if (e.description != undefined && typeof e.description == 'string')
failureInfo.description = e.description;
else if (e.message != undefined && typeof e.message == 'string')
failureInfo.description = e.message;
var ButtonWindowSendMessageID = 2; //This message ID is being used for all SendRequest message in untrusted button window
this.onMessage = function (callback) {
mrp.GetEvent(ButtonWindowPostMessageID).AddListener(
{ OnMessage: function (type, msg, messageexchangeId, mrpIdentifier, handled) {
callback({ message: msg });
this.onRequest = function (callback) {
mrp.GetEvent(ButtonWindowSendMessageID).AddListener(
callback({ message: msg }, function (message) {
mrp.SendResponse(message, messageexchangeId);
this.postMessage = function (message) {
mrp.PostMessage(ButtonWindowPostMessageID, message);
this.sendRequest = function (message, callback) {
mrp.SendRequest(ButtonWindowSendMessageID, message, {
OnResponse: function (msg) {
OnError: function (err, msg) {
P// the only global variable that should be defined by the chrome extension. All others fall under a
var iacbar = { adapter: { traceLog: window.external.TraceLog } };
var XMLHttpRequestCallID = 2;
this.top = top;
this.left = left;
this.width = width;
this.height = height;
var extID = window.external.ExtensionInfo.extensionId;
this.m_internalAPI_MRP = window.external.InterprocessCommunicationService.Get("EBP_"   extID, "EC_"   extID, "Ticker");
iacbar.adapter.traceLog.sendLogError(" Error #"   failureInfo.number   " Description"   failureInfo.description);
InternalAPI.InitializeMRP();
// iacbar.adapter.manifest
iacbar.adapter.manifest = JSON.parse(window.external.ExtensionInfo.manifest);
iacbar.adapter.debugTrace = window.external.DebugTrace;
var JavaScriptCritical = iacbar.adapter.debugTrace.JavaScriptCritical;
var JavaScriptError = iacbar.adapter.debugTrace.JavaScriptError;
var JavaScriptWarning = iacbar.adapter.debugTrace.JavaScriptWarning;
var JavaScriptInformational = iacbar.adapter.debugTrace.JavaScriptInformational;
var JavaScriptVerbose = iacbar.adapter.debugTrace.JavaScriptVerbose;
var TestError = iacbar.adapter.debugTrace.TestError;
var TestWarning = iacbar.adapter.debugTrace.TestWarning;
backgroundpage: window.external.ExtensionInfo.background_page
iacbar.adapter.extension = {
// iacbar.adapter.extension.getBackgroundPage
var background_page = iacbarExt.backgroundpage;
if (background_page.length > 0) {
var webControlHost = window.external.WebBrowserHostManager.GetAll(); // SAFEARRAYs are of type VBArray in JScript
background_page = background_page.toLowerCase();
for (var nCntr = webControlHost.lbound(1); nCntr <= webControlHost.ubound(1);   nCntr) {
var item = webControlHost.getItem(nCntr);
if (item.resource.toLowerCase() == background_page) {
return item.webBrowser.document.parentWindow;
if (background_page.length == 0 || item.resource.toLowerCase() != background_page) {
views[i] = item.webBrowser.document.parentWindow;
// iacbar.adapter.extension.localPath
localPath: window.external.ExtensionInfo.installDirectory
ToolbarSettings: window.external.ToolbarSettings
// For details on the following APIs see the latest version of Mindspark Widget API*.docx
iacbar.adapter.toolbar = {
sendGetToolbarSettings : function(keys, callback) {
allSettings.toolbarId = settings.ToolbarId;
allSettings.partnerId = settings.PartnerId;
allSettings.partnerSubId = settings.PartnerSubId;
allSettings.installDate = settings.InstallDate;
allSettings.toolbarVersion = settings.ToolbarVersion;
allSettings.toolbarLanguage = settings.ToolbarLanguage;
allSettings.apiVersion = "1.5";
}(iacbarExt.ToolbarSettings);
if (undefined == keys) {
if (typeof keys == "string") {
keys = new Array(keys);
} else if (Object.prototype.toString.call(keys) !== "[object Array]") {
for (var iKeys = 0; iKeys < keys.length; iKeys   )
var key = keys[iKeys];
if (typeof key != "string")
throw new Error("Array element #"   iKeys   " is not 'string'");
if (undefined == toolbarSettings[key])
throw new Error("Invalid element in array '"   key   "'");
ret[key] = toolbarSettings[key];
if (undefined != ret.toolbarLanguage) {
if (ret.toolbarLanguage < 0 || ret.toolbarLanguage >= arLanguage.length) {
ret.toolbarLanguage = navigator.userLanguage;
var lang = arLanguage[ret.toolbarLanguage];
if (0 == navigator.userLanguage.indexOf(lang))
ret.toolbarLanguage = lang;
ICS: window.external.InterprocessCommunicationService,
extensionId: window.external.ExtensionInfo.extensionId
oErr.description = "Not a valid ticker update property object.";
if (oProp.effect == 'fade' || oProp.effect == 'scrollLeft' || oProp.effect == 'scrollRight') {
tickerProp.effect = oProp.effect;
tickerProp.effect = 'fade';
if (undefined != oProp.fontFace) {
if (typeof oProp.fontFace !== 'string') {
oErr.description = "Type mismatch - fontFace";
tickerProp.fontFace = oProp.fontFace;
if (undefined != oProp.scrollSpeed) {
if (typeof oProp.scrollSpeed !== 'number') {
oErr.description = "Type mismatch - scrollSpeed";
tickerProp.scrollSpeed = oProp.scrollSpeed;
tickerProp.scrollSpeed = 1;
if (typeof oProp.displayDuration != 'undefined') {
if (typeof oProp.displayDuration !== 'number') {
oErr.description = "Type mismatch - displayDuration";
tickerProp.duration = oProp.displayDuration;
tickerProp.duration = 3000;
if (typeof oProp.fadeInDuration != 'undefined') {
if (typeof oProp.fadeInDuration !== 'number') {
oErr.description = "Type mismatch - fadeInDuration";
tickerProp.fadeIn = oProp.fadeInDuration;
tickerProp.fadeIn = 0;
if (typeof oProp.fadeOutDuration != 'undefined') {
if (typeof oProp.fadeOutDuration !== 'number') {
oErr.description = "Type mismatch - fadeOutDuration";
tickerProp.fadeOut = oProp.fadeOutDuration;
tickerProp.fadeOut = 0;
if (typeof oProp.scrollSpeed != 'undefined') {
tickerProp.scrollSpeed = 0;
if (typeof oProp.width != 'undefined') {
if (typeof oProp.width != 'object') {
oErr.description = "Type mismatch - width";
if (typeof oProp.width.fitText != 'undefined') {
if (typeof oProp.width.fitText != 'boolean') {
oErr.description = "Type mismatch - width-fitText";
if (true == oProp.width.fitText)
tickerProp.size = 1; //fit text
tickerProp.size = 2; //Use specified width
if (typeof oProp.width.custom != 'undefined') {
if (typeof oProp.width.custom != 'number') {
oErr.description = "Type mismatch - width-custome";
tickerProp.width = oProp.width.custom;
tickerProp.size = 0; //No change
tickerProp.width = 0;
if (typeof oProp.backgroundColor != 'undefined') {
if (typeof oProp.backgroundColor !== 'string') {
oErr.description = "Type mismatch -backgroundColor";
tickerProp.backgroundColor = oProp.backgroundColor;
if (typeof oProp.xhtmlFragments != 'undefined') {
if (Object.prototype.toString.call(oProp.xhtmlFragments) != '[object Array]') {
oErr.description = "Type mismatch -xhtmlFragments";
tickerProp.text = oProp.xhtmlFragments.join("\n");
oErr.description = "Property missing - xhtmlFragments";
if (typeof oProp.fontColor != 'undefined') {
if (typeof oProp.fontColor !== 'string') {
oErr.description = "Type mismatch - fontColor";
tickerProp.textColor = oProp.fontColor;
InternalAPI.BroadcastTickerUpdate = function (oProp) {
var jsonStr = JSON.stringify(oProp);
this.m_internalAPI_MRP.BroadcastMessage(TickerUpdateMessageID, jsonStr);
InternalAPI.BroadcastBarItemProxyCall = function (oProp) {
this.m_internalAPI_MRP.BroadcastMessage(BarItemProxyCallID, jsonStr);
iacbar.adapter.barItem = {
// iacbar.adapter.barItem.ticker.update
An XHTML fragment, lacking any tags (i.e. plain text) is also supported.
//iacbar.adapter.barItem.ticker.update(object updateProperties, function(object result) {...})
var tickerProp = Ticker.ConvertUpdatePropObjToTickerDll(updateProperties);
InternalAPI.BroadcastTickerUpdate(tickerProp);
// iacbar.adapter.barItem.ticker.onClicked.addListener
var extID = iacbarExt.extensionId;
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "ticker.onClicked");
var event = mrp.GetEvent(TickerOnClickEventID);
event.addListener({ OnMessage: function(type, message, messageexchangeid, mrpIdentifier, handled) {
var prop = JSON.parse(message);
callback({information : {tabId : parse2Int(prop.tabId), callbackId : prop.id}});
// iacbar.adapter.barItem.update
//iacbar.adapter.barItem.update(object updateProperties, function(object result) {...})
inParams.action = "update";
if (typeof updateProperties.text === 'string')
inParams.text = updateProperties.text;
if (typeof updateProperties.title === 'string')
inParams.title = updateProperties.title;
if (typeof updateProperties.imagePath === 'string')
inParams.imagePath = updateProperties.imagePath;
if (!InternalAPI.BroadcastBarItemProxyCall(inParams))
// iacbar.adapter.barItem.onClicked.addListener
this.m_BarItem_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "baritem");
this.m_BarItem_Event = this.m_BarItem_MRP.GetEvent(BarItemProxyCallID);
this.m_BarItem_Event.AddListener(
// iacbar.adapter.barItem.onHover.addListener
// iacbar.adapter.barItem.onHover.addListener(function(Tab tab) {
url (string)
The URL the tab is displaying.
function Tab(id, windowId, url, screenRect) {
if (windowsId == undefined)
if (url == undefined)
throw new Error("The url of the Tab is a required parameter");
this.id = id;
this.windowsId = windowsId
this.url = url;
this.screenRect = screenRect;
SendRequest(2, "{"url":"https://xml.gasbuddy.com/GasBuddy_Mindspark_Zip.ashx?xml=n","method":"POST","header":"undefinedContent-Type\napplication/json\n","action":"send","body":"{\"Zip\":\"98101\",\"City\":\"\",\"State\":\"\",\"CustomerName\":\"Mindspark\",\"Key\":\"m5d8c1we9bas\",\"Time\":\"Fri, 11 May 2012 17:34:35 GMT\"}"}", 0x0270EE44)
iacbar.adapter.tabs = {
// iacbar.adapter.tabs.create
The URL to navigate the tab to initially. The URL will not be processed, but simply passed to IE and loaded as it will.
// iacbar.adapter.tabs.create(object createProperties, function(object result) {...});
if (prop.url == undefined)
throw new Error("Url is a required parameter");
if (typeof prop.url != 'string')
throw new Error("Url is not string");
prop.method = "create";
var jsonMsg = JSON.stringify(prop);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(TabsServiceCallID, jsonMsg);
// iacbar.adapter.tabs.get
if (undefined != window.external.ButtonWindow) {
requestId  = " "   iacbar.adapter.thisButtonWindow.id;
throw new Error("Exception 'window.external.ButtonWindow.id'");
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "tabs.get");
var event = mrp.GetEvent(TabsGetEventID);
var tab = JSON.parse(message);
if (tab.requestId != requestId)
delete tab.requestId;
tab.id = parse2Int(tab.id);
tab.windowId = parse2Int(tab.windowId);
tab.left = parse2Int(tab.left);
tab.top = parse2Int(tab.top);
tab.right = parse2Int(tab.right);
tab.bottom = parse2Int(tab.bottom);
tab.active = tab.active == "true";
tab.screenRect = new ScreenRect(tab.top, tab.left, tab.right - tab.left, tab.bottom - tab.top);
delete tab.left;
delete tab.top;
delete tab.right;
delete tab.bottom;
tab.wndLeft = parse2Int(tab.wndLeft);
tab.wndTop = parse2Int(tab.wndTop);
tab.wndRight = parse2Int(tab.wndRight);
tab.wndBottom = parse2Int(tab.wndBottom);
tab.windowScreenRect = new ScreenRect(tab.wndTop, tab.wndLeft, tab.wndRight - tab.wndLeft, tab.wndBottom - tab.wndTop);
delete tab.wndLeft;
delete tab.wndTop;
delete tab.wndRight;
delete tab.wndBottom;
result.tab = tab;
event.RemoveListener(this);
prop.method = "get";
prop.tabId = tabId;
prop.requestId = requestId;
// iacbar.adapter.tabs.update
url (optional string)
A URL to navigate the tab to.
// iacbar.adapter.tabs.update(integer tabId, object updateProperties, function(object result) {...});
if (undefined == prop.url)
prop.method = "update";
// iacbar.adapter.tabs.onUpdated
The tab's URL if it has changed.
// iacbar.adapter.tabs.onUpdated.addListener(function(integer tabId, object changeInfo) {...});
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "tabs.onUpdated");
var event = mrp.GetEvent(TabsOnUpdatedEventID);
var obj = JSON.parse(message);
var tabId = parse2Int(obj.tabId);
delete obj.tabId;
if ("true" == obj.removed)
obj.removed = true;
else if ("true" == obj.active)
obj.active = true;
else if ("false" == obj.active)
obj.active = false;
// iacbar.adapter.tabs.searchBoxText.get
if (retrievalParams.tabId) {
if (typeof(retrievalParams.tabId) != "number")
throw { description: "The optional retrievalParams.tabId parameter must be a number" };
tabID = retrievalParams.tabId;
var extensionID = iacbarExt.extensionId;
var mrp = iacbarExt.ICS.Get("EBP_"   extensionID, "EC_"   extensionID, tabIdentifier);
mrp.SendRequest(TabIDSearchBoxContentMessageID, "\\", {
iacbar.adapter.tabs.get(null, function (result) {
f(result.tab.id);
// iacbar.adapter.tabs.executeScript
// Have the script engine running in the WebBrowser of the specified tab window execute the specified JavaScript code.
JavaScript code to execute in the tab.
Called after all the JavaScript has been executed or an error occurred
// iacbar.adapter.tabs.executeScript(object scriptProperties, function(object result) {...});
if (scriptProperties.tabId != undefined && typeof scriptProperties.tabId != "number")
throw new Error("'scriptProperties.tabId' is not a number");
if (scriptProperties.script == undefined)
throw new Error("'scriptProperties.script' is a required property");
if (typeof scriptProperties.script != 'string')
throw new Error("Property 'scriptProperties.script' is not a string");
inParams.action = "execScript";
inParams.code = scriptProperties.script;
var jsonMsg = JSON.stringify(inParams);
mrp.SendRequest(PageServiceCallID, jsonMsg, {
var info = JSON.parse(message);
if (info.HRESULT != undefined) {
callback({failureInfo : {HRESULT : parseInt(info.HRESULT, 10)}});
if (scriptProperties.tabId == undefined) {
f(scriptProperties.tabId);
PAD// window.XMLHTTPRequest
http://msdn.microsoft.com/en-us/library/windows/desktop/ms759148(v=vs.85).aspx
For this method only a true value is supported for the varAsync parameter.
This is not supported
This is currently not supported
window.XMLHttpRequest = function () {
// Assigns method, destination URL, and other optional attributes of a pending request.
// open(sMethod, sUrl [, bAsync] [, sUser] [, sPassword])
this.open = function (sMethod, sUrl, bAsync, sUser, sPassword) {
this.initialize();
if (typeof sUrl == 'undefined')
throw { description: "sUrl is required." };
this.onreadystatechange = null;
this.onReadyStateChange = null;
payload.url = sUrl;
payload.method = sMethod;
if (typeof sUser != 'undefined' && typeof sUser == 'string' && sUser.length > 0) {
payload.user = sUser;
if (typeof sPassword != 'undefined')
payload.password = sPassword;
this.readyState = 1; //A request has been opened, but the send method has not been called.
// Sends an HTTP request to the server and receives a response.
this.send = function (varBody) {
if (this.readyState != 1)
this.XMLHttpRequestSendListener = {
if (this.XMLHttpRequestObj !== null) {
var msg = JSON.parse(Message);
this.XMLHttpRequestObj.responseText = msg.responseText;
this.XMLHttpRequestObj.status = msg.status;
this.XMLHttpRequestObj.statusText = msg.statusText;
this.XMLHttpRequestObj.allResponseHeaders = msg.allResponseHeaders;
if (typeof this.XMLHttpRequestObj.responseText === 'string') {
this.XMLHttpRequestObj.responseXML = new window.ActiveXObject("Microsoft.XMLDOM");
this.XMLHttpRequestObj.responseXML.async = false;
var m = this.XMLHttpRequestObj.responseText.match(/^\s*]*>/i);
this.XMLHttpRequestObj.responseText = ""   this.XMLHttpRequestObj.responseText.slice(m[0].length);
this.XMLHttpRequestObj.responseXML.loadXML(this.XMLHttpRequestObj.responseText);
this.XMLHttpRequestObj.readyState = 4; //All the data has been received.
if ((this.XMLHttpRequestObj.onreadystatechange !== null) &&
(typeof this.XMLHttpRequestObj.onreadystatechange == 'function')) {
this.XMLHttpRequestObj.onreadystatechange();
} else if ((this.XMLHttpRequestObj.onReadyStateChange !== null) &&
(typeof this.XMLHttpRequestObj.onReadyStateChange == 'function')) {
this.XMLHttpRequestObj.onReadyStateChange();
this.XMLHttpRequestObj.readyState = 3;
if (typeof this.XMLHttpRequestObj.onreadystatechange == 'function') {
this.XMLHttpRequestObj.onreadystatechange = null;
} else if (typeof this.XMLHttpRequestObj.onReadyStateChange == 'function') {
this.XMLHttpRequestObj.onReadyStateChange = null;
XMLHttpRequestObj: null
this.XMLHttpRequestSendListener.XMLHttpRequestObj = this;
payload.action = "send";
payload.body = varBody;
var jsonMsg = JSON.stringify(payload);
InternalAPI.m_internalAPI_MRP.SendRequest(XMLHttpRequestCallID, jsonMsg, this.XMLHttpRequestSendListener);
this.readyState = 2; //The send method has been called. No data is available yet.
//Cancels the current HTTP request.
this.abort = function () {
this.readyState = 4;
if (this.XMLHttpRequestObj.onreadystatechange !== null) {
var callback1 = this.XMLHttpRequestObj.onreadystatechange;
} else if (this.XMLHttpRequestObj.onReadyStateChange !== null) {
var callback2 = this.XMLHttpRequestObj.onReadyStateChange;
this.readyState = 0;
//Adds custom HTTP headers to the request.
this.setRequestHeader = function (sName, sValue) {
if (typeof this._payload.headers === 'undefined')
this._payload.headers = "";
this._payload.headers  = sName   '\n'   sValue   '\n';
this.getResponseHeader = function (sName) {
if (typeof this.allResponseHeaders == 'undefined')
this._responseHeaders = this.allResponseHeaders.split("\n");
nameWithColon = nameWithColon.toLowerCase();
for (var i = 0; i < this._responseHeaders.length; i  ) {
var first = this._responseHeaders[i].slice(0, nameWithColon.length).toLowerCase();
return this._responseHeaders[i].slice(nameWithColon.length);
this.responseBody = null;
this.responseText = null;
this.status = null;
this.statusText = null;
this.allResponseHeaders = null;
this.responseXML = null;
// Retrieves the current state of the request operation.
this.aborted = false;
this.XMLHttpRequestSendListener = null;
this.initialize = function () {
if (this.XMLHttpRequestSendListener !== null)
this.XMLHttpRequestSendListener.XMLHttpRequestObj = null;
iacbar.adapter.shell = {
// iacbar.adapter.shell.sendLaunchExe
The url of the manifest file to download. The manifest is accompanied by a signature file, which has the same name as the manifest, with ".signature" attached on the end.
sendLaunchExe: function (properties, callback) {
if (typeof properties.url != 'string') {
throw new Error("url is a required string");
if (typeof properties.template != 'string') {
if (properties.commandLine && typeof properties.commandLine != 'string') {
if (!iacbarExt.Shell) {
iacbarExt.Shell = window.external.Shell;
iacbarExt.Shell.sendLaunchExe(properties, typeof callback == 'function' ? function (result) {
// iacbar.adapter.shell.sendDetectExe
sendDetectExe: function (properties, callback) {
iacbarExt.Shell.sendDetectExe(properties, callback);
Clipboard: window.external.Clipboard
iacbar.adapter.clipboard = {
// iacbar.adapter.clipboard.getText
callback({clipboardText: iacbarExt.Clipboard.GetText()});
// iacbar.adapter.clipboard.putText
iacbarExt.Clipboard.SetText(text);
Piacbar.adapter.localKeyValueStore = {
keys (optional)
A string or array of strings containing the name of the stored keys to
variables[key] == value for each key/value retrieved
Contains a property for each requested key with the corresponding
sendGetStoredData : function(keys, callback) {
var translatedKeys;
if (keys === null) {
translatedKeys = "";
} else if (Object.prototype.toString.call(keys) === "[object Array]") {
for (var i = 0; i < keys.length; i  ) {
translatedKeys  = keys[i]   "\n";
} else if (typeof keys == 'function' && callback === undefined) {
callback = keys;
translatedKeys = keys;
responseHandler.OnReadCompletion = function(bag, result) {
for (var i = 0; i < bag.CountProperties(); i  ) {
var name = bag.GetPropertyName(i);
var value = bag.GetPropertyValue(i);
// now call the api with the translated keys
window.external.PersistentStorage.GetStoredData(translatedKeys, responseHandler);
var bag = window.external.PersistentStorage.CreatePropertyBagInstance();
bag.Write(property, variables[property]);
responseHandler.OnWriteCompletion = function(result) {
window.external.PersistentStorage.UpdateStoredData(bag, responseHandler);
ScreenInfo: window.external.ScreenInfo,
iacbar.adapter.anchors = {
// iacbar.adapter.anchors.getInfo
//iacbar.adapter.anchors.getInfo(string anchorName, function(object result) {...})
if ((result.tab != null) && (typeof InternalAPI.m_internalAPI_MRP === 'object')) {
var tabID_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, result.tab.id);
var tabID_ScreenRectMsgEvt = tabID_MRP.GetEvent(TabIDScreenRectMessageID);
tabID_ScreenRectMsgEvt.AddListener({OnMessage: function (type, message, messageexchangeid, mrpIdentifier, handled) {
if (typeof info.HRESULT != "undefined") {
info.screenRect = new ScreenRect(parse2Int(info.top), parse2Int(info.left), parse2Int(info.width), parse2Int(info.height));
delete info.left;
delete info.top;
delete info.height;
delete info.width;
info.anchorName = anchorNameParam;
tabID_ScreenRectMsgEvt.RemoveListener(this);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(BarItemCallId, JSON.stringify({ action: "getscreenrect" }));
iacbar.adapter.tabs.get(null, function(result) {
if(result.failureInfo) {
callback({information : {anchorName : anchorNameParam, screenRect : result.tab.screenRect}});
callback({information : {anchorName : anchorNameParam, screenRect : result.tab.windowScreenRect}});
this.m_ToolbarUIInformation_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "toolbaruiinformation");
this.m_ToolbarUIInformation_Event = this.m_ToolbarUIInformation_MRP.GetEvent(ToolbarUIInformationCallID);
event.RemoveListener(listener);
info.left = parse2Int(info.left);
info.top = parse2Int(info.top);
info.right = parse2Int(info.right);
info.bottom = parse2Int(info.bottom);
info.screenRect = new ScreenRect(info.top, info.left, info.right - info.left, info.bottom - info.top);
delete info.right;
delete info.bottom;
event.AddListener(listener);
inParams.action = "getInfo";
inParams.anchorName = anchorNameParam;
var jsonStr = JSON.stringify(inParams);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(ToolbarUIInformationCallID, jsonStr);
iacbarExt.ScreenInfo.getAnchorRect(anchorNameParam, function(retVal) {
var rect = retVal.screenInfo.getItem(0);
callback({information: {anchorName : anchorNameParam, screenRect: new ScreenRect(parse2Int(rect.top),parse2Int(rect.left),parse2Int(rect.width),parse2Int(rect.height))}});
ScreenInfo: window.external.ScreenInfo
iacbar.adapter.screen = {
// iacbar.adapter.screen.getInfo
Same valid values as parameter with this name taken by anchors.getInfo
if ( anchorInfoResult.failureInfo != undefined )
result.failureInfo = anchorInfoResult.failureInfo;
if ( anchorInfoResult.screenInfo != undefined )
result.screenInfo = anchorInfoResult.screenInfo.toArray();
if ( anchorInfoResult.status != undefined )
result.status = anchorInfoResult.status;
if ( anchorInfoResult.exitCode != undefined )
result.exitCode = anchorInfoResult.exitCode;
var screenInfo = iacbarExt.ScreenInfo;
if (screenSelectionInfo.buttonWindowId != null) {
var buttonId = window.external.WebBrowserHostManager.GetButtonWindow(screenSelectionInfo.buttonWindowId);
screenInfo.getScreenRects(buttonId.ScreenRect, AnchorInfoResultToResultCallbackWrapper);
else if (screenSelectionInfo.anchorName != null) {
iacbar.adapter.anchors.getInfo(screenSelectionInfo.anchorName, function (anchorInfoResult) {
if (anchorInfoResult.failureInfo != null) {
screenInfo.getScreenRects(anchorInfoResult.information.screenRect, AnchorInfoResultToResultCallbackWrapper);
screenInfo.getScreenRects(null, AnchorInfoResultToResultCallbackWrapper);
Piacbar.adapter.windows = {
// iacbar.adapter.windows.create
// Creates (opens) a new browser with any optional sizing, position or default URL provided.
url (string or array of string)
A URL or list of URLs to open as tabs in the window.
Fully-qualified URLs must include a scheme (i.e. 'http://www.google.com', not 'www.google.com').
Relative URLs will be relative to the current page within the extension.
var rect = prop.screenRect;
prop.left = rect.left;
prop.top = rect.top;
prop.width = rect.width;
prop.height = rect.height;
prop.method = "createWindow";
ButtonWindow: window.external.ButtonWindow
iacbar.adapter.windowClipping = {
// iacbar.adapter.windowClipping.addOpaqueChild
if (typeof data.child !== 'object')
throw new Error("Type mismatch - data.child");
if (data.clippingType === undefined)
data.clippingType = 'roundRect';
if (typeof data.clippingType !== 'string')
throw new Error("Type mismatch - data.clippingType");
if (data.clippingType !== "roundRect" && data.clippingType !== "complex" && data.clippingType !== "iviewobject")
throw new Error("Invalid clippingType - supported clipping type are [roundRect, complex, iviewobject]");
if (data.clippingType === "roundRect") {
if (data.roundedEdgeWidth === undefined)
data.roundedEdgeWidth = 0;
if (data.roundedEdgeHeight === undefined)
data.roundedEdgeHeight = 0;
if (typeof data.roundedEdgeWidth !== 'number')
throw new Error("Type mismatch - data.roundedEdgeWidth");
if (typeof data.roundedEdgeHeight !== 'number')
throw new Error("Type mismatch - data.roundedEdgeHeight");
var clipType = data.clippingType == "roundRect" ? 0 : (data.clippingType == "complex" ? 1 : 2);
iacbarExt.ButtonWindow.HTMLChild.RegisterChildEx(data.child, data.roundedEdgeWidth, data.roundedEdgeHeight, clipType, true);
// iacbar.adapter.windowClipping.removeOpaqueChild
iacbarExt.ButtonWindow.HTMLChild.RegisterChildEx(child, 0, 0, 0, false);
iacbarExt.ButtonWindow.HTMLChild.UpdateClip();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(627):STDMETHODIMP CSkinWindowDisp::RemoveClip()
iacbarExt.ButtonWindow.HTMLChild.RemoveClip();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(647):STDMETHODIMP CSkinWindowDisp::SaveShape(long* pIdentifier)
var shapeId = iacbarExt.ButtonWindow.HTMLChild.SaveShape();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(657):STDMETHODIMP CSkinWindowDisp::CopyShape(long identifier)
iacbarExt.ButtonWindow.HTMLChild.CopyShape(shapeIdentifier);
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(667):STDMETHODIMP CSkinWindowDisp::DeleteShape(long identifier)
iacbarExt.ButtonWindow.HTMLChild.DeleteShape(shapeIdentifier);
this.id = buttonWindow.ID;
this.type = buttonWindow.Type;
this.title = buttonWindow.Title;
this.sizeIsClientArea = buttonWindow.SizeIsClientArea;
this.focused = buttonWindow.Focused;
this.hidden = buttonWindow.Hidden;
this.scrollable = buttonWindow.Scrollable;
this.screenRect = { top: buttonWindow.ScreenRect.Top, left: buttonWindow.ScreenRect.Left, height: buttonWindow.ScreenRect.Height, width: buttonWindow.ScreenRect.Width };
this.closed = buttonWindow.Closed;
this.commEndPoint = new MRPJSWrapper(buttonWindow.MRPRemote);
this.type = type;
this.title = title;
this.focused = focused;
this.closed = closed;
WebBrowserHostManager: window.external.WebBrowserHostManager,
responceHandler.OnResponse = function (message) {
callback(JSON.parse(message), data);
responceHandler.OnError = function (err, message) {
prop.method = "getHWND";
prop.windowId = windowId;
InternalAPI.m_internalAPI_MRP.SendRequest(WindowMapperServiceCallId, jsonMsg, responceHandler);
iacbar.adapter.buttonWindows = {
// iacbar.adapter.buttonWindows.create
// Creates (opens) a new button window with any optional sizing, position or default URL provided.
A URL to open in the button window.
For isolate & untrusted window - url must be an http/https that includes a domain name
If specified, the iacbar.data attribute will be set to this parameter (for the DOM of the button window).
The url must be an http/https that includes a domain name.
The url must be relative to the extension installation directory.
The url must be a relative to the extension installation directory.
if (createData.api && typeof createData.api == 'string') {
if (createData.api === 'none')
else if (createData.api === 'post-loaded communication')
else if (createData.api !== 'rich')
if (createData.url == undefined)
throw new Error("url is a required parameter for button window");
if (typeof createData.url != 'string')
throw new Error("Invalid datatype - url");
var url;
if (createData.url.length >= 7) {
url = createData.url.substr(0, 8).toLowerCase();
if (url.slice(0, -1) == "http://" || url == "https://")
throw new Error("URL must be relative to the extension installation directory");
url = "iacbarcx://extension/"   createData.url
url = createData.url;
// URL rather than remote URL, rather than trying to do rigorous and thorough
// validation on the URL.
if (url.length < 4 || url.substring(0, 4).toLowerCase() != "http")
throw new Error("URL protocol must be HTTP or HTTPS");
if (createData.tabDependentCreateData == undefined && createData.tabIndependentCreateData == undefined)
if (typeof createData.tabDependentCreateData != 'object' && typeof createData.tabIndependentCreateData != 'object')
if (createData.screenRect != undefined && typeof createData.screenRect == 'object')
screenRect = createData.screenRect;
var sizeIsClientArea = typeof createData.sizeIsClientArea != 'boolean' ? false : createData.sizeIsClientArea;
if (createData.focused != undefined && typeof createData.focused == 'boolean')
focused = createData.focused;
if (createData.hidden != undefined && typeof createData.hidden == 'boolean')
hidden = createData.hidden;
if (createData.scrollable != undefined && typeof createData.scrollable == 'boolean')
scrollable = createData.scrollable;
if (createData.data != undefined && typeof createData.data == 'object')
data = createData.data;
if (createData.tabDependentCreateData != undefined) {
if (createData.tabDependentCreateData.tabId != undefined) {
if (typeof createData.tabDependentCreateData.tabId != 'number')
throw new Error("Invalid datatype - tabDependentCreateData.tabId");
tabId = createData.tabDependentCreateData.tabId;
if (createData.tabDependentCreateData.modal != undefined) {
if (typeof createData.tabDependentCreateData.modal != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.modal");
modal = createData.tabDependentCreateData.modal;
if (createData.tabDependentCreateData.modlessToTab != undefined) {
if (typeof createData.tabDependentCreateData.modlessToTab != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.modlessToTab");
modlessToTab = createData.tabDependentCreateData.modlessToTab;
if (createData.tabDependentCreateData.menuLike != undefined) {
if (typeof createData.tabDependentCreateData.menuLike != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.menuLike");
menuLike = createData.tabDependentCreateData.menuLike;
buttonWnd.apiType = apiType;
buttonWnd.url = url;
buttonWnd.modal = modal;
buttonWnd.modlessToTab = modlessToTab;
buttonWnd.menuLike = menuLike;
buttonWnd.screenRect = screenRect;
buttonWnd.sizeIsClientArea = sizeIsClientArea;
buttonWnd.focused = focused;
buttonWnd.hidden = hidden;
buttonWnd.scrollable = scrollable;
buttonWnd.data = data;
buttonWnd.callback = callback;
buttonWnd.tabServicecallback = function (result) {
if (result.HRESULT != undefined) {//There is an error
if (typeof buttonWnd.callback == 'function') {
buttonWnd.callback({ failureInfo: { number: result.HRESULT} });
if (result.tab === undefined)
if (typeof result.tab !== 'object')
if (typeof result.tab.id !== 'number')
if (typeof result.tab.windowId !== 'number')
if ((true === buttonWnd.modal) || ((true !== buttonWnd.menuLike) && (true !== buttonWnd.modlessToTab))) {//for modal/modless browser window
WindowMapperHelper.GetWindowHandleFromWindowId(result.tab.windowId, buttonWnd.windowMappercallback);
else {//For tabDependent window non modal pass tabID
if (buttonWnd.data != null)
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, result.tab.id, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, result.tab.id, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
if (!buttonWnd.hidden) {
if (result.tab != null) {
var barItemProxyMRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, result.tab.id);
var message = { action: "ForButtonWindow", HWND: btnWnd.ID };
if (buttonWnd.menuLike)
message.SetForegroundWindow = true;
if (buttonWnd.focused)
message.focused = true;
barItemProxyMRP.PostMessage(BarItemTabIDCallID, JSON.stringify(message));
buttonWindowMap[buttonWindow.id] = buttonWindow;
buttonWnd.callback({ buttonWindow: buttonWindow });
buttonWnd.callback({ failureInfo: ErrorObjectTofailureInfo(e) });
buttonWnd.windowMappercallback = function (result) {
if (result.hWnd === undefined)
var hWnd = parse2Int(result.hWnd);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, hWnd, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, hWnd, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
if ((tabId === null) || (true === buttonWnd.modal) || ((true !== buttonWnd.menuLike) && (true !== buttonWnd.modlessToTab))) {
iacbar.adapter.tabs.get(tabId, buttonWnd.tabServicecallback);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, parse2Int(tabId), buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, parse2Int(tabId), buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
var barItemProxyMRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, tabId);
if (createData.tabIndependentCreateData.title != undefined && typeof createData.tabIndependentCreateData.title == 'string')
title = createData.tabIndependentCreateData.title;
if (createData.tabIndependentCreateData.alwaysOnTop != undefined && typeof createData.tabIndependentCreateData.alwaysOnTop == 'boolean')
alwaysOnTop = createData.tabIndependentCreateData.alwaysOnTop;
if (createData.tabIndependentCreateData.taskBarPresence != undefined && typeof createData.tabIndependentCreateData.taskBarPresence == 'boolean')
taskBarPresence = createData.tabIndependentCreateData.taskBarPresence;
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabIndependentButtonWindow(apiType, url, title, alwaysOnTop, taskBarPresence, screenRect, sizeIsClientArea, focused, hidden, scrollable, data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabIndependentButtonWindow(apiType, url, title, alwaysOnTop, taskBarPresence, screenRect, sizeIsClientArea, focused, hidden, scrollable);
// iacbar.adapter.buttonWindows.remove
iacbarExt.WebBrowserHostManager.RemoveButtonWindow(buttonWindowId);
delete buttonWindow.id;
delete buttonWindow.type;
delete buttonWindow.title;
delete buttonWindow.sizeIsClientArea;
delete buttonWindow.focused;
delete buttonWindow.hidden;
delete buttonWindow.scrollable;
delete buttonWindow.screenRect;
delete buttonWindow.closed;
if (buttonWindow.commEndPoint) {
buttonWindow.commEndPoint.onMessage = null;
buttonWindow.commEndPoint.onRequest = null;
buttonWindow.commEndPoint.postMessage = null;
buttonWindow.commEndPoint.sendRequest = null;
delete buttonWindow.commEndPoint;
var s = { failureInfo: "iacbar.adapter.buttonWindows.remove() failed" };
if (typeof e == 'object' && typeof (e.message) == 'string')
s.failureInfo  = " ('"   e.message   "')";
// iacbar.adapter.buttonWindows.update
var buttonWindow = new ButtonWindowType(iacbarExt.WebBrowserHostManager.GetButtonWindow(buttonWindowId));
var s = { failureInfo: "iacbar.adapter.buttonWindows.update() failed" };
var ticd = updateProperties.tabIndependentCreateData;
throw new Error("updateProperties.tabIndependentCreateData must be an object");
if (ticd.title !== undefined) {
if (typeof ticd.title != 'string')
throw new Error("updateProperties.tabIndependentCreateData.title must be string");
buttonWindow.title = ticd.title;
var r = updateProperties.screenRect;
throw new Error("updateProperties.screenRect must an object");
if (r.left !== undefined) {
if (typeof r.left != 'number')
throw new Error("updateProperties.screenRect.left must a number");
buttonWindow.screenRect.left = r.left;
if (r.top !== undefined) {
if (typeof r.top != 'number')
throw new Error("updateProperties.screenRect.top must a number");
buttonWindow.screenRect.top = r.top;
if (r.height !== undefined) {
if (typeof r.height != 'number')
throw new Error("updateProperties.screenRect.height must a number");
buttonWindow.screenRect.height = r.height;
if (r.width !== undefined) {
if (typeof r.width != 'number')
throw new Error("updateProperties.screenRect.width must a number");
buttonWindow.screenRect.width = r.width;
var b = updateProperties.sizeIsClientArea;
throw new Error("If specified, updateProperties.sizeIsClientArea must a boolean");
buttonWindow.sizeIsClientArea = b;
b = updateProperties.focused;
throw new Error("updateProperties.focused must a boolean");
buttonWindow.focused = b;
b = updateProperties.hidden;
throw new Error("updateProperties.hidden must a boolean");
buttonWindow.hidden = b;
b = updateProperties.scrollable;
throw new Error("updateProperties.scrollable must a boolean");
buttonWindow.scrollable = b;
status = iacbarExt.WebBrowserHostManager.UpdateButtonWindow(buttonWindowId, buttonWindow.title, buttonWindow.screenRect, buttonWindow.sizeIsClientArea, buttonWindow.focused, buttonWindow.hidden, buttonWindow.scrollable);
if (!buttonWindow.hidden) {
if (buttonWindow.focused)
if (typeof status == 'string' && status.length > 0) {
callback({ failureInfo: "iacbar.adapter.buttonWindows.update() partially failed:\n"   status });
// iacbar.adapter.buttonWindows.onUpdated
iacbarExt.WebBrowserHostManager.AddButtonWindowUpdateListener(buttonWindowId, { OnUpdate: function (buttonWindow) {
screenRect: { top: buttonWindow.ScreenRect.Top, left: buttonWindow.ScreenRect.Left, height: buttonWindow.ScreenRect.Height, width: buttonWindow.ScreenRect.Width },
sizeIsClientArea: buttonWindow.SizeIsClientArea,
focused: buttonWindow.Focused,
hidden: buttonWindow.Hidden,
scrollable: buttonWindow.Scrollable,
closed: buttonWindow.Closed
var t = buttonWindow.Title;
changeInfo.title = t;
btnWndJS = buttonWindowMap[buttonWindow.ID];
if (changeInfo.title) {
btnWndJS.title = changeInfo.title;
btnWndJS.sizeIsClientArea = changeInfo.sizeIsClientArea;
btnWndJS.focused = changeInfo.focused;
btnWndJS.hidden = changeInfo.hidden;
btnWndJS.scrollable = changeInfo.scrollable;
btnWndJS.screenRect = { top: changeInfo.screenRect.top, left: changeInfo.screenRect.left, height: changeInfo.screenRect.height, width: changeInfo.screenRect.width };
btnWndJS.closed = changeInfo.closed;
if (iacbarExt.ButtonWindow != undefined && typeof iacbarExt.ButtonWindow === 'object') {
var data = iacbarExt.ButtonWindow.UserData;
iacbar.data = data;
iacbar.adapter.thisButtonWindow = new ButtonWindowType(iacbarExt.ButtonWindow);
window.open = function (open) {
return function (url, name, features, replace) {
orgWnd = open(url, name, features, replace);
this.orgWnd = org;
this.close = function () {
if (this.orgWnd.close)
this.orgWnd.close();
this.orgWnd.window.close();
} (window.open);
var ButtonWindow = window.external.ButtonWindow;
var data = ButtonWindow.UserData;
var mrpWrapper = new MRPJSWrapper(ButtonWindow.MRP);
iacbar.adapter = {
//iacbar.adapter.commEndPoint
buttonWindows : {
riacbar.adapter.buttonWindows.update() method exposed by the Rich API - should be set to 0.
for (var i = 0; i < props.length;   i) {
throw new Error("updateProperties.screenRect."   props[i]   " must a number");
if (typeof params.hidden != undefined && params.hidden != false)
throw new Error("When specified updateProperties.hidden must be set to false");
status = ButtonWindow.Update(r, params.sizeIsClientArea, params.focused, params.hidden);
error = { failureInfo: "iacbar.adapter.buttonWindows.update() partially failed:\n"   status };
error = { failureInfo: "iacbar.adapter.buttonWindows.update() failed" };
error.failureInfo  = " ('"   e.message   "')";
} //iacbar.adapter
var InterWidgetMRP = window.external.InterprocessCommunicationService.Get("EBPToEBP", "EBPToEBP", "ForInterWidgetCommunication");
iacbar.adapter.traceLog.sendLogError(" Error #"   failureInfo.number   " Description "   failureInfo.description);
iacbar.adapter.InterWidget = {
InterWidgetMRP.GetEvent(InterWidgetCommunicationMessageID).AddListener(
OnMessage: function (type, msg, messageexchangeId, mrpIdentifier, handled) {
async(function () { callback({ message: msg }) });
InterWidgetMRP.BroadcastMessage(InterWidgetCommunicationMessageID, message);
78
3$3-3E3v3}3
78u8
=:> ?5?;?
8094989<9
1O4X4Y6
F1X1 2F2V2
;$; ;2;9;
0-0A0M0a0}0
00
:":):2:7:
7074787<7
$0-040;0
3-363@3_3
11&282
4L4
=*>0>4>8><>
7 7$7(7,7074787
;$;*;0;6;];
9094989<9
4 4$4(4,40444
> >@>\>`>
? ?@?`?|?
7$7,747<7`7
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:Semaphore:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:NewBcpEventToken:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:NewBcpEvent:
.Release() failed!!! (
eCould not create the event %s
m_NewBcpEvent.Set() failed (
Error in extension Id - extension Id is over 48 characters long. Count: %d
Error in extension Id - non-hex character encountered, treating as zero: %x
Cookie 0xX removed!
Cookie 0xX not found!
Rpcrt4
RpcAsyncInitializeHandle() returned %d
RpcServerRegisterIfEx() returned %d
CAtlException X
Are we under attack? Nill value passed to RPC server
QueueUserAPC() failed with 0xX
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:SharedMemory:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:Mutex:
RpcStringFree() returned %d
gRpcBindingFromStringBinding() returned %d
RpcStringBindingCompose() returned %d
nKERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
HRESULT is 0xx
GetIdentifiers failed with error code 0xx
Error in Advise with Bcp. Error code is 0xx
Error in Unadvise with Bcp. Error code is 0xx
Error in CLocalBcp::PostData. Error code is 0xx
t8ExtPEx.dll
t8ExtPEx.dll is missing
EXEManager.dll
\StringFileInfo\XX\OriginalFilename
Mscoree.dll
Advapi32.dll
W.tlb
OLEAUT32.DLL
\\.\pipe\IAC.DebugTraceNamedPipe.6420F383-BCB1-4D5D-BFD9-BB977497E2E1
kernel32.dll
0.0.0.0
SetCurrentExtensionInfo [Invalid Version: %s]
\manifest.json
SetCurrentExtensionInfo wrong manifest version: %s]
Failed to read or parse the manifest [ExtensionDir: %s]
manifest.json
shell32.dll
%ls_%ls_xx%ls_%ls
ntdll.dll
cookie: %d
Failed to convert the stream's marshaling data into an interface pointer [HRESULT: 0xlx, cookie: %d, IStream: %p]
Exception thrown by executing a task on the thread pool
NULL IDispatch passed to DispInvokeHelper()
IAC-WatchedProcessEvent:%d
iacbarcxWebBrowserHost
iacbarcxWebBrowserHostParent
WBH.EnableJSErrorsDisplay.txt
.comm
#%d/#%d
tabs.onUpdated
wtabs.get
t8Html.dll
l#4 /p="%d" /c="%d"
9BFE145C-09C8-4696-AC31-73D9F4D63792:Mutex:
).Integrity(
.Browser(
).Bar
ieframe.dll
rgb(%d,%d,%d)
TraceLog.cfg
^(. ?)\=(. ?)$
).csv
WebBrowserHostManagerService
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CrExtP65.exe
CrExtProc.exe
CrExtP65.exe
1.0.7.183

CrExtP65.exe_1352:




.text
`.rdata
@.data
.rsrc
@.reloc
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
QVSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
SHELL32.dll
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\bidirectionalcommunicationprotocol\CIdentifierTrait.h
CBcp.cpp
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\bidirectionalcommunicationprotocol\CRpcCall.h
CCommunicationTrait.cpp
CSharedMemoryTrait.cpp
CRpcBingdingHandle.cpp
FreeRpcString::operator ()
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
MaxPolicyElementKey
()$^.* ?[]|\-{},:=!
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPMessage.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPBcpHelper.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPLocalBcp.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPEvent.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPImpl.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPHandshake.h
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Common\ResultInfo.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\services\extensioninternalapi\ScreenInfo.h
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Toolbar\ChromeExtAPI\Services\ExtensionInternalApi\CExtensionInternalApi.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPProviderImplBase.h
e:\teamcity\buildagent1\work\b016debbe225e71a\projects\chromeextapi_dal_gclid_qa\toolbar\chromeextapi\mrp\MRPLocalProviderImplBase.h
IAC::ExtensionInternalApi::Internal::CDispatchImpl::get_WebBrowserHostManager
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
JavaScriptDebugTrace.cpp
JavaScriptTraceLog.cpp
ServiceManager.cpp
CommandLineParameters.cpp
([^"]{1,64})
ExtensionInformationManager.cpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/json_parser_read.hpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/ptree_implementation.hpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/string_path.hpp
ExtensionLifetime.cpp
EventMonitoring.cpp
IAC::EventMonitoringService::`anonymous-namespace'::::operator ()
IAC::EventMonitoringService::CEventMonitoring::CThreadPoolWorker::Execute
MRPLib.cpp
IAC::WebBrowserHostManagerService::CWebBrowserTraits::GetExternal
WebBrowserHostManager.cpp
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::FinalConstruct
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::Get
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::GetAll
IAC::WebBrowserHostManagerService::CWebBrowserHostManagerT::CWebBrowserHost::GetProperty
IAC::WebBrowserHostManagerService::CChromeExtensionTraits::GetExtensionScriptCode
PluggableNamespaceHandler.cpp
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::Start
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::Read
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::ParseUrl
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::CombineUrl
IAC::WebBrowserHostManagerService::CPluggableNamespaceHandlerT::QueryInfo
ButtonWindowProvider.cpp
ButtonWindow.cpp
IAC::ExtensionInternalApi::Internal::CDispatchImpl::get_WebBrowserHostManager
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\SDKs\boost1.46.1\boost/property_tree/detail/json_parser_write.hpp
WidgetStorage.cpp
WidgetPropertyBag.cpp
Clipboard.cpp
E:\TeamCity\BuildAgent1\work\b016debbe225e71a\Projects\ChromeExtAPI_DAL_GCLID_QA\Build.TT\Release.x86\CrExtProc.pdb
DisconnectNamedPipe
SetNamedPipeHandleState
CreateIoCompletionPort
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CallMsgFilterW
EnumChildWindows
USER32.dll
GDI32.dll
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
UrlCanonicalizeW
UrlUnescapeW
UrlCreateFromPathW
UrlIsW
SHRegCloseUSKey
SHRegEnumUSKeyW
SHDeleteKeyW
SHRegOpenUSKeyW
SHRegDeleteEmptyUSKeyW
SHRegCreateUSKeyW
SHLWAPI.dll
USERENV.dll
VERSION.dll
CoInternetGetSecurityUrl
urlmon.dll
RPCRT4.dll
GetProcessHeap
GetCPInfo
zcÁ
.?AV?$IDispatchImpl@UIEventMonitoringSink@@$1?_GUID_606969f9_21d6_41dc_ac9f_8c3a6211daf0@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserEvents@CExtensionProcess@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AVCWebBrowserEvents@CExtensionProcess@@
.?AV?$CComObject@VCWebBrowserEvents@CExtensionProcess@@@ATL@@
.?AV?$CAtlExeModuleT@VCExtensionProcess@@@ATL@@
.?AV?$IDispatchImpl@UIClipboard@@$1?_GUID_028531e1_5078_4242_81cb_7cc385af4d6f@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPProvider@@$1?IID_IMRPProvider@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIScreenInfo@@$1?_GUID_277c85f9_1df0_4f37_bd20_c8e0c9724c35@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRP@@$1?IID_IMRP@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPEvent@@$1?IID_IMRPEvent@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPIdentifier@@$1?IID_IMRPIdentifier@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIMRPListener@@$1?_GUID_c300902d_0d9c_41d7_ae6f_850c508e3b37@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIExtensionInternalApi@@$1?_GUID_7d292731_4f6a_4e24_8da5_fddb3bcd6b29@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIJavaScriptDebugTrace@@$1?_GUID_f1d98e10_c66e_4303_b17e_debc666339ca@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIJavaScriptTraceLog@@$1?_GUID_b01322d8_dcd1_4404_af09_fd6e098504e0@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIScreenRect@@$1?IID_IScreenRect@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIResultInfo@@$1?_GUID_a042acb5_d06f_40e6_9e8f_6fd46d6c9805@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIPersistentStorage@@$1?_GUID_c152443c_6576_47df_a3a7_5bb882bea699@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$CExtensionInformationManagerServiceConsumer@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@IAC@@
.?AUIWebBrowserHostManager@@
.?AV?$IDispatchImpl@UIWebBrowserHostManager@@$1?_GUID_dff2bf4a_3ac4_478c_b12b_d1573ffcd07f@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IObjectWithSiteImpl@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@V?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$IDispatchImpl@UITraceFilter@@$1?_GUID_54594249_f9cc_4304_8c93_defa2a0b94da@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIExtensionInfo@@$1?_GUID_04c7b726_0fae_4dc5_b1e8_bc53e6d2d72f@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AV?$CThreadPool@VCThreadPoolWorker@CEventMonitoring@EventMonitoringService@IAC@@VCRTThreadTraits@ATL@@VWin32WaitTraits@6@@ATL@@
.?AVCPluggableNamespaceHandlerClassFactory@WebBrowserHostManagerService@IAC@@
.?AV?$CComObjectNoLock@VCPluggableNamespaceHandlerClassFactory@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CWindowImpl@VCSublassedChildWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AVCSublassedChildWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CWindowImpl@VCParentWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AVCParentWnd@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AV?$CWindowImpl@VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@6@@ATL@@
.?AUIWebBrowserHost@@
.?AV?$IDispatchImpl@UIWebBrowserHost@@$1?_GUID_2182956c_9e99_42ab_ab3d_e0e9f630991d@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AVCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@VCWebBrowserHost@?$CWebBrowserHostManagerT@VCWebBrowserTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CComContainedObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CComAggObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@
.?AV?$CComObject@V?$CPluggableNamespaceHandlerT@VCChromeExtensionTraits@WebBrowserHostManagerService@IAC@@@WebBrowserHostManagerService@IAC@@@ATL@@
.?AV?$IDispatchImpl@UIRichButtonWindow@@$1?_GUID_d3335624_ab87_4419_82c8_113318ec36be@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIUntrustedButtonWindow@@$1?_GUID_fc992dd0_3c68_432a_8925_d99dadb06736@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIInternalApiForUntrustedButtonWindow@@$1?IID_IInternalApiForUntrustedButtonWindow@@3U_GUID@@B$1?LIBID_ChromeExtLib@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UIInternalApiForButtonWindow@@$1?_GUID_6122aea5_a1b7_4ce5_b908_91bd0d271c28@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispatchImpl@UISecureHTMLChild@@$1?_GUID_b6c6d0da_8dfc_4e05_ab76_73ecbb568c29@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
.?AUIHTMLOMWindowServices@@
.?AV?$IServiceProviderImpl@VCWebBrowserHost@ButtonWindow@IAC@@@ATL@@
.?AV?$CWindowImpl@VCWebBrowserHost@ButtonWindow@IAC@@VCWindow@ATL@@V?$CWinTraits@$0MPAAAA@$0A@@5@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebBrowserHost@ButtonWindow@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B@ATL@@
.?AV?$IDispEventImpl@$00VCWebBrowserHost@ButtonWindow@IAC@@$1?_GUID_34a715a0_6587_11d0_924a_0020afc7ac4d@@3U__s_GUID@@B$1?LIBID_SHDocVw@@3U_GUID@@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@
.?AVCWebBrowserHost@ButtonWindow@IAC@@
.?AV?$CComObject@VCWebBrowserHost@ButtonWindow@IAC@@@ATL@@
.?AV?$IDispatchImpl@UIPropertyBagDisp@@$1?_GUID_878d78ad_8fe3_4c7c_bf55_16d3458c011e@@3U__s_GUID@@B$1?LIBID_ChromeExtLib@@3U_GUID@@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@
stdole2.tlbWWW
ChromeExtLib
muMsgType
.IBrowserInformationWL
btFirefoxWWW
keys
KCoLaunchEXEW(
tagMSGWW
pMsg(
IEXELauncher
sendLaunchExeWWW
sendDetectExeWWW
WebBrowserHostManagerWWW
r.UserData
|IWebBrowser2
%IWebBrowserAppWW$
8;'IWebBrowserW$
URLW
LocationURLW$
OLECMDID
OLECMDID_OPENWWW
`OLECMDID_NEW
OLECMDID_SAVEWWW
gOLECMDID_SAVEASW
OLECMDID_SAVECOPYASW
OLECMDID_PRINTPREVIEWWWW
OLECMDID_PAGESETUPWW
0>QOLECMDID_SPELLWW
0yGOLECMDID_PROPERTIESW
(OLECMDID_CUT
OLECMDID_COPYWWW
0VROLECMDID_PASTEWW
EOLECMDID_PASTESPECIALWWW
OLECMDID_UNDOWWW
OLECMDID_REDOWWW
OLECMDID_SELECTALLWW
OLECMDID_CLEARSELECTIONW
0gdOLECMDID_ZOOMWWW
0.wOLECMDID_GETZOOMRANGEWWW
;OLECMDID_UPDATECOMMANDSW
OLECMDID_REFRESH
OLECMDID_STOPWWW
OLECMDID_HIDETOOLBARSWWW
OLECMDID_SETPROGRESSMAXW
OLECMDID_SETPROGRESSPOSW
9OLECMDID_SETPROGRESSTEXT
OLECMDID_SETTITLEWWW
SOLECMDID_SETDOWNLOADSTATEWWW
VOLECMDID_STOPDOWNLOADWWW
|OLECMDID_ONTOOLBARACTIVATEDW
OLECMDID_FINDWWW
OLECMDID_DELETEW
#OLECMDID_HTTPEQUIVWW
!OLECMDID_HTTPEQUIV_DONEW
pOLECMDID_ENABLE_INTERACTIONW
OLECMDID_ONUNLOADWWW
OLECMDID_PROPERTYBAG2WWW
0DZOLECMDID_PREREFRESHW
OLECMDID_SHOWSCRIPTERROR
OLECMDID_SHOWMESSAGE
OLECMDID_SHOWFINDWWW
0?BOLECMDID_SHOWPAGESETUPWW
OLECMDID_SHOWPRINTWW
0dROLECMDID_CLOSEWW
OLECMDID_ALLOWUILESSSAVEASWW
OLECMDID_DONTDOWNLOADCSS
OLECMDID_UPDATEPAGESTATUSWWW
OLECMDID_PRINT2W
vOLECMDID_PRINTPREVIEW2WW
rOLECMDID_SETPRINTTEMPLATEWWW
0_sOLECMDID_GETPRINTTEMPLATEWWW
0OLECMDID_PAGEACTIONBLOCKEDWW
0cmOLECMDID_PAGEACTIONUIQUERYWW
OLECMDID_FOCUSVIEWCONTROLSWW
OLECMDID_FOCUSVIEWCONTROLSQUERYW
OLECMDID_SHOWPAGEACTIONMENUW
OLECMDID_ADDTRAVELENTRYW
OLECMDID_UPDATETRAVELENTRYWW
OLECMDID_UPDATEBACKFORWARDSTATEW
OLECMDID_OPTICAL_ZOOMWWW
0snOLECMDID_OPTICAL_GETZOOMRANGEWWW
OLECMDID_WINDOWSTATECHANGEDW
OLECMDID_ACTIVEXINSTALLSCOPE
OLECMDID_UPDATETRAVELENTRY_DATARECOVERYW
OLECMDID_SHOWTASKDLG
OLECMDID_POPSTATEEVENTWW
pOLECMDID_VIEWPORT_MODEWW
OLECMDID_LAYOUT_VIEWPORT_WIDTHWW
'0]mOLECMDID_VISUAL_VIEWPORT_EXCLUDE_BOTTOMW
OLECMDID_USER_OPTICAL_ZOOMWW
OLECMDID_PAGEAVAILABLEWW
0$6OLECMDID_GETUSERSCALABLE
OLECMDID_UPDATE_CARETWWW
OLECMDID_ENABLE_VISIBILITYWW
0W%OLECMDID_MEDIA_PLAYBACKW
OLECMDID_SETFAVICONW
OLECMDID_SET_HOST_FULLSCREENMODE
5OLECMDID_EXITFULLSCREENW
OLECMDID_SCROLLCOMPLETEW
OLECMDID_ONBEFOREUNLOADW
OLECMDFW
KOLECMDF_SUPPORTEDWWW
OLECMDF_ENABLEDW
OLECMDF_LATCHEDW
OLECMDF_NINCHEDW
09vOLECMDF_INVISIBLEWWW
$OLECMDF_DEFHIDEONCTXTMENUWWW\
cmdIDWWW
npcmdfWWWP
OLECMDEXECOPTWWWP
OLECMDEXECOPT_DODEFAULTWP
OLECMDEXECOPT_PROMPTUSERP
0:*OLECMDEXECOPT_DONTPROMPTUSERP
OLECMDEXECOPT_SHOWHELPWW\
cmdexecoptWW
webBrowserWW
{ppWebBrowser
8[.IMRPResponseCallback
81YIWebBrowserHostManagerWWd
IWebBrowserHostW
ppWebBrowserHost
pUnkWebBrowserHostEvents
gpvarWebBrowserHostsW
-8Xd__MIDL___MIDL_itf_ChromeExtLib_0001_0045_0001WWW
ct_ComplexEdgeWW
0z.ct_ViewObjWW,
Chrome Extension LibraryWW
Version of the browser as a string (major.minor.build.revision&
An empty property bag that can be filled and then stored by passing it to SaveStoredDataWW
IEXELauncher Interface
Web Browser Interface for IE4."
Web Browser Application Interface.
Web Browser interfaceW3
Navigates to the previous item in the history list.WWW/
Navigates to the next item in the history list.WWW
Go home/start page.WWW
Go Search Page.WWW
Navigates to a URL or file.WWW"
Returns the application automation object if accessible, this automation object otherwise..WWW^
Returns the container/parent automation object, if any.WWW6
The vertical position (pixels) of the frame window relative to the screen/container.WW=
The vertical dimension (pixels) of the frame window/object.WWWC
Gets the short (UI-friendly) name of the URL/file currently viewed.WWW(
Gets the full URL/path currently viewed.WW/
Query to see if something is still in progress.WWW/
Exits application and closes the open document.WWW(
Converts client sizes into window sizes.WWI
Associates vtValue with the name szProperty in the context of the object.WT
Retrieve the Associated value for the property vtValue in the context of the object.WW
Returns name of the application.WW*
Returns the path to the application.WW8
Determines whether the application is visible or hidden.WW
Controls which toolbar is shown.WW"
Navigates to a URL or file or pidl.WWW
IOleCommandTarget::ExecWWW
Reports the results of a read operationWWW'
IWebBrowserHostManager InterfaceWW
IWebBrowserHost InterfaceW
Created by MIDL version 7.00.0555 at Fri Mar 14 20:00:13 2014
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
//Replace window.alert so that the message box window does not take over
window.external.alert(message);
window.alert = alertDebug;
2011-10-19
See http://www.JSON.org/js.html
See http://javascript.crockford.com/jsmin.html
JSON.stringify(value, replacer, space)
will be passed the key associated with the value, and this will be
Date.prototype.toJSON = function (key) {
return this.getUTCFullYear()   '-'  
f(this.getUTCMonth()   1)   '-'  
f(this.getUTCDate())   'T'  
f(this.getUTCHours())   ':'  
f(this.getUTCMinutes())   ':'  
f(this.getUTCSeconds())   'Z';
You can provide an optional replacer method. It will be passed the
key and value of each member, with this bound to the containing
such that only members with keys listed in the replacer array are
JSON.stringify(undefined) returns undefined.
text = JSON.stringify(['e', {pluribus: 'unum'}]);
text = JSON.stringify(['e', {pluribus: 'unum'}], null, '\t');
text = JSON.stringify([new Date()], function (key, value) {
return this[key] instanceof Date ?
'Date('   this[key]   ')' : value;
JSON.parse(text, reviver)
transform the results. It receives each of the keys and values,
myData = JSON.parse(text, function (key, value) {
/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2}(?:\.\d*)?)Z$/.exec(value);
return new Date(Date.UTC( a[1],  a[2] - 1,  a[3],  a[4],
myData = JSON.parse('["Date(09/09/2001)"]', function (key, value) {
value.slice(0, 5) === 'Date(' &&
value.slice(-1) === ')') {
d = new Date(value.slice(5, -1));
getUTCMinutes, getUTCMonth, getUTCSeconds, hasOwnProperty, join,
if (typeof Date.prototype.toJSON !== 'function') {
return isFinite(this.valueOf())
? this.getUTCFullYear()   '-'  
f(this.getUTCDate())   'T'  
f(this.getUTCHours())   ':'  
f(this.getUTCMinutes())   ':'  
f(this.getUTCSeconds())   'Z'
String.prototype.toJSON =
Number.prototype.toJSON =
Boolean.prototype.toJSON = function (key) {
return this.valueOf();
'"': '\\"',
'\\': '\\\\'
escapable.lastIndex = 0;
return escapable.test(string) ? '"'   string.replace(escapable, function (a) {
: '\\u'   ('0000'   a.charCodeAt(0).toString(16)).slice(-4);
function str(key, holder) {
// Produce a string from holder[key].
k, // The member key.
value = holder[key];
typeof value.toJSON === 'function') {
value = value.toJSON(key);
value = rep.call(holder, key, value);
if (Object.prototype.toString.apply(value) === '[object Array]') {
length = value.length;
// Join all of the elements together, separated with commas, and wrap them in
v = partial.length === 0
? '[\n'   gap   partial.join(',\n'   gap)   '\n'   mind   ']'
: '['   partial.join(',')   ']';
length = rep.length;
partial.push(quote(k)   (gap ? ': ' : ':')   v);
// Otherwise, iterate through all of the keys in the object.
if (Object.prototype.hasOwnProperty.call(value, k)) {
// Join all of the member texts together, separated with commas,
? '{\n'   gap   partial.join(',\n'   gap)   '\n'   mind   '}'
: '{'   partial.join(',')   '}';
if (typeof JSON.stringify !== 'function') {
JSON.stringify = function (value, replacer, space) {
// that can replace values, or an array of strings that will select the keys.
typeof replacer.length !== 'number')) {
throw new Error('JSON.stringify');
// Make a fake root object containing our value under the key of ''.
if (typeof JSON.parse !== 'function') {
JSON.parse = function (text, reviver) {
function walk(holder, key) {
var k, v, value = holder[key];
return reviver.call(holder, key, value);
// Parsing happens in four stages. In the first stage, we replace certain
cx.lastIndex = 0;
if (cx.test(text)) {
text = text.replace(cx, function (a) {
('0000'   a.charCodeAt(0).toString(16)).slice(-4);
// We split the second stage into 4 regexp operations in order to work around
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
// JavaScript structure. The '{' operator is subject to a syntactic ambiguity
// In the optional fourth stage, we recursively walk the new structure, passing
throw new SyntaxError('JSON.parse');
failureInfo.description = e;
failureInfo.number = e;
failureInfo.description = e.toString();
if (e.number != undefined)
failureInfo.number = e.number.toString();
if (e.description != undefined && typeof e.description == 'string')
failureInfo.description = e.description;
else if (e.message != undefined && typeof e.message == 'string')
failureInfo.description = e.message;
var ButtonWindowSendMessageID = 2; //This message ID is being used for all SendRequest message in untrusted button window
this.onMessage = function (callback) {
mrp.GetEvent(ButtonWindowPostMessageID).AddListener(
{ OnMessage: function (type, msg, messageexchangeId, mrpIdentifier, handled) {
callback({ message: msg });
this.onRequest = function (callback) {
mrp.GetEvent(ButtonWindowSendMessageID).AddListener(
callback({ message: msg }, function (message) {
mrp.SendResponse(message, messageexchangeId);
this.postMessage = function (message) {
mrp.PostMessage(ButtonWindowPostMessageID, message);
this.sendRequest = function (message, callback) {
mrp.SendRequest(ButtonWindowSendMessageID, message, {
OnResponse: function (msg) {
OnError: function (err, msg) {
P// the only global variable that should be defined by the chrome extension. All others fall under a
var iacbar = { adapter: { traceLog: window.external.TraceLog } };
var XMLHttpRequestCallID = 2;
this.top = top;
this.left = left;
this.width = width;
this.height = height;
var extID = window.external.ExtensionInfo.extensionId;
this.m_internalAPI_MRP = window.external.InterprocessCommunicationService.Get("EBP_"   extID, "EC_"   extID, "Ticker");
iacbar.adapter.traceLog.sendLogError(" Error #"   failureInfo.number   " Description"   failureInfo.description);
InternalAPI.InitializeMRP();
// iacbar.adapter.manifest
iacbar.adapter.manifest = JSON.parse(window.external.ExtensionInfo.manifest);
iacbar.adapter.debugTrace = window.external.DebugTrace;
var JavaScriptCritical = iacbar.adapter.debugTrace.JavaScriptCritical;
var JavaScriptError = iacbar.adapter.debugTrace.JavaScriptError;
var JavaScriptWarning = iacbar.adapter.debugTrace.JavaScriptWarning;
var JavaScriptInformational = iacbar.adapter.debugTrace.JavaScriptInformational;
var JavaScriptVerbose = iacbar.adapter.debugTrace.JavaScriptVerbose;
var TestError = iacbar.adapter.debugTrace.TestError;
var TestWarning = iacbar.adapter.debugTrace.TestWarning;
backgroundpage: window.external.ExtensionInfo.background_page
iacbar.adapter.extension = {
// iacbar.adapter.extension.getBackgroundPage
var background_page = iacbarExt.backgroundpage;
if (background_page.length > 0) {
var webControlHost = window.external.WebBrowserHostManager.GetAll(); // SAFEARRAYs are of type VBArray in JScript
background_page = background_page.toLowerCase();
for (var nCntr = webControlHost.lbound(1); nCntr <= webControlHost.ubound(1);   nCntr) {
var item = webControlHost.getItem(nCntr);
if (item.resource.toLowerCase() == background_page) {
return item.webBrowser.document.parentWindow;
if (background_page.length == 0 || item.resource.toLowerCase() != background_page) {
views[i] = item.webBrowser.document.parentWindow;
// iacbar.adapter.extension.localPath
localPath: window.external.ExtensionInfo.installDirectory
ToolbarSettings: window.external.ToolbarSettings
// For details on the following APIs see the latest version of Mindspark Widget API*.docx
iacbar.adapter.toolbar = {
sendGetToolbarSettings : function(keys, callback) {
allSettings.toolbarId = settings.ToolbarId;
allSettings.partnerId = settings.PartnerId;
allSettings.partnerSubId = settings.PartnerSubId;
allSettings.installDate = settings.InstallDate;
allSettings.toolbarVersion = settings.ToolbarVersion;
allSettings.toolbarLanguage = settings.ToolbarLanguage;
allSettings.apiVersion = "1.5";
}(iacbarExt.ToolbarSettings);
if (undefined == keys) {
if (typeof keys == "string") {
keys = new Array(keys);
} else if (Object.prototype.toString.call(keys) !== "[object Array]") {
for (var iKeys = 0; iKeys < keys.length; iKeys   )
var key = keys[iKeys];
if (typeof key != "string")
throw new Error("Array element #"   iKeys   " is not 'string'");
if (undefined == toolbarSettings[key])
throw new Error("Invalid element in array '"   key   "'");
ret[key] = toolbarSettings[key];
if (undefined != ret.toolbarLanguage) {
if (ret.toolbarLanguage < 0 || ret.toolbarLanguage >= arLanguage.length) {
ret.toolbarLanguage = navigator.userLanguage;
var lang = arLanguage[ret.toolbarLanguage];
if (0 == navigator.userLanguage.indexOf(lang))
ret.toolbarLanguage = lang;
ICS: window.external.InterprocessCommunicationService,
extensionId: window.external.ExtensionInfo.extensionId
oErr.description = "Not a valid ticker update property object.";
if (oProp.effect == 'fade' || oProp.effect == 'scrollLeft' || oProp.effect == 'scrollRight') {
tickerProp.effect = oProp.effect;
tickerProp.effect = 'fade';
if (undefined != oProp.fontFace) {
if (typeof oProp.fontFace !== 'string') {
oErr.description = "Type mismatch - fontFace";
tickerProp.fontFace = oProp.fontFace;
if (undefined != oProp.scrollSpeed) {
if (typeof oProp.scrollSpeed !== 'number') {
oErr.description = "Type mismatch - scrollSpeed";
tickerProp.scrollSpeed = oProp.scrollSpeed;
tickerProp.scrollSpeed = 1;
if (typeof oProp.displayDuration != 'undefined') {
if (typeof oProp.displayDuration !== 'number') {
oErr.description = "Type mismatch - displayDuration";
tickerProp.duration = oProp.displayDuration;
tickerProp.duration = 3000;
if (typeof oProp.fadeInDuration != 'undefined') {
if (typeof oProp.fadeInDuration !== 'number') {
oErr.description = "Type mismatch - fadeInDuration";
tickerProp.fadeIn = oProp.fadeInDuration;
tickerProp.fadeIn = 0;
if (typeof oProp.fadeOutDuration != 'undefined') {
if (typeof oProp.fadeOutDuration !== 'number') {
oErr.description = "Type mismatch - fadeOutDuration";
tickerProp.fadeOut = oProp.fadeOutDuration;
tickerProp.fadeOut = 0;
if (typeof oProp.scrollSpeed != 'undefined') {
tickerProp.scrollSpeed = 0;
if (typeof oProp.width != 'undefined') {
if (typeof oProp.width != 'object') {
oErr.description = "Type mismatch - width";
if (typeof oProp.width.fitText != 'undefined') {
if (typeof oProp.width.fitText != 'boolean') {
oErr.description = "Type mismatch - width-fitText";
if (true == oProp.width.fitText)
tickerProp.size = 1; //fit text
tickerProp.size = 2; //Use specified width
if (typeof oProp.width.custom != 'undefined') {
if (typeof oProp.width.custom != 'number') {
oErr.description = "Type mismatch - width-custome";
tickerProp.width = oProp.width.custom;
tickerProp.size = 0; //No change
tickerProp.width = 0;
if (typeof oProp.backgroundColor != 'undefined') {
if (typeof oProp.backgroundColor !== 'string') {
oErr.description = "Type mismatch -backgroundColor";
tickerProp.backgroundColor = oProp.backgroundColor;
if (typeof oProp.xhtmlFragments != 'undefined') {
if (Object.prototype.toString.call(oProp.xhtmlFragments) != '[object Array]') {
oErr.description = "Type mismatch -xhtmlFragments";
tickerProp.text = oProp.xhtmlFragments.join("\n");
oErr.description = "Property missing - xhtmlFragments";
if (typeof oProp.fontColor != 'undefined') {
if (typeof oProp.fontColor !== 'string') {
oErr.description = "Type mismatch - fontColor";
tickerProp.textColor = oProp.fontColor;
InternalAPI.BroadcastTickerUpdate = function (oProp) {
var jsonStr = JSON.stringify(oProp);
this.m_internalAPI_MRP.BroadcastMessage(TickerUpdateMessageID, jsonStr);
InternalAPI.BroadcastBarItemProxyCall = function (oProp) {
this.m_internalAPI_MRP.BroadcastMessage(BarItemProxyCallID, jsonStr);
iacbar.adapter.barItem = {
// iacbar.adapter.barItem.ticker.update
An XHTML fragment, lacking any tags (i.e. plain text) is also supported.
//iacbar.adapter.barItem.ticker.update(object updateProperties, function(object result) {...})
var tickerProp = Ticker.ConvertUpdatePropObjToTickerDll(updateProperties);
InternalAPI.BroadcastTickerUpdate(tickerProp);
// iacbar.adapter.barItem.ticker.onClicked.addListener
var extID = iacbarExt.extensionId;
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "ticker.onClicked");
var event = mrp.GetEvent(TickerOnClickEventID);
event.addListener({ OnMessage: function(type, message, messageexchangeid, mrpIdentifier, handled) {
var prop = JSON.parse(message);
callback({information : {tabId : parse2Int(prop.tabId), callbackId : prop.id}});
// iacbar.adapter.barItem.update
//iacbar.adapter.barItem.update(object updateProperties, function(object result) {...})
inParams.action = "update";
if (typeof updateProperties.text === 'string')
inParams.text = updateProperties.text;
if (typeof updateProperties.title === 'string')
inParams.title = updateProperties.title;
if (typeof updateProperties.imagePath === 'string')
inParams.imagePath = updateProperties.imagePath;
if (!InternalAPI.BroadcastBarItemProxyCall(inParams))
// iacbar.adapter.barItem.onClicked.addListener
this.m_BarItem_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "baritem");
this.m_BarItem_Event = this.m_BarItem_MRP.GetEvent(BarItemProxyCallID);
this.m_BarItem_Event.AddListener(
// iacbar.adapter.barItem.onHover.addListener
// iacbar.adapter.barItem.onHover.addListener(function(Tab tab) {
url (string)
The URL the tab is displaying.
function Tab(id, windowId, url, screenRect) {
if (windowsId == undefined)
if (url == undefined)
throw new Error("The url of the Tab is a required parameter");
this.id = id;
this.windowsId = windowsId
this.url = url;
this.screenRect = screenRect;
SendRequest(2, "{"url":"https://xml.gasbuddy.com/GasBuddy_Mindspark_Zip.ashx?xml=n","method":"POST","header":"undefinedContent-Type\napplication/json\n","action":"send","body":"{\"Zip\":\"98101\",\"City\":\"\",\"State\":\"\",\"CustomerName\":\"Mindspark\",\"Key\":\"m5d8c1we9bas\",\"Time\":\"Fri, 11 May 2012 17:34:35 GMT\"}"}", 0x0270EE44)
iacbar.adapter.tabs = {
// iacbar.adapter.tabs.create
The URL to navigate the tab to initially. The URL will not be processed, but simply passed to IE and loaded as it will.
// iacbar.adapter.tabs.create(object createProperties, function(object result) {...});
if (prop.url == undefined)
throw new Error("Url is a required parameter");
if (typeof prop.url != 'string')
throw new Error("Url is not string");
prop.method = "create";
var jsonMsg = JSON.stringify(prop);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(TabsServiceCallID, jsonMsg);
// iacbar.adapter.tabs.get
if (undefined != window.external.ButtonWindow) {
requestId  = " "   iacbar.adapter.thisButtonWindow.id;
throw new Error("Exception 'window.external.ButtonWindow.id'");
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "tabs.get");
var event = mrp.GetEvent(TabsGetEventID);
var tab = JSON.parse(message);
if (tab.requestId != requestId)
delete tab.requestId;
tab.id = parse2Int(tab.id);
tab.windowId = parse2Int(tab.windowId);
tab.left = parse2Int(tab.left);
tab.top = parse2Int(tab.top);
tab.right = parse2Int(tab.right);
tab.bottom = parse2Int(tab.bottom);
tab.active = tab.active == "true";
tab.screenRect = new ScreenRect(tab.top, tab.left, tab.right - tab.left, tab.bottom - tab.top);
delete tab.left;
delete tab.top;
delete tab.right;
delete tab.bottom;
tab.wndLeft = parse2Int(tab.wndLeft);
tab.wndTop = parse2Int(tab.wndTop);
tab.wndRight = parse2Int(tab.wndRight);
tab.wndBottom = parse2Int(tab.wndBottom);
tab.windowScreenRect = new ScreenRect(tab.wndTop, tab.wndLeft, tab.wndRight - tab.wndLeft, tab.wndBottom - tab.wndTop);
delete tab.wndLeft;
delete tab.wndTop;
delete tab.wndRight;
delete tab.wndBottom;
result.tab = tab;
event.RemoveListener(this);
prop.method = "get";
prop.tabId = tabId;
prop.requestId = requestId;
// iacbar.adapter.tabs.update
url (optional string)
A URL to navigate the tab to.
// iacbar.adapter.tabs.update(integer tabId, object updateProperties, function(object result) {...});
if (undefined == prop.url)
prop.method = "update";
// iacbar.adapter.tabs.onUpdated
The tab's URL if it has changed.
// iacbar.adapter.tabs.onUpdated.addListener(function(integer tabId, object changeInfo) {...});
var mrp = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "tabs.onUpdated");
var event = mrp.GetEvent(TabsOnUpdatedEventID);
var obj = JSON.parse(message);
var tabId = parse2Int(obj.tabId);
delete obj.tabId;
if ("true" == obj.removed)
obj.removed = true;
else if ("true" == obj.active)
obj.active = true;
else if ("false" == obj.active)
obj.active = false;
// iacbar.adapter.tabs.searchBoxText.get
if (retrievalParams.tabId) {
if (typeof(retrievalParams.tabId) != "number")
throw { description: "The optional retrievalParams.tabId parameter must be a number" };
tabID = retrievalParams.tabId;
var extensionID = iacbarExt.extensionId;
var mrp = iacbarExt.ICS.Get("EBP_"   extensionID, "EC_"   extensionID, tabIdentifier);
mrp.SendRequest(TabIDSearchBoxContentMessageID, "\\", {
iacbar.adapter.tabs.get(null, function (result) {
f(result.tab.id);
// iacbar.adapter.tabs.executeScript
// Have the script engine running in the WebBrowser of the specified tab window execute the specified JavaScript code.
JavaScript code to execute in the tab.
Called after all the JavaScript has been executed or an error occurred
// iacbar.adapter.tabs.executeScript(object scriptProperties, function(object result) {...});
if (scriptProperties.tabId != undefined && typeof scriptProperties.tabId != "number")
throw new Error("'scriptProperties.tabId' is not a number");
if (scriptProperties.script == undefined)
throw new Error("'scriptProperties.script' is a required property");
if (typeof scriptProperties.script != 'string')
throw new Error("Property 'scriptProperties.script' is not a string");
inParams.action = "execScript";
inParams.code = scriptProperties.script;
var jsonMsg = JSON.stringify(inParams);
mrp.SendRequest(PageServiceCallID, jsonMsg, {
var info = JSON.parse(message);
if (info.HRESULT != undefined) {
callback({failureInfo : {HRESULT : parseInt(info.HRESULT, 10)}});
if (scriptProperties.tabId == undefined) {
f(scriptProperties.tabId);
PAD// window.XMLHTTPRequest
http://msdn.microsoft.com/en-us/library/windows/desktop/ms759148(v=vs.85).aspx
For this method only a true value is supported for the varAsync parameter.
This is not supported
This is currently not supported
window.XMLHttpRequest = function () {
// Assigns method, destination URL, and other optional attributes of a pending request.
// open(sMethod, sUrl [, bAsync] [, sUser] [, sPassword])
this.open = function (sMethod, sUrl, bAsync, sUser, sPassword) {
this.initialize();
if (typeof sUrl == 'undefined')
throw { description: "sUrl is required." };
this.onreadystatechange = null;
this.onReadyStateChange = null;
payload.url = sUrl;
payload.method = sMethod;
if (typeof sUser != 'undefined' && typeof sUser == 'string' && sUser.length > 0) {
payload.user = sUser;
if (typeof sPassword != 'undefined')
payload.password = sPassword;
this.readyState = 1; //A request has been opened, but the send method has not been called.
// Sends an HTTP request to the server and receives a response.
this.send = function (varBody) {
if (this.readyState != 1)
this.XMLHttpRequestSendListener = {
if (this.XMLHttpRequestObj !== null) {
var msg = JSON.parse(Message);
this.XMLHttpRequestObj.responseText = msg.responseText;
this.XMLHttpRequestObj.status = msg.status;
this.XMLHttpRequestObj.statusText = msg.statusText;
this.XMLHttpRequestObj.allResponseHeaders = msg.allResponseHeaders;
if (typeof this.XMLHttpRequestObj.responseText === 'string') {
this.XMLHttpRequestObj.responseXML = new window.ActiveXObject("Microsoft.XMLDOM");
this.XMLHttpRequestObj.responseXML.async = false;
var m = this.XMLHttpRequestObj.responseText.match(/^\s*]*>/i);
this.XMLHttpRequestObj.responseText = ""   this.XMLHttpRequestObj.responseText.slice(m[0].length);
this.XMLHttpRequestObj.responseXML.loadXML(this.XMLHttpRequestObj.responseText);
this.XMLHttpRequestObj.readyState = 4; //All the data has been received.
if ((this.XMLHttpRequestObj.onreadystatechange !== null) &&
(typeof this.XMLHttpRequestObj.onreadystatechange == 'function')) {
this.XMLHttpRequestObj.onreadystatechange();
} else if ((this.XMLHttpRequestObj.onReadyStateChange !== null) &&
(typeof this.XMLHttpRequestObj.onReadyStateChange == 'function')) {
this.XMLHttpRequestObj.onReadyStateChange();
this.XMLHttpRequestObj.readyState = 3;
if (typeof this.XMLHttpRequestObj.onreadystatechange == 'function') {
this.XMLHttpRequestObj.onreadystatechange = null;
} else if (typeof this.XMLHttpRequestObj.onReadyStateChange == 'function') {
this.XMLHttpRequestObj.onReadyStateChange = null;
XMLHttpRequestObj: null
this.XMLHttpRequestSendListener.XMLHttpRequestObj = this;
payload.action = "send";
payload.body = varBody;
var jsonMsg = JSON.stringify(payload);
InternalAPI.m_internalAPI_MRP.SendRequest(XMLHttpRequestCallID, jsonMsg, this.XMLHttpRequestSendListener);
this.readyState = 2; //The send method has been called. No data is available yet.
//Cancels the current HTTP request.
this.abort = function () {
this.readyState = 4;
if (this.XMLHttpRequestObj.onreadystatechange !== null) {
var callback1 = this.XMLHttpRequestObj.onreadystatechange;
} else if (this.XMLHttpRequestObj.onReadyStateChange !== null) {
var callback2 = this.XMLHttpRequestObj.onReadyStateChange;
this.readyState = 0;
//Adds custom HTTP headers to the request.
this.setRequestHeader = function (sName, sValue) {
if (typeof this._payload.headers === 'undefined')
this._payload.headers = "";
this._payload.headers  = sName   '\n'   sValue   '\n';
this.getResponseHeader = function (sName) {
if (typeof this.allResponseHeaders == 'undefined')
this._responseHeaders = this.allResponseHeaders.split("\n");
nameWithColon = nameWithColon.toLowerCase();
for (var i = 0; i < this._responseHeaders.length; i  ) {
var first = this._responseHeaders[i].slice(0, nameWithColon.length).toLowerCase();
return this._responseHeaders[i].slice(nameWithColon.length);
this.responseBody = null;
this.responseText = null;
this.status = null;
this.statusText = null;
this.allResponseHeaders = null;
this.responseXML = null;
// Retrieves the current state of the request operation.
this.aborted = false;
this.XMLHttpRequestSendListener = null;
this.initialize = function () {
if (this.XMLHttpRequestSendListener !== null)
this.XMLHttpRequestSendListener.XMLHttpRequestObj = null;
iacbar.adapter.shell = {
// iacbar.adapter.shell.sendLaunchExe
The url of the manifest file to download. The manifest is accompanied by a signature file, which has the same name as the manifest, with ".signature" attached on the end.
sendLaunchExe: function (properties, callback) {
if (typeof properties.url != 'string') {
throw new Error("url is a required string");
if (typeof properties.template != 'string') {
if (properties.commandLine && typeof properties.commandLine != 'string') {
if (!iacbarExt.Shell) {
iacbarExt.Shell = window.external.Shell;
iacbarExt.Shell.sendLaunchExe(properties, typeof callback == 'function' ? function (result) {
// iacbar.adapter.shell.sendDetectExe
sendDetectExe: function (properties, callback) {
iacbarExt.Shell.sendDetectExe(properties, callback);
Clipboard: window.external.Clipboard
iacbar.adapter.clipboard = {
// iacbar.adapter.clipboard.getText
callback({clipboardText: iacbarExt.Clipboard.GetText()});
// iacbar.adapter.clipboard.putText
iacbarExt.Clipboard.SetText(text);
Piacbar.adapter.localKeyValueStore = {
keys (optional)
A string or array of strings containing the name of the stored keys to
variables[key] == value for each key/value retrieved
Contains a property for each requested key with the corresponding
sendGetStoredData : function(keys, callback) {
var translatedKeys;
if (keys === null) {
translatedKeys = "";
} else if (Object.prototype.toString.call(keys) === "[object Array]") {
for (var i = 0; i < keys.length; i  ) {
translatedKeys  = keys[i]   "\n";
} else if (typeof keys == 'function' && callback === undefined) {
callback = keys;
translatedKeys = keys;
responseHandler.OnReadCompletion = function(bag, result) {
for (var i = 0; i < bag.CountProperties(); i  ) {
var name = bag.GetPropertyName(i);
var value = bag.GetPropertyValue(i);
// now call the api with the translated keys
window.external.PersistentStorage.GetStoredData(translatedKeys, responseHandler);
var bag = window.external.PersistentStorage.CreatePropertyBagInstance();
bag.Write(property, variables[property]);
responseHandler.OnWriteCompletion = function(result) {
window.external.PersistentStorage.UpdateStoredData(bag, responseHandler);
ScreenInfo: window.external.ScreenInfo,
iacbar.adapter.anchors = {
// iacbar.adapter.anchors.getInfo
//iacbar.adapter.anchors.getInfo(string anchorName, function(object result) {...})
if ((result.tab != null) && (typeof InternalAPI.m_internalAPI_MRP === 'object')) {
var tabID_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, result.tab.id);
var tabID_ScreenRectMsgEvt = tabID_MRP.GetEvent(TabIDScreenRectMessageID);
tabID_ScreenRectMsgEvt.AddListener({OnMessage: function (type, message, messageexchangeid, mrpIdentifier, handled) {
if (typeof info.HRESULT != "undefined") {
info.screenRect = new ScreenRect(parse2Int(info.top), parse2Int(info.left), parse2Int(info.width), parse2Int(info.height));
delete info.left;
delete info.top;
delete info.height;
delete info.width;
info.anchorName = anchorNameParam;
tabID_ScreenRectMsgEvt.RemoveListener(this);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(BarItemCallId, JSON.stringify({ action: "getscreenrect" }));
iacbar.adapter.tabs.get(null, function(result) {
if(result.failureInfo) {
callback({information : {anchorName : anchorNameParam, screenRect : result.tab.screenRect}});
callback({information : {anchorName : anchorNameParam, screenRect : result.tab.windowScreenRect}});
this.m_ToolbarUIInformation_MRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, "toolbaruiinformation");
this.m_ToolbarUIInformation_Event = this.m_ToolbarUIInformation_MRP.GetEvent(ToolbarUIInformationCallID);
event.RemoveListener(listener);
info.left = parse2Int(info.left);
info.top = parse2Int(info.top);
info.right = parse2Int(info.right);
info.bottom = parse2Int(info.bottom);
info.screenRect = new ScreenRect(info.top, info.left, info.right - info.left, info.bottom - info.top);
delete info.right;
delete info.bottom;
event.AddListener(listener);
inParams.action = "getInfo";
inParams.anchorName = anchorNameParam;
var jsonStr = JSON.stringify(inParams);
InternalAPI.m_internalAPI_MRP.BroadcastMessage(ToolbarUIInformationCallID, jsonStr);
iacbarExt.ScreenInfo.getAnchorRect(anchorNameParam, function(retVal) {
var rect = retVal.screenInfo.getItem(0);
callback({information: {anchorName : anchorNameParam, screenRect: new ScreenRect(parse2Int(rect.top),parse2Int(rect.left),parse2Int(rect.width),parse2Int(rect.height))}});
ScreenInfo: window.external.ScreenInfo
iacbar.adapter.screen = {
// iacbar.adapter.screen.getInfo
Same valid values as parameter with this name taken by anchors.getInfo
if ( anchorInfoResult.failureInfo != undefined )
result.failureInfo = anchorInfoResult.failureInfo;
if ( anchorInfoResult.screenInfo != undefined )
result.screenInfo = anchorInfoResult.screenInfo.toArray();
if ( anchorInfoResult.status != undefined )
result.status = anchorInfoResult.status;
if ( anchorInfoResult.exitCode != undefined )
result.exitCode = anchorInfoResult.exitCode;
var screenInfo = iacbarExt.ScreenInfo;
if (screenSelectionInfo.buttonWindowId != null) {
var buttonId = window.external.WebBrowserHostManager.GetButtonWindow(screenSelectionInfo.buttonWindowId);
screenInfo.getScreenRects(buttonId.ScreenRect, AnchorInfoResultToResultCallbackWrapper);
else if (screenSelectionInfo.anchorName != null) {
iacbar.adapter.anchors.getInfo(screenSelectionInfo.anchorName, function (anchorInfoResult) {
if (anchorInfoResult.failureInfo != null) {
screenInfo.getScreenRects(anchorInfoResult.information.screenRect, AnchorInfoResultToResultCallbackWrapper);
screenInfo.getScreenRects(null, AnchorInfoResultToResultCallbackWrapper);
Piacbar.adapter.windows = {
// iacbar.adapter.windows.create
// Creates (opens) a new browser with any optional sizing, position or default URL provided.
url (string or array of string)
A URL or list of URLs to open as tabs in the window.
Fully-qualified URLs must include a scheme (i.e. 'http://www.google.com', not 'www.google.com').
Relative URLs will be relative to the current page within the extension.
var rect = prop.screenRect;
prop.left = rect.left;
prop.top = rect.top;
prop.width = rect.width;
prop.height = rect.height;
prop.method = "createWindow";
ButtonWindow: window.external.ButtonWindow
iacbar.adapter.windowClipping = {
// iacbar.adapter.windowClipping.addOpaqueChild
if (typeof data.child !== 'object')
throw new Error("Type mismatch - data.child");
if (data.clippingType === undefined)
data.clippingType = 'roundRect';
if (typeof data.clippingType !== 'string')
throw new Error("Type mismatch - data.clippingType");
if (data.clippingType !== "roundRect" && data.clippingType !== "complex" && data.clippingType !== "iviewobject")
throw new Error("Invalid clippingType - supported clipping type are [roundRect, complex, iviewobject]");
if (data.clippingType === "roundRect") {
if (data.roundedEdgeWidth === undefined)
data.roundedEdgeWidth = 0;
if (data.roundedEdgeHeight === undefined)
data.roundedEdgeHeight = 0;
if (typeof data.roundedEdgeWidth !== 'number')
throw new Error("Type mismatch - data.roundedEdgeWidth");
if (typeof data.roundedEdgeHeight !== 'number')
throw new Error("Type mismatch - data.roundedEdgeHeight");
var clipType = data.clippingType == "roundRect" ? 0 : (data.clippingType == "complex" ? 1 : 2);
iacbarExt.ButtonWindow.HTMLChild.RegisterChildEx(data.child, data.roundedEdgeWidth, data.roundedEdgeHeight, clipType, true);
// iacbar.adapter.windowClipping.removeOpaqueChild
iacbarExt.ButtonWindow.HTMLChild.RegisterChildEx(child, 0, 0, 0, false);
iacbarExt.ButtonWindow.HTMLChild.UpdateClip();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(627):STDMETHODIMP CSkinWindowDisp::RemoveClip()
iacbarExt.ButtonWindow.HTMLChild.RemoveClip();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(647):STDMETHODIMP CSkinWindowDisp::SaveShape(long* pIdentifier)
var shapeId = iacbarExt.ButtonWindow.HTMLChild.SaveShape();
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(657):STDMETHODIMP CSkinWindowDisp::CopyShape(long identifier)
iacbarExt.ButtonWindow.HTMLChild.CopyShape(shapeIdentifier);
// \\site3devfs01\vveprik\m3skin1,3,20,0\SkinManager\WndDispatch.cpp(667):STDMETHODIMP CSkinWindowDisp::DeleteShape(long identifier)
iacbarExt.ButtonWindow.HTMLChild.DeleteShape(shapeIdentifier);
this.id = buttonWindow.ID;
this.type = buttonWindow.Type;
this.title = buttonWindow.Title;
this.sizeIsClientArea = buttonWindow.SizeIsClientArea;
this.focused = buttonWindow.Focused;
this.hidden = buttonWindow.Hidden;
this.scrollable = buttonWindow.Scrollable;
this.screenRect = { top: buttonWindow.ScreenRect.Top, left: buttonWindow.ScreenRect.Left, height: buttonWindow.ScreenRect.Height, width: buttonWindow.ScreenRect.Width };
this.closed = buttonWindow.Closed;
this.commEndPoint = new MRPJSWrapper(buttonWindow.MRPRemote);
this.type = type;
this.title = title;
this.focused = focused;
this.closed = closed;
WebBrowserHostManager: window.external.WebBrowserHostManager,
responceHandler.OnResponse = function (message) {
callback(JSON.parse(message), data);
responceHandler.OnError = function (err, message) {
prop.method = "getHWND";
prop.windowId = windowId;
InternalAPI.m_internalAPI_MRP.SendRequest(WindowMapperServiceCallId, jsonMsg, responceHandler);
iacbar.adapter.buttonWindows = {
// iacbar.adapter.buttonWindows.create
// Creates (opens) a new button window with any optional sizing, position or default URL provided.
A URL to open in the button window.
For isolate & untrusted window - url must be an http/https that includes a domain name
If specified, the iacbar.data attribute will be set to this parameter (for the DOM of the button window).
The url must be an http/https that includes a domain name.
The url must be relative to the extension installation directory.
The url must be a relative to the extension installation directory.
if (createData.api && typeof createData.api == 'string') {
if (createData.api === 'none')
else if (createData.api === 'post-loaded communication')
else if (createData.api !== 'rich')
if (createData.url == undefined)
throw new Error("url is a required parameter for button window");
if (typeof createData.url != 'string')
throw new Error("Invalid datatype - url");
var url;
if (createData.url.length >= 7) {
url = createData.url.substr(0, 8).toLowerCase();
if (url.slice(0, -1) == "http://" || url == "https://")
throw new Error("URL must be relative to the extension installation directory");
url = "iacbarcx://extension/"   createData.url
url = createData.url;
// URL rather than remote URL, rather than trying to do rigorous and thorough
// validation on the URL.
if (url.length < 4 || url.substring(0, 4).toLowerCase() != "http")
throw new Error("URL protocol must be HTTP or HTTPS");
if (createData.tabDependentCreateData == undefined && createData.tabIndependentCreateData == undefined)
if (typeof createData.tabDependentCreateData != 'object' && typeof createData.tabIndependentCreateData != 'object')
if (createData.screenRect != undefined && typeof createData.screenRect == 'object')
screenRect = createData.screenRect;
var sizeIsClientArea = typeof createData.sizeIsClientArea != 'boolean' ? false : createData.sizeIsClientArea;
if (createData.focused != undefined && typeof createData.focused == 'boolean')
focused = createData.focused;
if (createData.hidden != undefined && typeof createData.hidden == 'boolean')
hidden = createData.hidden;
if (createData.scrollable != undefined && typeof createData.scrollable == 'boolean')
scrollable = createData.scrollable;
if (createData.data != undefined && typeof createData.data == 'object')
data = createData.data;
if (createData.tabDependentCreateData != undefined) {
if (createData.tabDependentCreateData.tabId != undefined) {
if (typeof createData.tabDependentCreateData.tabId != 'number')
throw new Error("Invalid datatype - tabDependentCreateData.tabId");
tabId = createData.tabDependentCreateData.tabId;
if (createData.tabDependentCreateData.modal != undefined) {
if (typeof createData.tabDependentCreateData.modal != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.modal");
modal = createData.tabDependentCreateData.modal;
if (createData.tabDependentCreateData.modlessToTab != undefined) {
if (typeof createData.tabDependentCreateData.modlessToTab != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.modlessToTab");
modlessToTab = createData.tabDependentCreateData.modlessToTab;
if (createData.tabDependentCreateData.menuLike != undefined) {
if (typeof createData.tabDependentCreateData.menuLike != 'boolean')
throw new Error("Invalid datatype - tabDependentCreateData.menuLike");
menuLike = createData.tabDependentCreateData.menuLike;
buttonWnd.apiType = apiType;
buttonWnd.url = url;
buttonWnd.modal = modal;
buttonWnd.modlessToTab = modlessToTab;
buttonWnd.menuLike = menuLike;
buttonWnd.screenRect = screenRect;
buttonWnd.sizeIsClientArea = sizeIsClientArea;
buttonWnd.focused = focused;
buttonWnd.hidden = hidden;
buttonWnd.scrollable = scrollable;
buttonWnd.data = data;
buttonWnd.callback = callback;
buttonWnd.tabServicecallback = function (result) {
if (result.HRESULT != undefined) {//There is an error
if (typeof buttonWnd.callback == 'function') {
buttonWnd.callback({ failureInfo: { number: result.HRESULT} });
if (result.tab === undefined)
if (typeof result.tab !== 'object')
if (typeof result.tab.id !== 'number')
if (typeof result.tab.windowId !== 'number')
if ((true === buttonWnd.modal) || ((true !== buttonWnd.menuLike) && (true !== buttonWnd.modlessToTab))) {//for modal/modless browser window
WindowMapperHelper.GetWindowHandleFromWindowId(result.tab.windowId, buttonWnd.windowMappercallback);
else {//For tabDependent window non modal pass tabID
if (buttonWnd.data != null)
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, result.tab.id, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, result.tab.id, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
if (!buttonWnd.hidden) {
if (result.tab != null) {
var barItemProxyMRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, result.tab.id);
var message = { action: "ForButtonWindow", HWND: btnWnd.ID };
if (buttonWnd.menuLike)
message.SetForegroundWindow = true;
if (buttonWnd.focused)
message.focused = true;
barItemProxyMRP.PostMessage(BarItemTabIDCallID, JSON.stringify(message));
buttonWindowMap[buttonWindow.id] = buttonWindow;
buttonWnd.callback({ buttonWindow: buttonWindow });
buttonWnd.callback({ failureInfo: ErrorObjectTofailureInfo(e) });
buttonWnd.windowMappercallback = function (result) {
if (result.hWnd === undefined)
var hWnd = parse2Int(result.hWnd);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, hWnd, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, hWnd, buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
if ((tabId === null) || (true === buttonWnd.modal) || ((true !== buttonWnd.menuLike) && (true !== buttonWnd.modlessToTab))) {
iacbar.adapter.tabs.get(tabId, buttonWnd.tabServicecallback);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, parse2Int(tabId), buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable, buttonWnd.data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabButtonWindow(buttonWnd.apiType, buttonWnd.url, parse2Int(tabId), buttonWnd.modal, buttonWnd.menuLike, buttonWnd.screenRect, buttonWnd.sizeIsClientArea, buttonWnd.focused, buttonWnd.hidden, buttonWnd.scrollable);
var barItemProxyMRP = iacbarExt.ICS.Get("EBP_"   extID, "EC_"   extID, tabId);
if (createData.tabIndependentCreateData.title != undefined && typeof createData.tabIndependentCreateData.title == 'string')
title = createData.tabIndependentCreateData.title;
if (createData.tabIndependentCreateData.alwaysOnTop != undefined && typeof createData.tabIndependentCreateData.alwaysOnTop == 'boolean')
alwaysOnTop = createData.tabIndependentCreateData.alwaysOnTop;
if (createData.tabIndependentCreateData.taskBarPresence != undefined && typeof createData.tabIndependentCreateData.taskBarPresence == 'boolean')
taskBarPresence = createData.tabIndependentCreateData.taskBarPresence;
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabIndependentButtonWindow(apiType, url, title, alwaysOnTop, taskBarPresence, screenRect, sizeIsClientArea, focused, hidden, scrollable, data);
var btnWnd = iacbarExt.WebBrowserHostManager.CreateTabIndependentButtonWindow(apiType, url, title, alwaysOnTop, taskBarPresence, screenRect, sizeIsClientArea, focused, hidden, scrollable);
// iacbar.adapter.buttonWindows.remove
iacbarExt.WebBrowserHostManager.RemoveButtonWindow(buttonWindowId);
delete buttonWindow.id;
delete buttonWindow.type;
delete buttonWindow.title;
delete buttonWindow.sizeIsClientArea;
delete buttonWindow.focused;
delete buttonWindow.hidden;
delete buttonWindow.scrollable;
delete buttonWindow.screenRect;
delete buttonWindow.closed;
if (buttonWindow.commEndPoint) {
buttonWindow.commEndPoint.onMessage = null;
buttonWindow.commEndPoint.onRequest = null;
buttonWindow.commEndPoint.postMessage = null;
buttonWindow.commEndPoint.sendRequest = null;
delete buttonWindow.commEndPoint;
var s = { failureInfo: "iacbar.adapter.buttonWindows.remove() failed" };
if (typeof e == 'object' && typeof (e.message) == 'string')
s.failureInfo  = " ('"   e.message   "')";
// iacbar.adapter.buttonWindows.update
var buttonWindow = new ButtonWindowType(iacbarExt.WebBrowserHostManager.GetButtonWindow(buttonWindowId));
var s = { failureInfo: "iacbar.adapter.buttonWindows.update() failed" };
var ticd = updateProperties.tabIndependentCreateData;
throw new Error("updateProperties.tabIndependentCreateData must be an object");
if (ticd.title !== undefined) {
if (typeof ticd.title != 'string')
throw new Error("updateProperties.tabIndependentCreateData.title must be string");
buttonWindow.title = ticd.title;
var r = updateProperties.screenRect;
throw new Error("updateProperties.screenRect must an object");
if (r.left !== undefined) {
if (typeof r.left != 'number')
throw new Error("updateProperties.screenRect.left must a number");
buttonWindow.screenRect.left = r.left;
if (r.top !== undefined) {
if (typeof r.top != 'number')
throw new Error("updateProperties.screenRect.top must a number");
buttonWindow.screenRect.top = r.top;
if (r.height !== undefined) {
if (typeof r.height != 'number')
throw new Error("updateProperties.screenRect.height must a number");
buttonWindow.screenRect.height = r.height;
if (r.width !== undefined) {
if (typeof r.width != 'number')
throw new Error("updateProperties.screenRect.width must a number");
buttonWindow.screenRect.width = r.width;
var b = updateProperties.sizeIsClientArea;
throw new Error("If specified, updateProperties.sizeIsClientArea must a boolean");
buttonWindow.sizeIsClientArea = b;
b = updateProperties.focused;
throw new Error("updateProperties.focused must a boolean");
buttonWindow.focused = b;
b = updateProperties.hidden;
throw new Error("updateProperties.hidden must a boolean");
buttonWindow.hidden = b;
b = updateProperties.scrollable;
throw new Error("updateProperties.scrollable must a boolean");
buttonWindow.scrollable = b;
status = iacbarExt.WebBrowserHostManager.UpdateButtonWindow(buttonWindowId, buttonWindow.title, buttonWindow.screenRect, buttonWindow.sizeIsClientArea, buttonWindow.focused, buttonWindow.hidden, buttonWindow.scrollable);
if (!buttonWindow.hidden) {
if (buttonWindow.focused)
if (typeof status == 'string' && status.length > 0) {
callback({ failureInfo: "iacbar.adapter.buttonWindows.update() partially failed:\n"   status });
// iacbar.adapter.buttonWindows.onUpdated
iacbarExt.WebBrowserHostManager.AddButtonWindowUpdateListener(buttonWindowId, { OnUpdate: function (buttonWindow) {
screenRect: { top: buttonWindow.ScreenRect.Top, left: buttonWindow.ScreenRect.Left, height: buttonWindow.ScreenRect.Height, width: buttonWindow.ScreenRect.Width },
sizeIsClientArea: buttonWindow.SizeIsClientArea,
focused: buttonWindow.Focused,
hidden: buttonWindow.Hidden,
scrollable: buttonWindow.Scrollable,
closed: buttonWindow.Closed
var t = buttonWindow.Title;
changeInfo.title = t;
btnWndJS = buttonWindowMap[buttonWindow.ID];
if (changeInfo.title) {
btnWndJS.title = changeInfo.title;
btnWndJS.sizeIsClientArea = changeInfo.sizeIsClientArea;
btnWndJS.focused = changeInfo.focused;
btnWndJS.hidden = changeInfo.hidden;
btnWndJS.scrollable = changeInfo.scrollable;
btnWndJS.screenRect = { top: changeInfo.screenRect.top, left: changeInfo.screenRect.left, height: changeInfo.screenRect.height, width: changeInfo.screenRect.width };
btnWndJS.closed = changeInfo.closed;
if (iacbarExt.ButtonWindow != undefined && typeof iacbarExt.ButtonWindow === 'object') {
var data = iacbarExt.ButtonWindow.UserData;
iacbar.data = data;
iacbar.adapter.thisButtonWindow = new ButtonWindowType(iacbarExt.ButtonWindow);
window.open = function (open) {
return function (url, name, features, replace) {
orgWnd = open(url, name, features, replace);
this.orgWnd = org;
this.close = function () {
if (this.orgWnd.close)
this.orgWnd.close();
this.orgWnd.window.close();
} (window.open);
var ButtonWindow = window.external.ButtonWindow;
var data = ButtonWindow.UserData;
var mrpWrapper = new MRPJSWrapper(ButtonWindow.MRP);
iacbar.adapter = {
//iacbar.adapter.commEndPoint
buttonWindows : {
riacbar.adapter.buttonWindows.update() method exposed by the Rich API - should be set to 0.
for (var i = 0; i < props.length;   i) {
throw new Error("updateProperties.screenRect."   props[i]   " must a number");
if (typeof params.hidden != undefined && params.hidden != false)
throw new Error("When specified updateProperties.hidden must be set to false");
status = ButtonWindow.Update(r, params.sizeIsClientArea, params.focused, params.hidden);
error = { failureInfo: "iacbar.adapter.buttonWindows.update() partially failed:\n"   status };
error = { failureInfo: "iacbar.adapter.buttonWindows.update() failed" };
error.failureInfo  = " ('"   e.message   "')";
} //iacbar.adapter
var InterWidgetMRP = window.external.InterprocessCommunicationService.Get("EBPToEBP", "EBPToEBP", "ForInterWidgetCommunication");
iacbar.adapter.traceLog.sendLogError(" Error #"   failureInfo.number   " Description "   failureInfo.description);
iacbar.adapter.InterWidget = {
InterWidgetMRP.GetEvent(InterWidgetCommunicationMessageID).AddListener(
OnMessage: function (type, msg, messageexchangeId, mrpIdentifier, handled) {
async(function () { callback({ message: msg }) });
InterWidgetMRP.BroadcastMessage(InterWidgetCommunicationMessageID, message);
78
3$3-3E3v3}3
78u8
=:> ?5?;?
8094989<9
1O4X4Y6
F1X1 2F2V2
;$; ;2;9;
0-0A0M0a0}0
00
:":):2:7:
7074787<7
$0-040;0
3-363@3_3
11&282
4L4
=*>0>4>8><>
7 7$7(7,7074787
;$;*;0;6;];
9094989<9
4 4$4(4,40444
> >@>\>`>
? ?@?`?|?
7$7,747<7`7
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:Semaphore:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:NewBcpEventToken:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:NewBcpEvent:
.Release() failed!!! (
eCould not create the event %s
m_NewBcpEvent.Set() failed (
Error in extension Id - extension Id is over 48 characters long. Count: %d
Error in extension Id - non-hex character encountered, treating as zero: %x
Cookie 0xX removed!
Cookie 0xX not found!
Rpcrt4
RpcAsyncInitializeHandle() returned %d
RpcServerRegisterIfEx() returned %d
CAtlException X
Are we under attack? Nill value passed to RPC server
QueueUserAPC() failed with 0xX
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:SharedMemory:
5FFC5EB6-340B-4A5F-8D2E-363DE2E25B1E:Mutex:
RpcStringFree() returned %d
gRpcBindingFromStringBinding() returned %d
RpcStringBindingCompose() returned %d
nKERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
HRESULT is 0xx
GetIdentifiers failed with error code 0xx
Error in Advise with Bcp. Error code is 0xx
Error in Unadvise with Bcp. Error code is 0xx
Error in CLocalBcp::PostData. Error code is 0xx
t8ExtPEx.dll
t8ExtPEx.dll is missing
EXEManager.dll
\StringFileInfo\XX\OriginalFilename
Mscoree.dll
Advapi32.dll
W.tlb
OLEAUT32.DLL
\\.\pipe\IAC.DebugTraceNamedPipe.6420F383-BCB1-4D5D-BFD9-BB977497E2E1
kernel32.dll
0.0.0.0
SetCurrentExtensionInfo [Invalid Version: %s]
\manifest.json
SetCurrentExtensionInfo wrong manifest version: %s]
Failed to read or parse the manifest [ExtensionDir: %s]
manifest.json
shell32.dll
%ls_%ls_xx%ls_%ls
ntdll.dll
cookie: %d
Failed to convert the stream's marshaling data into an interface pointer [HRESULT: 0xlx, cookie: %d, IStream: %p]
Exception thrown by executing a task on the thread pool
NULL IDispatch passed to DispInvokeHelper()
IAC-WatchedProcessEvent:%d
iacbarcxWebBrowserHost
iacbarcxWebBrowserHostParent
WBH.EnableJSErrorsDisplay.txt
.comm
#%d/#%d
tabs.onUpdated
wtabs.get
t8Html.dll
l#4 /p="%d" /c="%d"
9BFE145C-09C8-4696-AC31-73D9F4D63792:Mutex:
).Integrity(
.Browser(
).Bar
ieframe.dll
rgb(%d,%d,%d)
TraceLog.cfg
^(. ?)\=(. ?)$
).csv
WebBrowserHostManagerService
%Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CrExtP65.exe
CrExtProc.exe
CrExtP65.exe
1.0.7.183

IEXPLORE.EXE_556_rwx_09AC0000_00003000:




-5e6c-4af9-8f57-c6192f42cf74
2,5,14,85
le.log
%Program Files% (x86)\Internet Explorer\IEXPLORE.EXE
ComSpec=C:\Windows\system32\cmd.exe
OS=Windows_NT
Path=%Program Files%\Internet Explorer;;C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;%Program Files% (x86)\Wireshark
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
SystemRoot=C:\Windows
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
k.imgfarm.com/images/nocache/vicinio/installers/207743773.YYA.3/266776-140604143336-YYA.3/FromDocToPDFSetup.exe
#.fromdoctopdf.com






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    TPAutoConnSvc.exe:1652
    65medint.exe:3812
    65medint.exe:3408
    65medint.exe:3432
    65medint.exe:3000
    65medint.exe:2408
    DllHost.exe:3672
    DllHost.exe:3032
    DllHost.exe:3280
    AppIntegrator64.exe:3920
    chrome.exe:3348
    chrome.exe:4052
    chrome.exe:3328
    chrome.exe:2560
    chrome.exe:1960
    chrome.exe:3684
    chrome.exe:1932
    chrome.exe:3132
    chrome.exe:296
    chrome.exe:1448
    FromDocToPDFSetup.exe:3832
    %original file name%.exe:1552
    65brmon64.exe:4000
    00000ef8T8SETUP.EXE:3872
    rundll32.exe:3000
    UPDATER.EXE:1888
    65srchmn.exe:3928
    

    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\spinner.gif (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\css\nl.css (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\swf\UploadButton.swf (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PDFToDOC.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\DocToPDF.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\manifest.json (815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\manifest.json (815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\App.html:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\ArrowConverting.gif (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\Background.html (706 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\sprite.png (33 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\js\Widget.js (3249 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\icon.png (663 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\js\Background.js (2425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\lang-en.js:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\css\App.min.css (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\fonts\cabin.eot (1137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\Background.html:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PDFToDOC.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PDFToDOC.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PageToPDF.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\logo.bmp (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\rateUISprite.png (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\css\PDFConverter.css (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PageToPDF.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006CC82.zip (10160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\pdf_rate.png (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\App.html (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\PageToPDF.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\lang-en.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\fonts\cabin.woff (1137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\DocToPDF.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\Background.html (706 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\logo.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.uf1 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\icon.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\swf\UploadButtonIE6.swf (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\js\Review.js (2425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\7a4bf2afb464bdbef98bc8110582aee93fa811e5\1.2.0\images\DocToPDF.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CC82.zip\manifest.json:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\UrlFolderExtension.ufm (884 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo-unbranded.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\background.html (385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddy_SpeechBubble.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\js\Background.js (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddy_SpeechBubble.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\manifest.json:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\lang-en.js (148 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\background.html:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\lang-en.js (148 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddyLogo.bmp (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\background.html (385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006CFEB.zip\lang-en.js:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006CFEB.zip (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\logo-unbranded.png (894 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\manifest.json (817 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\9df238df22677b09b4c439018fbd136cc469293a\1.1.1\images\TranslationBuddyLogo.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\swf\UploadButtonIE6.swf (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\logo.bmp (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\pdf_rate.png (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\DocToPDF.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PDFToDOC.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\js\Widget.js (3249 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\manifest.json:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\icon.png (663 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\js\Review.js (2425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PDFToDOC.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\lang-en.js:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\fonts\cabin.eot (1137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\Background.html (706 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\App.html (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PDFToDOC.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PageToPDF.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\rateUISprite.png (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\ChromeReview.html (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\Background.html:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\css\nl.css (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\css\PDFConverter.css (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\ChromeReview.html:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PageToPDF.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Temp1_0006C88C.zip\App.html:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\css\App.min.css (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\icon.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65\bar\Cache\0006C88C.zip (10160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\js\Background.js (2425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\Background.html (706 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\ArrowConverting.gif (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\PageToPDF.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\spinner.gif (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\sprite.png (33 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\swf\UploadButton.swf (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\logo.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\manifest.json (854 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\DocToPDF.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\images\DocToPDF.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\fonts\cabin.woff (1137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\FromDocToPDF_65\64c2283e78652d1ba5b13bb49fe3ea4af5553abf\1.2.0\lang-en.js (2 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR64.DLL (356 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL (20 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll (294 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\Hpg64.dll (442 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\searchupdater (1388 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\T8SQL.DLL (90 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\SQLITE3.DLL (489 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\searchupdater (92 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\UPDATER.EXE (512 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_3 (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\18A2.tmp (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\3BFC.tmp (151 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal (18810 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\921B.tmp (127 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6FF8.tmp (742 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Shortcuts (384 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx (7345 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\44B3.tmp (104 bytes)
    C:\Users\"%CurrentUserName%"\Downloads\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\History (8588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\9518.tmp (103 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\README (180 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_fromdoctopdf.dl.tb.ask.com_0.localstorage-journal (5114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\1892.tmp (104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645.crx:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal (5077 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache (330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000006.log (612 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\65ChromePlugIn.dll (45 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\Cookies-journal (12786 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs-journal (4533 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\69E5.tmp (152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon128.png (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000004 (149 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon16.png (622 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log (152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\History-journal (23396 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Current Tabs (1960 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\index (368 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\45CD.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Visited Links (272 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon48.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\etilqs_LNZwDGmAhuv8MSF (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\manifest.json (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\69C5.tmp (152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Current Session (15109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9M3PV1TAC9J4O5LRPVBN.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6984.tmp (120 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dhhjmlmdpcpiojiffodbldlkgcnaeogp_0.localstorage (839 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6B07.tmp (97 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\187E.tmp (104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_1 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_0 (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_2 (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log (228 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6994.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales (4 bytes)
    C:\Users\"%CurrentUserName%"\Downloads\dhhjmlmdpcpiojiffodbldlkgcnaeogp_49645 (1).crx (284074 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal (17330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 (14432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 (5864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 (466240 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 (154904 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\187F.tmp (133 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies (298 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal (3764 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000004.dbtmp (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TQGE4QRB1YR6ZS3KBT6W.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6A19.tmp (126 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\1890.tmp (104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\6AE7.tmp (127 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\BC29.tmp (127 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\1891.tmp (108 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000005.ldb (590 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__MACOSX\_locales (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dhhjmlmdpcpiojiffodbldlkgcnaeogp_0.localstorage-journal (9642 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1G4DF906P1N5ZI172EX.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon19on.png (702 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\69F9.tmp (120 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal (7549 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019 (68 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000018 (68 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0 (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000013 (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\Cache\data_1 (192 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000017 (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000016 (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000015 (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000014 (41 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\69F8.tmp (56 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\Widget.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\html\movieReviews.html (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\focusManager.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\weather\css\weatherButton.css (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-parser.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\jquery-1.7.1.min.js (6984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\underscore-1.3.1.min.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\testWidget.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\extension_toolbar_api.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\common.js (251 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-widget.js (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\foreground\button.js (295 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\exeManager.js (789 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\js\widget.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\mutation_summary-min.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\unifiedLogging.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\list-interaction.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\images\right_arrow_white.png (962 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbarUI.js (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\weather\background\weatherButton.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\buildVars.js (55 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\tvf_icon_guide.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\background\FlareWidget.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\js\topapps-config.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestions.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\07_buttons2.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\underscore-1.3.1.min.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\images\right_arrow.png (963 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\DECODED_MESSAGE_CATALOGS (24 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\globalBlacklistManager.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\supertab.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\scriptInjector.js (819 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868131.png (391 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\eventListening.js (586 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widget-context-1.0.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\list-interaction.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\readLocalStorage.js (339 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbar.js (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\hiddenWidgetWindow.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\radioWrapper\radioWrapper.html (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\srchsugg.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\reservespaceifenabled.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\unifiedLogging.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\js\embedScriptUI.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\underscore-1.3.1.min.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\set.js (558 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\background\ApiBasedWidget.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\toolbarPreinit.js (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_restart_alert_icon.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\qunit.css (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\plugins\65ChromePlugIn.dll (3656 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\config.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\__utm.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\weather\js\weather.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\weather\weatherButton.html (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\magnifying_glass.png (234 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\widgetFactory.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\newTabInfo.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\plugins\SearchControl.dll (59304 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\js\rss-widget.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestions.css (889 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\html\innerEmbedScriptTemplate.html (996 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\contentScript.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\navRedirector.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868103.png (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\abstractbutton\background\abstractButton.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\widgetWindowManager.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\background\RadioWidget.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\rss\background\RssWidget.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\RadioPlayerSprite.png (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\reservespacefortoolbar.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\search_button.png (844 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\tb_icon_search_disappearing_ask.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\html\innerEmbedHtmlTemplate.html (420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\html\embedScriptTemplate.html (532 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\html\supertab.html (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\html\embedHtmlTemplate.html (531 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\exePackageManager.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\resource.xml (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\jquery.js (15336 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\IDR_WEBSTORE_ICON.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\searchContext.js (758 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\mutation_summary.js (3656 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\background\MovieReviewsWidget.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\js\rss-widget-custom.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\css\supertab.css (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\icons\Thumbs.db (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\js\movieReviews.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\css\toolbar-item.css (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\enableDetect.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\common.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\defaultSearchModalInjector.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868101.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\alert\background\alertButton.js (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\menuframe.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\query-string.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\background\updateSearch.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\PartnerId.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-custom.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\DECODED_IMAGES (77 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\tvf_logo.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\contentScript.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\superFrame.js (745 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\css\radio-widget.css (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_btn_ok.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\moviereviews\css\movieReviews.css (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\defaultSearchModal.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868170.png (398 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\invalid.json (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\universalConsole.js (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\radio\radioWrapper\radioWrapper.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\radio-widget.html (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\link\background\linkButton.js (697 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\css\widget.css (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\background\updateSearchPromptBg.js (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\underscore-1.5.2.min.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\08_buttons2.png (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868104.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\eventListening.js (586 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\utils.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\js\rss-widget-parse.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\blacklistService.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_restart_icon.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbar.html (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\icon19disabled.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\radio\js\radio-widget-ui.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868129.png (375 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\js\nanigans-topapps-feed.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\rss\rssWidget.html (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\html\menuframe.html (956 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\resource.json (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\README.txt (227 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\down_arrow.png (959 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\generic\background\GenericWidget.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\testWidget.html (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\set.js (558 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestions.html (811 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\dynamic.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\messaging.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\icons\arrowSprite.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\background\searchBox.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\initWidgetWindow.js (802 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\topapps\widget.html (727 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\widgetWindow.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\background\menuButton.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\IDR_PRODUCT_LOGO_16.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\unifiedLogging.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\hiddenWidgetWindow.html (557 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbarUI.html (876 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\toolbarCookieParser.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\background\embedHtmlWidget.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\options.html (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\wrench.png (398 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\shared\rsvp-latest.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\URILoaderContentScript.js (271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\icons\Icon_Flare_pink.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\toolbarUI.css (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\global.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedscript\background\embedScriptWidget.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\newtabfork.js (841 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868145.png (264 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\updateSearchPromptFg.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\images\221868130.png (364 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\css\menuframe.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\defaultSearchModalInjector.css (522 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\hiddenWidgetWindowInit.js (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\window\widgetWindow.html (788 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\chromeUtils.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\supertab\js\reporting.js (55 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\paramReplacer.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\test\qunit.js (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\adapter\widget-adapter.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\flare\icons\Icon_Flare_blue.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\search\html\searchSuggestionsInit.js (548 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\menu\js\jquery-1.7.1.min.js (6984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\adapter\adapterUtil.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\embedhtml\js\embedHtmlUI.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\widget-api\widgets\common\jquery-1.7.1.min.js (6984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\messageEventListener.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\thirdparty\background\thirdPartyWidget.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\js\underscore-1.3.1.min.js (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\common\components\uninstall\background\uninstallButton.js (717 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\defaultSearch\foreground\tvf_btn_ok2.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\js\options.js (684 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scoped_dir_1960_6943\CRX_INSTALL\components\api\background\widget-api-impl.js (776 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\Y4596ZS3\macromedia.com\support\flashplayer\sys\settings.sxx (3058 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q2J2PH9N\assist_exe[1] (752 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIKAEOYB\assist_exe[1] (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00000ef8T8SETUP.EXE (216121 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00000ef8T8SETUP.EX_ (6 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISb.dll (1617 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dll (15219 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EIPlug.dll (2185 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EZSETP.dl_ (300 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\NP65EISb.dl_ (40 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\1.bin\65EIPlug.dl_ (45 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brstub64.dll (77 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65datact.dll (323 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bar.dll (1744 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65mlbtn.dll (194 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML (491 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 (7936 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\Settings\s_pid.dat (34 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65barsvc.exe (178 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\EXEMANAGER.DLL (973 bytes)
    C:\Windows\System32\config\SOFTWARE.LOG1 (152014 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\ASSISTMONITOR.DLL (610 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65dlghk64.dll (119 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65hkstub.dll (59 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\FF-NativeMessagingDispatcher.dll (250 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CREXT.DLL (50 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll (422 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SrcAs.dll (139 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65dlghk.dll (203 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65SrchMn.exe (112 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (97 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65auxstb64.dll (65 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8HTML.DLL (380 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\APPINTEGRATORSTUB.DLL (503 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skin.dll (406 bytes)
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 (1384 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8EXTEX.DLL (200 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65feedmg.dll (282 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\chrome\65ffxtbr.jar (3361 bytes)
    C:\Windows\System32\config\SECURITY (1120 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\UNIFIEDLOGGING.DLL (635 bytes)
    C:\$Directory (1072 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\install.rdf (2 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65regiet.dll (169 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CHROME.MANIFEST (1 bytes)
    C:\Windows\System32\config\SYSTEM.LOG1 (4395 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brmon.exe (126 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\IE9Mesg\COMMON.T8S (446 bytes)
    C:\Windows\System32\config\SECURITY.LOG1 (1048 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65medint.exe (12 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\APPINTEGRATOR.EXE (421 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\Message\COMMON.T8S (103 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\installKeys.js (216 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65script.dll (202 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65htmlmu.dll (406 bytes)
    C:\System Volume Information\Syscache.hve.LOG1 (10464 bytes)
    C:\Boot\BCD (2080 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE (206 bytes)
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT (1592 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65idle.dll (126 bytes)
    C:\Users\"%CurrentUserName%"\ntuser.dat.LOG1 (3904 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\VERIFY.DLL (135 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\LOGO.BMP (10 bytes)
    C:\Windows\System32\config\COMPONENTS (1461 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65auxstb.dll (112 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65ieovr.dll (73 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65srchmr.dll (83 bytes)
    C:\Windows\System32\config\DEFAULT.LOG1 (7096 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe (28 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\BOOTSTRAP.JS (20 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65regfft.dll (162 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65Plugin.dll (218 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65skplay.exe (55 bytes)
    C:\Windows\System32\config\COMPONENTS.LOG1 (2122 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\bootstrap.js (20 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\gen1\COMMON.T8S (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\65ffxtbr@FromDocToPDF_65.com\chrome.manifest (1 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65reghk.dll (152 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65tpinst.dll (359 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL (15 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\TPIMANAGERCONSOLE.EXE (159 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brstub.dll (128 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\installKeys.js (216 bytes)
    C:\Boot\BCD.LOG (1768 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe (972 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8RES.DLL (396 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8EPMSUP.DLL (158 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8EXTPEX.DLL (210 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65httpct.dll (291 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\CrExtP65.exe (1 bytes)
    C:\Users\"%CurrentUserName%"\NTUSER.DAT (4992 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\INSTALL.RDF (2 bytes)
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 (1168 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\T8TICKER.DLL (340 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\DPNMNGR.DLL (579 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65brmon64.exe (144 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\chrome\65ffxtbr.jar (548 bytes)
    %Program Files% (x86)\FromDocToPDF_65\bar\1.bin\65bprtct.dll (233 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC (1520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\files.ini (2155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_7E268BB06E85E1B6722E01F49268E12F (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1504 bytes)
    %Program Files% (x86)\FromDocToPDF_65EI\Installr\setups\FromDocToPDFSetup.exe (2969170 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_7E268BB06E85E1B6722E01F49268E12F (1520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\000680F1.exe (662259 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\_CACHE_CLEAN_ (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\storage\persistent\moz-safe-about home\idb\818200132aebmoouht.sqlite-journal (11855 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\etilqs_gd6egbKBgyti3of (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\places.sqlite-wal (25037 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_002_ (10248 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\0\62\B2A53d01 (6111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple-1.cache (80 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\webappsstore.sqlite-wal (2668 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json.tmp (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF\manifest.mf (1850 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-phish-shavar.pset (394 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\addons.json.tmp (24 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple.pset (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple.sbstore (464 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\cert8.db (8856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\plugins\NativeMessagingDispatcher.dll (9598 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple.cache (88 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\localstore-1.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\F\95\9139Cd01 (8137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\1\59\C3913d01 (754 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\9\37\B8611d01 (2629 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\cookies.sqlite-wal (135640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\sessionCheckpoints.json.tmp (143 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\thumbnails\b00ebab23e841db1dff7111c7248d790.png.tmp (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-malware-simple-1.sbstore (436 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-phish-shavar.sbstore (13481 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\compatibility.ini (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\pluginreg.dat.tmp (2272 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs-1.js (204 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp-d1v.xpi (77660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-phish-shavar.cache (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\permissions.sqlite-journal (9000 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\etilqs_QbC499h9vA9Vemg (568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple.cache (88 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\8\E1\FD2A8d01 (953 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\install.rdf (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\chrome.manifest (664 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite (47563 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\7\09\7975Dd01 (154241 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-malware-shavar.pset (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple.sbstore (464 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-malware-shavar.sbstore (15174 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite-journal (540 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\goog-malware-shavar.cache (80 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp-xsk.xpi (164759 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_001_ (44368 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\8\6D\F3711d01 (11226 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\chrome\65ffxtbr.jar (3112 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple-1.sbstore (436 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\bootstrap.js (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\trash\65ffxtbr@FromDocToPDF_65.com (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini.tmp (141 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing-to_delete (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_MAP_ (556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.rsa (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\Cache\_CACHE_003_ (9080 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\install_no_bootstrap.rdf (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple.pset (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\sessionstore.js.tmp (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\webapps\webapps.json.tmp (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\healthreport.sqlite-wal (145432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Mozilla\Firefox\Profiles\zwvbr04l.default\safebrowsing\test-phish-simple-1.cache (80 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.sf (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (7904 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences (66 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhjmlmdpcpiojiffodbldlkgcnaeogp\8.27.3.62724_0\plugins\searchupdated (0 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "FromDocToPDF EPM Support" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65medint.exe T8EPMSUP.DLL,S"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "FromDocToPDF Home Page Guard 64 bit" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\AppIntegrator64.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "FromDocToPDF Search Scope Monitor" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65srchmn.exe /m=2 /w /h"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "FromDocToPDF_65 Browser Plugin Loader 64" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65brmon64.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "FromDocToPDF_65 Browser Plugin Loader" = "C:\PROGRA~2\FROMDO~2\bar\1.bin\65brmon.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "dhhjmlmdpcpiojiffodbldlkgcnaeogp Upgrader" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dhh5AAD.tmp\UPDATER.EXE"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now