MD5: 80f39c23c0864b8c36c60bc32d5a63c6
SHA1: 971736554edac908976fcfc5601af976d04c96ee
SHA256: 71e1997a0cf4769f782ba1fc8369d2b6b462ff77badfac513cb16602a7ec7276
SSDeep: 49152:4VL4NybWENEZY9vigH03SubpAb1k7GeATqEuckPbM:uL4N53ZY9LHq39Ab2eOhzM
Size: 2150912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-01-12 23:04:25
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2756
hotrolb.exe:1844
hotro.exe:3160
H_LOADER.EXE:2500
hotromaster.exe:1040

The Trojan injects its code into the following process(es):

HFM.exe:2624

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\H_LOADER.EXE (126 bytes)
%WinDir%\FSWKLY\HFM.01 (81 bytes)
%WinDir%\FSWKLY\HFM.00 (1 bytes)
%WinDir%\FSWKLY\HFM.exe (15801 bytes)
%WinDir%\FSWKLY\HFM.02 (56 bytes)

The process hotrolb.exe:1844 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\httpErrorPagesScripts[1] (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\navcancl[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\info_48[1] (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\background_gradient[1] (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bullet[1] (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\rent[1].txt (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\errorPageStrings[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\ErrorPageTemplate[1] (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (0 bytes)

The process hotro.exe:3160 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\b64[1].js (145 bytes)
%Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (1254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\92a411bc23[1] (21 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ahl6532[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ga[1].js (22035 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\adfly_2[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery[1].js (38959 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\1market[1].htm (768 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\CC61097B94A0A007D678F95504798376 (140 bytes)
%Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (1254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\kjuwM[1].htm (1382 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\view40[1].js (31873 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\96D7A99548C36B10D2E8035A3E0DCA1A (7972 bytes)
%Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (952 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\CC61097B94A0A007D678F95504798376 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\logo_fb2[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\logo[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\cloudflare.min[1].js (24826 bytes)
%Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (92 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\96D7A99548C36B10D2E8035A3E0DCA1A (244 bytes)
%Documents and Settings%\%current user%\Cookies\LFO58N91.txt (83 bytes)
%Documents and Settings%\%current user%\Cookies\XWUC2JM3.txt (273 bytes)
%Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (686 bytes)
%Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\nr-411.min[1].js (4323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\C6D6MG1D\www.downloadmovieshd[1].xml (13 bytes)
%Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (510 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D4F348B882DF3F205ECCB6243795CB3A (200 bytes)
%Documents and Settings%\%current user%\Cookies\11D1YS36.txt (125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\footer[1].txt (579 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\42[1].htm (875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\d_bottom_bg[1].png (167 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (200 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\en_tran[1].png (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\d_top_bg[1].png (156 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D4F348B882DF3F205ECCB6243795CB3A (554 bytes)
%Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (1248 bytes)
%Documents and Settings%\%current user%\Cookies\JA35W949.txt (1248 bytes)
%Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (1102 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\external[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\img[1].js (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bag2[1] (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\style[1].css (1762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery.min[1].js (57770 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\aa75b70072b3d2c372e725db858e1e89[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (0 bytes)

The process H_LOADER.EXE:2500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\hotro.exe (32 bytes)
%System%\hotrolb.exe (32 bytes)
%System%\hotromaster.exe (24 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFA24D.tmp (0 bytes)

The process HFM.exe:2624 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\XFH\HFM.004 (1170 bytes)

Registry activity

The process %original file name%.exe:2756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 A1 3D 40 D7 DC 3B 40 05 27 4B 42 AC 3B 28 91"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\FSWKLY]
"HFM.exe" = "HFM"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"H_LOADER.exe" = "H_LOADER"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process hotrolb.exe:1844 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 26 7E 81 B0 79 68 12 AC 7F 62 3F 34 F3 00 C4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 01 00 00 00 00 00 00 00"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process hotro.exe:3160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 AA F8 DF 70 A9 5C 0F D9 94 D7 06 8D B3 01 F7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1398452974"
"Name" = "hotro.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process H_LOADER.EXE:2500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 3D A3 9E A4 F8 65 5E 34 AD 52 25 07 FC CF D6"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hotro" = "C:\Windows\System32\hotro.exe"

"hotromaster" = "C:\Windows\System32\hotromaster.exe"

The process hotromaster.exe:1040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 AF 09 E8 49 D5 D0 7A 55 A8 D4 FF C9 A6 58 9A"

The process HFM.exe:2624 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 8F BB 6B DA 45 E0 CE 72 69 CF 1D 57 34 D3 50"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HFM Start" = "%WinDir%\FSWKLY\HFM.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e6845.ce.akamaiedge.net/crls/gtglobal.crl
hxxp://www3.l.google.com/GIAG2.crl
hxxp://adf.ly/kjuwM	69.65.39.16
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://cdn.adf.ly/static/css/adfly_2.css	66.55.92.34
hxxp://cdn.adf.ly/static/js/b64.js	66.55.92.34
hxxp://cdn.adf.ly/static/js/view40.js	66.55.92.34
hxxp://cdn.adf.ly/static/image/logo_fb2.png	66.55.92.34
hxxp://cdn.adf.ly/static/image/ahl6532.gif	66.55.92.34
hxxp://www3.l.google.com/ga.js
hxxp://cdn.adf.ly/static/image/d_top_bg.png	66.55.92.34
hxxp://cdn.adf.ly/static/image/skip_ad/en_tran.png	66.55.92.34
hxxp://cdn.adf.ly/static/image/d_bottom_bg.png	66.55.92.34
hxxp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=	69.65.39.16
hxxp://c.global-ssl.fastly.net/nr-411.min.js
hxxp://www.downloadmovieshd.com/vid/42/?did=267	108.162.196.83
hxxp://beacon-3.newrelic.com/1/92a411bc23?a=2344945,2334836&ap=58&fe=4593&dc=4593&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZc0xHFVZcSxYLXERBU15cRiJWXxAXDF9aUEQfTFoyUV4WEQZd&f=["err"]&jsonp=NREUM.setToken	50.31.164.176
hxxp://e6845.ce.akamaiedge.net/gb.crl
hxxp://www.downloadmovieshd.com/vid/xternal/jquery.js	108.162.196.83
hxxp://www.downloadmovieshd.com/vid/42/style.css	108.162.196.83
hxxp://www.downloadmovieshd.com/vid/xternal/external.js	108.162.196.83
hxxp://www.downloadmovieshd.com/vid/xternal/img.js	108.162.196.83
hxxp://www.downloadmovieshd.com/vid/42/img/logo.png	108.162.196.83
hxxp://www.downloadmovieshd.com/vid/xternal/footer.txt	108.162.196.83
hxxp://ajax.cloudflare.com.cdn.cloudflare.net/cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js	198.41.212.126
hxxp://beacon-3.newrelic.com/1/92a411bc23?a=2344945,2334836&ap=22&fe=3328&dc=3328&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZZUtdTghcBRcIVkIbRlhJ&f=["err"]	50.31.164.176
hxxp://lp.sharelive.net/pixel.php?sysid=406&appid=267&subid=	94.31.0.27
hxxp://www.downloadmovieshd.com/cdn-cgi/pe/bag2?r[]=http://www.downloadmovieshd.com/cdn-cgi/nexp/dokv=abba2f56bd/cloudflare/json.js	108.162.196.83
hxxp://adf.ly/callback/aa75b70072b3d2c372e725db858e1e89	69.65.39.16
hxxp://ajax.cloudflare.com/cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js	198.41.212.126
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js	74.125.22.95
hxxp://crl.geotrust.com/crls/secureca.crl	23.9.117.163
hxxp://js-agent.newrelic.com/nr-411.min.js	199.27.76.175
hxxp://www.google-analytics.com/ga.js	173.194.43.41
hxxp://crl.geotrust.com/crls/gtglobal.crl	23.9.117.163
hxxp://gb.symcb.com/gb.crl	23.9.117.163
hxxp://pki.google.com/GIAG2.crl	173.194.43.34
bam.nr-data.net	50.31.164.166

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /nr-411.min.js HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: js-agent.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: PbUwlD/woEsn5A wHJLD5wSZTT ecr/JvfmtHoS VfiTf1WrDhpGpES0hvZCyTz2

x-amz-request-id: B86B72DCB2E45219

Cache-Control: public, max-age=315360000

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Last-Modified: Thu, 01 May 2014 23:15:58 GMT

ETag: "9050946217be03f42647b3f708ef10d3"

Content-Type: application/javascript

Server: AmazonS3

Content-Encoding: gzip

Content-Length: 5773

Accept-Ranges: bytes

Date: Mon, 23 Jun 2014 06:18:52 GMT

Via: 1.1 varnish

Age: 1325392

Connection: keep-alive

X-Served-By: cache-jfk1024-JFK

X-Cache: HIT

X-Cache-Hits: 16639957

X-Timer: S1403504332.030173302,VS0,VE0

Vary: Accept-Encoding
...........[mw.6....B..*....8NB.V.4......fv?Hj.M....TA..G.............
I../.....Y\f.J.......V.=.(...$v..L-L)[email protected]...........|/..e"E....P.
../])T).^...F...U]n..J..{...{ e...&..\..$.z.<*S......}..=a........\
.......u6Z.. M.`hA.^.0..}.p....."".|.{.....=....TU.>.~f....<.G..
F.S.-.j....v|.,......{.6....&.............I.D&$K..G.Z.qz...?..........
.7.....4.w.'Qo....~./....G.v...Mg.b.s..o...6 ......m.*[email protected].
.J&a..0.........'0...a^f..a.1...?.1Z............n....N.......4...P.u..
w...E^....Col...Q1.1..-Px...V...F....<.A1.LU.Q.6.Se.....-..~.n.G..m
.d ..SP.d..g.....&.x0'..4...fr.. .\.........H.B..5..H..2M.....rf~....;
.D#.....)Z....0...2..T......!.T.7...p)..d-..(.U[.,4O.J.#l..0.........S
..a.....R....c...^r...2.....<.}...4B.-T.....>[email protected];.W.x..
..D..S"VoW...lA. ..g...\*O..2Oda.......|..3....J.I.P8)$.H.*.R..,4...{$
.........nE...a.&..=..oy.9.....k.x.....U....$.&A]..lAF%......k....&iX.
.>).d.,..hRVX.9....;...p.)..S.............l.Z.9s.....0RVyG..<..*
...e.....l a.<..=.,..[.....a..>...JT...[./.t5B.K]w..g...(M......
.1D9l.W..{bS...........v..l...X...^.e..J.......'...^Y.,.....{....Z...2
...E.m....].zj......x....2M.......<,.`.a(....T... B.l.^.....xP.....
..f.!4t=.].=...Fd..U.F.9......F~...bb..v...vR.V.0..|x'.0.....R...Z..!I
w.u...([.s....U..r..|..)...t.M.1..aw.}..H..C9Nd....`.vq...H.y.u.E.A.(_
..3E...../H..0v.~.X..^P-Rbh<..^...v...%`c.C0c..].W..7V.h5 .........
vP..e..mhY............5..7..o$....V...Kl.....:-...o*..hCc......A......
-...\......0,...;........3[..q.l....b.......]x.Yp.,.F..?.ES.[....F
<<< skipped >>>

GET /cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: ajax.cloudflare.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:54 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d3c65f5ca903574506465ce0de483f7581403504334321; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.cloudflare.com; HttpOnly

Expires: Tue, 23 Jun 2015 06:18:54 GMT

Cache-Control: public, max-age=31536000

CF-RAY: 13ee922980210785-EWR

Content-Encoding: gzip
d3d.............Yms.6..._!..LT0-.i...h.......&.M..e@..(Q.LR.]K.....&[i
.f..Er.X,.....g_w;.q.._.2...?.xCo...a.;..]g.m..`..3x6:?.......g_ug.D.Q
........(W..h.v.b...(...(..:..L..,.$.....O.v....W.^......,.l...,.\.e..
.w.m9:...LCh..d.z.e:t._J.u..WHn>.t..\HO.2.......72...~..p......-...
h..m...5.o.Bg72.$D...g|A...b.zi.....E....Ta<....r.>...."......"-
.6...Anh.6..'.......n.xs]..._.}....Z...:l2.r.^.iY...N^...a<...f..(.
[email protected]...<v......#..S...L....g.z.....?<..
...G....N..E..n. .....!c0_.E1...{h.@8.$..(..w...'...=..Z....._...y.N..
.k..axu...{.Dg..A....p..t....4CY.B1....)-.8U.H...,.GIm.....!T....3....
..N..km......q.....<..u.vs.okOz..y....UW.X#..1..n....H.`,[email protected]
?g.F......X'.b.b...^..f..\...;`.K..f./......Kq............A..!.X.... .
..5#....\....S..L....Gg....9.x.. ....=..vn..\....i..D..w..H.....P%pD..
Q..1....s^[email protected].;.T.....,..z.E.G........f$I.'
...)_........-...u.......i ..u:..s...J.h.|...C_.u.....q....,.w.....F..
.~.\.LO......N {.F..l.|E.3...5.&..r.W?..B.;.Bf..AK.....T.q&bW5H.?...0.
..FH...J..hVym.......%!s.....9yZ..s..\2.4.[....!_......*g.........%.*.
4........*..k.."...^........G.bQ.....Q..... ....#......c........v8\..Z
.#.].H..GPh.#R..u.rC}K.Y.s.....\2...ZtC......9..l..L..AZ..j/.X...'..&g
t;#..$S.a...>.H....ee...^.P....6..\....b.XXUV.ND:;.......'..\.mQs..
p..;.c7.../.[......FW...V.....=.m..3..h..>s.d[6..g....>.!..Vk...
g|...U6.|..5D....SG.v.y.e........D....K.B...KZP.....w.G.....z4._j$....
.....l..-..N..^......u..*.G.J.1&..B.U.H..f..'.i..2LT.&....cR...hC.
<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.geotrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "f04c0433daabadaa78dc278baacbcdd8:1403502613"

Last-Modified: Mon, 23 Jun 2014 05:50:13 GMT

Accept-Ranges: bytes

Content-Length: 1780

Date: Mon, 23 Jun 2014 06:18:40 GMT

Connection: keep-alive

Content-Type: application/pkix-crl
0...0..Y0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..140623054300Z..140703054300Z0...0..
...&..120627171036Z0........140521155053Z0.....-..140617185011Z0......
..120627171058Z0....``..120627171034Z0.....3..020515130611Z0....j...14
0226123519Z0........120627171039Z0........120627171002Z0........120627
171038Z0....i...120627171035Z0........100301134531Z0........1006231417
52Z0........120627171026Z0.....)..140617185515Z0........120627171025Z0
........120627171050Z0.....#..140606204021Z0....S...120627170949Z0....
H...120627171011Z0........120627171026Z0....._..120627171036Z0........
140618143145Z0....7...140416231149Z0....%...020514181157Z0........1406
05215230Z0........120627171058Z0........140618224415Z0....x...14050720
4001Z0....}...120627170911Z0.....8..120627171035Z0....."..120627171030
Z0....]E..140618144819Z0........140429180917Z0........100729164439Z0..
..x...130924204342Z0....M\..140430000442Z0.....D..120627171051Z0.....N
..100623141726Z0....X...140427081922Z0........120627171036Z0....7...12
0627171052Z0..../(..120627171032Z0....zo..120627171025Z0....v...140618
150003Z0........120627171039Z0........120627171031Z0....*...1206271710
32Z0........100729164732Z0........120627171017Z0........120627171028Z0
........120627171030Z0........120627171031Z0........140618143256Z0....
....120627171028Z0........120627171029Z0....hA..120627171034Z0....~...
120627171035Z0........120627171003Z0.....$..120627171037Z0....x=..1206
27171055Z0........140416233935Z0....t6..140425041720Z0....S...1404
<<< skipped >>>

GET /crls/gtglobal.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.geotrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "3af1227a9006c319b97222bd604d8385:1403503211"

Last-Modified: Mon, 23 Jun 2014 06:00:11 GMT

Accept-Ranges: bytes

Content-Length: 554

Date: Mon, 23 Jun 2014 06:18:40 GMT

Connection: keep-alive

Content-Type: application/pkix-crl
0..&0...0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U.
...GeoTrust Global CA..140623054300Z..140703054300Z0..0....4...0310111
41952Z0....5...060809140549Z0....4]..020522080843Z0....4\..02052208090
0Z0....5Y..050722125926Z0....6k..070711055050Z0....4Z..020521134804Z0.
..*.H................/.7.`.r....w.}#4.....).O.F..=...j....3..05...}.lG
....6..s.%3.9..R......#@@.nw.N..n...SJj... h.F.\........*.dd.w.L..ae..
.)-.K)..p.r..P.J.....`....t...Uf.4.9.....8).....`.h...O.......c.....x.
.39....b]....VVIT[.....x..u.....8........Asm.2...m|8....|.......HTTP/1
.1 200 OK..Server: Apache..ETag: "3af1227a9006c319b97222bd604d8385:140
3503211"..Last-Modified: Mon, 23 Jun 2014 06:00:11 GMT..Accept-Ranges:
 bytes..Content-Length: 554..Date: Mon, 23 Jun 2014 06:18:40 GMT..Conn
ection: keep-alive..Content-Type: application/pkix-crl..0..&0...0...*.
H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Gl
obal CA..140623054300Z..140703054300Z0..0....4...031011141952Z0....5..
.060809140549Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050
722125926Z0....6k..070711055050Z0....4Z..020521134804Z0...*.H.........
......./.7.`.r....w.}#4.....).O.F..=...j....3..05...}.lG....6..s.%3.9.
.R......#@@.nw.N..n...SJj... h.F.\........*.dd.w.L..ae...)-.K)..p.r..P
.J.....`....t...Uf.4.9.....8).....`.h...O.......c.....x..39....b]....V
VIT[.....x..u.....8........Asm.2...m|8....|.........
<<< skipped >>>

GET /GIAG2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: pki.google.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Mon, 23 Jun 2014 02:48:44 GMT

Date: Mon, 23 Jun 2014 06:11:54 GMT

Expires: Mon, 23 Jun 2014 07:11:54 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 871

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 407

Alternate-Protocol: 80:quic
0..c0..K...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U.
...Google Internet Authority G2..140623010004Z..140703010004Z0...0'..@
..q.S....130910151922Z0.0...U.......0'..@ .*..)v..131112093101Z0.0...U
.......0'[email protected]'..h.x../ ...13091311
0309Z0.0...U.......0'..5..[......130927105255Z0.0...U.......0'....).(_
.I..131028093755Z0.0...U.......0'..x.%,......140522102708Z0.0...U.....
..0'....f.'..{..130910150931Z0.0...U.......0'..O..D..."..140407142442Z
0.0...U.......0'....!.jD.E..130612174206Z0.0...U........00.0...U.#..0.
..J......h.v....b..Z./0...U........0...*.H.............lV..^"......\.J
...}..j..<..\7."tP..l......k......1.3..].YCz5..V.g7f\.....f..9... .
..i.......8*..Y....q.&=...2Vt.2....<k?....}fZ.c.o.Q..4..c.......v..
..n..C....`.... .....N..E..X...1J.%..|....):../S...Q..m9b.`.7..Z...K.t
..y.|GQ..4=.{.Q.\.....^9..Rp...M_..|.HTTP/1.1 200 OK..Content-Type: ap
plication/pkix-crl..Last-Modified: Mon, 23 Jun 2014 02:48:44 GMT..Date
: Mon, 23 Jun 2014 06:11:54 GMT..Expires: Mon, 23 Jun 2014 07:11:54 GM
T..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 871.
.X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600.
.Age: 407..Alternate-Protocol: 80:quic..0..c0..K...0...*.H........0I1.
0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G
2..140623010004Z..140703010004Z0...0'[email protected].
......0'..@ .*..)v..131112093101Z0.0...U.......0'[email protected]
120Z0.0...U.......0'..h.x../ ...130913110309Z0.0...U.......0'..5..
<<< skipped >>>

GET /pixel.php?sysid=406&appid=267&subid= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: lp.sharelive.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:55 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Last-Modified: Mon, 23 Jun 2014 06:18:55 GMT

X-Server: web1

Content-Type: text/html

Vary: Accept-Encoding

Content-Encoding: gzip

X-Stat-Server: web1

Content-Length: 21

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
..........3............

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 01:06:01 GMT

Expires: Mon, 23 Jun 2014 13:06:01 GMT

Last-Modified: Thu, 29 May 2014 22:33:33 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15836

Age: 18769

Cache-Control: public, max-age=43200

Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f.....ZhiI..dY.iB.b.KI.o.gF.-'..9....n
byF..h4...../....z..|..y .b../......A_.S.....w......$2=.\..8e..:.G..].
.<.b....M_7.,.I...{..t<./s....x...,...(r4...8W|&N._K...M...p.\9.
..'.I.._.Jz.!.6.....8........P...F.......]H...-..!.M.t...?..6..5O..1..
p0..7.n$y*.z..Z...".W .8XE.....z.a....`.n....t....v.u..6.....A:H...=..
z.....!...5.u [email protected](;. ... W#.M..4
.0.u|.8..{..5...v.T.....5.@)..M..wr.....A>.v..%w..C.B..,Wjj8......j
.r./.Y..RI.6.(........T....Dq......Al...b...:.r.........}1.C...ZYv..y.
r.=d^.....T....L.U(.2 ...`..5......8.tD=..........c.#u.h...-..yu.....r
..?D....j.JQa.T.....f...G.q?r....7_llo>..@....].n;[email protected]_.@...
....#[email protected]...~.UL&...,X.a.Gl...C..c....W........i..2....w.V.{S
...T(w..KF........1.".......V..N.J V.y...K.....4....  .W...Y.......k$.
..r...P..H.J.^.......|... [email protected]..,|\AH`..._..k. x...A...d$.X.~.H
|.3..w>.@M"...s....1..Yi.#..G.........tO....v...1...{k.......np...8
y...Aa....V1.UvB...UJ.q.YC.=.W....1..Yns....s.8.....}..}.0h:......[.Q.
[email protected].}.(..Z.%..q....=Q.$HD....|.[Yq5A..rR.|.r...A....,....^.3
.w...4.:..3.=...>.Z_.A?2X.W..vl...Y.Q].....`VUv......9.R%<.k)..P
OLv..rm..Gc._j.cr/...yBjJ....:7....'....uQ.7.W..0s/K...|..*bY...&...pe
E.50.......&...T)-.-.)......A.."....aK...M.#.Y..... Js......ns.......V
....F;Q....0.P..S.L..l...B..&...nfX3d.....Z....5...6... :.[.{.".!.7*.0
...ylO..N...n ....r.M [email protected]..]W.u..D...m..J.5k..nT...t!.
..._..=..G.Y..^Y..f..]...d.N^....9....m1-0..`K.uB..R.MB.......%.!.
<<< skipped >>>

GET /vid/42/?did=267 HTTP/1.1

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:52 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=ddc3489bb4baff32a5a4989683945a0451403504332170; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: z/LE5Kc7y0Eo17Fs3FiaSQ81qy8m35nsZeJmLCTSjeJAuoI8T5Wp1hAvVwUpADfr

x-amz-request-id: 118FF19D7BB78C88

Last-Modified: Thu, 12 Jun 2014 06:14:16 GMT

CF-RAY: 13ee921c187b0ee5-EWR

Content-Encoding: gzip
17b...............N.0...H..0w.[q..I..H ......h.i....{..o....h9!l..x...
h..b.s^<[email protected]...\.E.......&...^.`..N[.n...f.~W..:.]..W....
..$.q ..)W....Y6..7.....d:...A..kH*A/;..q.:[email protected]
..qd......h......q..).qA....FW.z1..G....K...G......0CYI...Jo.|*....O..
/s.R.L>u|..#.....L.......".i...7N|:6lif.foV.h;g[..{.bg}....Y....P..
.....u.5.......Y{."}.c}6.v...iy.W={.......251...U]o.0.}.R....B.%.Utj.y
..:..&.=..8..Hl.$0T..wm'!.2M..$.......\^\yq).1................"....8..
RzC.....' 4=c..RNuSl....7.z~M.....\...VDE. ..].L....5r0....l..VB......
..a9.-..l........-...iH".t....&...O..D.4.T^..p..A..8....;O..@Z.*et.9 .
5.....S .xnhQ.j..;. .;U"4..8..._.s.T.q...'Q.9...B..'.P...5@.....#&4..%
....\b..4.D. .. ..R.>....Z..{.Fg.`....R....o...K^..?y.).?.bx..C....
j..h.._.E.$2.......cr./..<.qeR|....O ...2~}....iMp_.q...[....D.Ms..
z..o....&6zl..f$UK.a...f.)L..*.P.F.d...5FF.4..#h.7.J. .......mc...qN.7
..9,s8...Q.[..._1.H....A..\6.x..).Qm>F3b3....5...E.....:..4..'R/.$.
.m.y..$...r..........1c3.....n.0.......).d[...u..i..{.NA0..N.$.a;m<
..>*......E..(.....t7.........f;..~.......#|8...tT. .<.'.z; ..k!
g..c.8ci&S.{.*.z,mN.6.V.$...lp.$..(.}.....|0>j...$2.....*...u....Z%
E..6"#U.;.D2.H...S..HM.r...1 %...pu..(.g..7.6S.."N.)8........... e..$.
1...\......{)q7.!..P........kL........."9...8.2...1...[..d......lTT/..
.....]h..:.x..Z.....zr..x......?..L.[..*Tm_....x%A.....N/....[..B..D..
/....k..a...{t...j......\....q.Z5..X..-..nw7..?...rT8.R.]..W.w........
.e9...W...0....{[..wm)......I..m.R...;YETZzJ..l&3.N.j:.Q..&.P.[.p{
<<< skipped >>>

GET /vid/xternal/jquery.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:53 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d8402590b549c39d9e446492eeb41de3d1403504333164; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: 3oQnrHW03yckPafAeHUYqHbo6lUwFeB4TubtFT7b35MC/6BHZNsdQ2j42KqIPKxe

x-amz-request-id: 152D9CBDFA0AA821

Last-Modified: Sat, 15 Mar 2014 17:31:09 GMT

CF-Cache-Status: HIT

Expires: Mon, 23 Jun 2014 10:18:53 GMT

Cache-Control: public, max-age=14400

CF-RAY: 13ee9222493c0ee5-EWR

Content-Encoding: gzip
60e7..............i..6.0....?....i.$..~.4Y.^....q.r.Q.yH....*-.X......
.PT9.....%.................M..o.#.....|.n|.....n.[...R..z.....5.m..Y..
...bq....u.i..#..(F..O.*.....h....t.J..f....z.6....(.....]..t...y....j
.4Z,.m.]..n>.n.t...?......,....J......#..q.x[@..5.....N.........hD.
.....Y.k.N..e.n.M.........g.7.N.5.:..t0#t..6........V.5f..m..=....Oi..
{...~.j%.`3K..7........N]g.fk.....`.F.v..?......Y$..`..7..~.Zb......~.
.H..6n........;w.YN}J...~>..h.J.LP..~.......{..5..q4}s.M...N......*
.k.(...y......v;.........."IOO.7....I_..i..^....."..H....D.F.F.i:..G.L
..:Vd.8.C......d..K....|..=...q..S=...F.....0...O.....)..[.J..  .NP\.A
.lz..aM...Ik..J.{!......l..|....a....o.A...........k.y5]c2~....2...,..
....<..........#..A .A...h..E......e."B...............r%."..O.\,.&l
t;...Z..(_..j_..#`..j.M.6_..,....Nr.G.v...o..b~z.qGaI.......fi,.`.6!.m
..B..^..,..b..d.k...Mo..r '.... n1.......Mq......Fn.Z.-.....oZ...?9;..
.....f.S....`Z.1X...Z...!.#.......2|.h..3.X.s...z........=4..-B.... ..
...K...2.(.nVlV).&]:.....t7..e4.e:..K>V.d...C...v. L.%<Q[.._....
....@h..'..o.a.}.*...y4.A....)..u...&.....-.-%@s.".E&.....A..q.W....q!
.#.r......l...'N7j:-...i....W..P8.......<~..:.V].Vq.'[email protected]...\
....... .A........f/.M.Q.....V..'.....N...L..|l6.......!q..}..j.......
F*.?H..p.....#..<...ko..........L..}.K..,...[izF.F...a.......Z.-0..
.k...4...Wl.g..T2.$.....2.......3^...)...W..'k.yD........j.X..uk0J..W.
b.kw.1......H..PaN.e4$....}........{.0.Eqk...N.8..R....=.hN..!..B.wPq8
.f..$.[......$..i.......N.~......b.".D& ..$.-.:a@\......^3..l...z.
<<< skipped >>>

GET /kjuwM HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: adf.ly

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Vary: Accept-Encoding

Transfer-Encoding: chunked

Date: Mon, 23 Jun 2014 06:18:42 GMT

Server: LiteSpeed

Connection: close

X-Powered-By: PHP/5.5.8

Set-Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; path=/; domain=.adf.ly

Set-Cookie: adf1=668e57544f6910e95c22591759704a2f; expires=Tue, 24-Jun-2014 06:18:42 GMT; Max-Age=86400; path=/; domain=.adf.ly

Set-Cookie: adf2=e8b8e1b450a222f8d1c56b9a088a166b; expires=Tue, 24-Jun-2014 06:18:42 GMT; Max-Age=86400; path=/; domain=.adf.ly

P3P: policyref="hXXp://adf.ly/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa IVAi IVDi CONi HISi TELi OUR IND PHY ONL FIN COM NAV INT DEM GOV"

Cache-Control: max-age=0, no-store, no-cache, must-revalidate

Pragma: no-cache

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Last-Modified: Mon, 23 Jun 2014 06:18:42 GMT

Cache-Control: post-check=0, pre-check=0

Content-Type: text/html
1000.............<kW....3.B(w.t.e...l.K..d&...L......-.%.V.C...~...
.a..[...$sw}r..U]]....?....C>...Q...>.|.i4&..=i...4.........0.t.
... ......;OO..M-M.c{D.q.\...{...smB{i...Q5.\?...........('bn.. .o=.U.
s.....1.5_.<..;.@...?$,..;.|R.....~..p.5.K..krKd.~`L.8H&...........
.3......]...p.M..a...L.}.r...o&...O...&.x.....uu.. ..3.....a....VlN...
.h.}c.^.....0-......q.x...f].=.....(2.[.Y.X./.....z.e.g.wH...5gVb. ...
........ u.C.%}.|.S- .u..3..N7......>.&[[&..".4.\f...\..Q.EA....#..
..K...E<.........z.Ex...K.=.$.A..p....&.qto..S.E: ._..[.b..._.. ...
,..mg.t...zz..S.....4'.7M....(..x6...K.Y>h..T......*.......f..1..H.
.b:..c.d.!?....$?....Q.....a.Z.A. .......p..^.v..@/........|..h%L..|..
.F. .u$...x4"..K.O.......GeG....ge>....r....&.........p...;7.!.....
..m....n.M...{I,..a.p..a.Ta......i*y).4..B.S...'<.........AX2..?.;.
...F`N....F.c-..4....7... ..-..].....`..ns...b.?......)..M..f.m.Y.....
.{q .`.D28.,[email protected]}n*.i..g[.k.....3*f.......1..b....q..}..fs3;pp.zy
.................k....{....Z.m.:-k..c.;...q.-)1..u.u...nIi..o..;/#....
^9..;.?E.GM.X...3:Jni.....:(...K..`...vQ..!.(4f../U..D.N.)g..>....5
..Me.C/H|.......C.~...jL..7.q6.f.I0v.......w..x...K`?.C..5....P...(..Z
.~z...n..M..-.ZR...02H:..|..]a`...... K.p...TK.<.e.......1.Z.;..Y..
[email protected].. .s.y.1K..RTuq.\.\T..4......*.....k.V..,.K.....(
3...8.~.....-.%.O..ATx..u..t.....>...%5.....").t..r..:q.1.......r..
........r...3 .n.......LB&I./.0../..(.x....D.5.. . ..PS....2.=..t.iw..
..&s{[email protected]...@......%xJ
<<< skipped >>>

GET /1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei= HTTP/1.1

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b; __utma=255621336.468587299.1403486636.1403486636.1403486636.1; __utmb=255621336.0.10.1403486636; __utmc=255621336; __utmz=255621336.1403486636.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

HTTP/1.1 200 OK

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Mon, 23 Jun 2014 06:18:52 GMT

Server: LiteSpeed

Connection: close

X-Powered-By: PHP/5.5.8

P3P: policyref="hXXp://adf.ly/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa IVAi IVDi CONi HISi TELi OUR IND PHY ONL FIN COM NAV INT DEM GOV"

Cache-Control: max-age=0, no-store, no-cache, must-revalidate

Pragma: no-cache

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Last-Modified: Mon, 23 Jun 2014 06:18:52 GMT

Cache-Control: post-check=0, pre-check=0

Set-Cookie: adfly_197198=1494770; expires=Tue, 24-Jun-2014 06:18:52 GMT; Max-Age=86400; path=/

Set-Cookie: market_197198=1494770; expires=Mon, 23-Jun-2014 06:19:52 GMT; Max-Age=60; path=/

Content-Type: text/html

Content-Length: 4072
............is...{g.. .T.FK..h....>S....j...Y.Krmr..........A......
F.....WS5.]...WSFsxz.s5g.zS..........B(&T.....^fZ...Wu..$^6..d*...e...
.__.....)Xbg~..........XFo.....z..g...0..4g.W8e.'.......i..O.^...../..
|.i.d.....c.._...W..K.. .)^[email protected]\.R..).. .uQHU...N.....(.
.YPDv.l.en......0.LU.O(n...5).feX.Q<.u.........W..6".]..K..........
....&..Y....a....V.x..F..... .@"n..i1PCBSyz*...u.....!N..&{.@..*...A5.
.b1..J8.AQ.-.k...........h.-.r....v....../Z..*?a.t....$l.U,....!.h#.B.
.4.'e.. U7U'..2...>....`K...h5..._3.h..0$..Eo..VMyI...I5.=).0>.5
X..v...9 K:a.Z.}7.....-..z..h.s\Gg....9.....,*....^..t..`...|........s
.X.M....,..k.w..S*...C...<...*x..0X. .........k...a4f.(.J.K}fH....Z
m#Q(....O$J..Ad...>.[gTe. .W~.h.....OO...B...`....-..5/.D..0..wz...
......_.....b.:=.nG.Y...z|$.=....H.nXs...Yt.P...T... ...^.......e....Y
.. `c"..n/....'.5...u.......@......>XK..O4.I.........e}r._.~..<.
{.a...#1.......O>1....?...t..r^.WN. .....PS...%.d...m.....A.v..(...
[email protected]...>.......y.i.N8..GSZ.].X.`R...0.I.S.M.
...C.....O.cB.P8..W..#...7a....d.Q...!....aRhQ.]...J;`d.q.`..=9``.....
. .rp...l.......x...Ne...........j...9id ..!.9.I.ze.= ....h..I...F..V.
..............d...D.(.....F..diX.Dp.'^J:g.E...wG..l...c......C.1...C.h
..^A$..n........3.NP. (..\LZ..R.........Lx..p.6AG....P...4.....l.B.yKg
.5.....D..... 5.6=.......b.....b`Q:..#..<..BH....P. 8.....n...Q.ii.
[email protected]..<)..{.yK..c..a......:E
[email protected]..!2...p.&T.'..q..J7.B.....>..4.5..{..c.Q.
<<< skipped >>>

GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Fri, 20 Jun 2014 15:21:54 GMT

Expires: Sat, 20 Jun 2015 15:21:54 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33186

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 226613

Alternate-Protocol: 80:quic
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D..
 (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK
?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.
......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_.
..~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U.
.....r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x.
..C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......
o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m
...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F
..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.
y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rY
x..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.
p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.
j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`
..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..&
lt;.F..q5C..vR.iO)Z.(..&T..v.Z#.. [email protected]..
.=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd
.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...&l
t;.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o
{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...
,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=....
.P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....
<<< skipped >>>

POST /callback/aa75b70072b3d2c372e725db858e1e89 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://adf.ly/kjuwM

Accept: */*

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: adf.ly

Content-Length: 562

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b; __utma=255621336.468587299.1403486636.1403486636.1403486636.1; __utmb=255621336.0.10.1403486636; __utmc=255621336; __utmz=255621336.1403486636.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); adfly_197198=1494770; market_197198=1494770

hithere=R5VCQI07LIjjBMDwOEyjAMuuTUkjVLUzNACi4UwMRNSEkIiULVCkJTyuZAWyZOl4cQijIN6uIYiDIMs1IQmDlMkuZAWj5L0zIAjioUwMLNCEJImUbVGkFTzuaACyIO63MICzwNiwcU2jNLywZ4XiNM3gIIjFoTxDMBTCcV2FL5CkJLzgYs3DJMlucQ2zgLi0O5jWgZ4kNlSmwciUdB2yJOyxZ4XSNN3gIQjloT4gMMT3cdsvIRnmdbipcdmFVIz7aACjIL63NADSgRxJLNCVJTtgbs2TJZpsbJGWUai0OFjGAcstI9m21YvoYAmClMsuZQVz9LvhcxyGIb6pIpk35bvNIJiiwOiiYQWnNb0ladWW9YuyIVj2oc51LJCCJL6iIkjDoOilMFCT4Z44OUDDAO1iORDWcNzyNcDTEZ1yNcDzEM3jIJiDwZizaIGmFMz3aACDIM63IImWYN53NEDWEYxiNoWjQI4kNlT2dXhnY9WGVbhiMwTidIj1OcGDEMyxOIDilOjiYIzXUZ22MJjCkL3wYomjQIx4IJny0eO=
HTTP/1.1 200 OK

Content-Encoding: gzip

Vary: Accept-Encoding

Date

GET /vid/42/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:53 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d1a29a4f15a66591a8a099ccda297f92d1403504333192; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: JxqfVsPo1FbAWUi7ir2KLQ0bqpGopH QwXpnlAweMtLq6B93Stx6rChRFb KEypW

x-amz-request-id: 114AB11C34153946

Last-Modified: Thu, 12 Jun 2014 06:14:28 GMT

CF-Cache-Status: HIT

Expires: Mon, 23 Jun 2014 10:18:53 GMT

Cache-Control: public, max-age=14400

CF-RAY: 13ee922270540ee5-EWR

Content-Encoding: gzip
532.............XOs.8.?'3...z2.;....1....zw.....*@`M0..9...w_=I`..$.^.
'1......=)......D."R.;.o.4q......I.........Y.H.0|a&..Uo............'..
.d.A....0B.....F..*H^8..,.....*.3.."c9u...k. ..r....e.t:U.?.....X^.\?.
y.>K'...D2...yN5...........v.)[email protected]`}b.\.d'y.F2..ADsIEi.z...@M
.......|~...<.{.....[X...o%..`e4e!....b.u.pf....O...ob...s.j.!...&l
t;...n..#..Gk....V...F..6.C.Mp..2.vLh.. ...............y.........;)y..
.~mu.^#...L...........vW...x......<cqm...L......hJ....;.]...,F..GJ.
..%...=.l.w....'.$f*.7..Q...kx&~....nx$....L............3#.....pcdk=..
..Uj..*.4.. `S.).....I.:..5.... ...SH.Y`.... fB..rZ...Y..."...;...T.$.
.*.k..=...N&u.N.B.._.=^M.6.%b.V....dW.h.p...=..b..U\Y.Q=.x...-.c].ty.j
k.'M..3.L.L..#....B.)...:....._W./W.._I..c......PY..;...>43.).o.&Q.
...mHJOm.D..T..>.g.....q...Og....g.<.. eM.t.Fw.iR.....=...S..?..
..DB...S.P...R..tF..wb......s..Q..L....)......n~...H....f...O.....D.{X
.B./...I.q.T..$h......m.._..i.....N.....by.......}F.... .Z)...E. D.G..
.z?..P... J..UXs......*.6....j.....D&B...a.e....M.......s#...5.|s.....
....l..8F.x.8.....R..i.........d..\6.e._."n..Z.9.Q-&.Z]........)U..H$w
$C[*..W..}.\SW...Y.\.Y.~.@[email protected].*..V..mQ^....i:2{........P=(d...[..
w..4F0._..I..H....-...zr.?.OG...w..{t...=..v...........f.T6.W...J..j..
I EA2T.C....(Y.r..n...G..}...5.um.yi.8...L......~......3J..f.y..P.N...
..;.....n&.{.[[~..,.."=.....0......
<<< skipped >>>

GET /vid/xternal/external.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:53 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d888951e18dc1409b194d64dcf274ab9e1403504333255; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: Ohnd/yqYKLMap 2YXPUHjdkH5hmtjNuofRx/vb0z6B2FRwX5ldMr9fLlbL4OOEmR

x-amz-request-id: AA4E0C233D529042

Last-Modified: Tue, 17 Jun 2014 11:49:49 GMT

CF-Cache-Status: HIT

Expires: Mon, 23 Jun 2014 10:18:53 GMT

Cache-Control: public, max-age=14400

CF-RAY: 13ee9222d0600ee5-EWR

Content-Encoding: gzip
39a.............VQo.6.~N........T....G.b.{J..Y..AP..Yb,.*I......).v.l.
0.X:~.......?..$UKY(..B.....=..V2.BI.....*....}[email protected]
 ...Gi.LY...W4..8..[VE.eOE....$h^.n..j..>.Uo.[.T..Y.....&..uL.r'.[j
......-jxwt?...iP.Y.2.9.c2.7.5.b.=.....6!.4.9&..Qo...y;...l....m.H....
E)...Z..`;.(..G.......i.......gQ..../\....b.l$..~.".d....,E.S..SyC....
VrA(%g..Bc..7wT..sW.......*.T.o..a..RH.......TuY...A.Ss.u.....i....c..
[email protected]..%V.esn.<..M.$D".......w.J=...#O...........A.U
..\.Z.........vu.j&xW0f.\k....`..r.0W.QtM.-h....#.J.....D..{._"..O....
_c...........{.......whd.Wq}...p.6.c....%j.=.....t.r;/.d<<......
Q...........F..|..;...#J..)6....;=..>UI5w.Z.n....?4...O>.......k
.z)y.."1.N..1n }..W$..0Cw.Pp...L.../..e..JZ.#..e................I.nx..
[email protected](.......P.R......]..Xj..F.|..U...J&.ju.M.E.....y`..k..
r.J..J.o.50..)|.o..\.i.]..L...>o....H..n.%.>[email protected].|....1N..
1..k..........2.#.V.)...'..j....o. ..*.....0......
<<< skipped >>>

GET /vid/42/img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:54 GMT

Content-Type: image/png

Content-Length: 8348

Connection: keep-alive

Set-Cookie: __cfduid=d4d6ab53f9e9ae39cd102d551ef8fe9be1403504334279; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: dTXZuD37f/c8Mvj2ex786FoSQ3Eok/O2UhAu YfQeMV67AtxK6iCS6EA60hObq r

x-amz-request-id: 688FCDD643C3E6ED

Last-Modified: Thu, 12 Jun 2014 06:14:16 GMT

ETag: "0316f69a4d3f81febbe17593082a979b"

CF-Cache-Status: HIT

Expires: Mon, 23 Jun 2014 10:18:54 GMT

Cache-Control: public, max-age=14400

CF-RAY: 13ee9229312f0ee5-EWR
.PNG........IHDR.......8.....^.|... cIDATx...w.......yN.>...00.)CW.
A........M^5....1M.^.....)F...M.....(h,t.0.6....i......30.0......l.s..
.^{..Z{...#H.......|.... ....b....$.$.I.... ..A..WA..X.a!.e..J..J.&...
.........t..V.b5.2.....$.&)....]...;...f*9...I........  ..R<.......
...$........!.`-..6..9.}[email protected](...Z..;..a..-.....31....IR5...6h..y&
[email protected]......$uO..J.....-W.7.F._..
.`.......p..D....3!o$....{.b.......X....B......II.....I%.....e...@....
..`tl.[n.......N..WC.......P......$....nc....~..)Pt.....&\............
...*..&...4_M....O.Z..*Bk...........]..w.V>...P[b8..ub.o%...4_...u.
...>...w............_A..0.>.Z==...!.. e....'.....A.Q.?.d.{ww..}.
...;..<....X..II.U..|..W.`.G..'..[.K.aC..v..Kf.7.a..{..IkYR.|.SF..8
..P.=...4../A.......2.........H....4.%.t#e..A.....S..9..xx.t..o.."-J..
.%..g.b.S..Wh.,...\...J.uZ.....;.jv...K..5' .]....V..I....Q]..........
~..!..em.:0M.3..{.....i...%!..4.74..%'!..V..4Zm......C2..u...]B..c.Q..
......M......j.Bd.....llX.....N/9.(.v...'..T....\.........L.U...[^....
.....@<H....0.<....9!-.8F...74.b.........$!.o....^S\.8........(.
..B..,...>........$...F$-{....M..x....o.7...~....fN....4.2.x;~.....
8...L......C..0...........:vhI..............Y......n.7p..zfqI..S=...hL
.......W....#..Fw...r.g....iE)....N.'.......}.>....;.]d.....%6]..W.
/b1.........X2.B.z([..UH.@.`.....C.a....<. ...xo.T.^.E.C...0....Sb.
_...........T.....G.!.....Q......)....^?Y.O..sa..x.U..^T..6..!9.._...&
....3>.B...O.X....I.f.../A.V.......l...P..T....P..6....C....x.)
<<< skipped >>>

GET /cdn-cgi/pe/bag2?r[]=http://VVV.downloadmovieshd.com/cdn-cgi/nexp/dokv=abba2f56bd/cloudflare/json.js HTTP/1.1

Accept: */*

Accept-Language: en-us

pe-token: b54f430f339eed8ac07f15bcf30d14e033c82fd1-1403504332-1800

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:55 GMT

Content-Type: multipart/mixed; boundary="8LQ45hu4T,)oij"

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d3ca12cb11cf3ce41a00a8402af5093201403504335980; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

CF-RAY: 13ee9233e2670ee5-EWR

Content-Encoding: gzip
5f...............u..K-*....R0.3..r.. I. ...,H.R.-.).,H,*....HM.VH./.KI
,..U...41.(5......R............c....E...........5e....A.. ...{......u.
:.....jj.F...f6.X..q...\[email protected]"......... >...V..FM.._.Q..B.
$Cn........14.....\.XRZl.`d.t:.......22...;.(1.8-.H.5/9?%3/.J!)3..h^..
.......18...k.M..uL..................14....;'&g................1a..B..
...............^.........16...ks-*./.RHK.)N..........443..|V[o.6.~....
 .....o...[.`[email protected].]hK.,...&...{H..6Y.Y..xn<7..t.F:k.b...D?.....
G....u).S..z$.u....Jw&.O{.X.p. J..J.X<!....Q...^..].....D|R...0R.'A
.{$?e.A...SS..}?......_.m3!1G.CP........x.{.;...q.....k.1..?{....y..;"
pU..b7..F*M>.........U.....<\W.s.Z(...I.at.\|.}<.BQ.8Ah....&l
t;.{s..U...W..1.&.*7l.$......k....(Z.z...:f....^..MH...Y..'HF......H..
...(....a .r..U....Z.:..,..a..Z...t..........J..r>...J..Y..sjQ.b.O.
..,YE..............3-..9.r,..9.j..c{..B.a.DA.%.g.)...."..m.......r....
.S.,.Wj....`.B.3.j.|.g....! .V.t.3.C;.3....0.W.l7.>.Z.9p...7hr.r...
6.k .]2..'.......t.5.C.Ho"..()^7...........0....b.pT..".....EY...]...y
...Mv.a..urm^.3..Ew.!..Z.U........V]\7....l...y....O.b...pIi$ '*k.b.sf
.......w.o....AiB.eF;..L.D...T.%F....T.%......T.....VDE. tA...Y....6..
.....T.uy~.h..<.i..E$.P.# ......|.t..V...e.<[email protected]&.i.....J....
)....CP%.. .........G<J....#l...9....Y...S...-..........F..;..5..y.
..JS-...L}......M..nPv..w...s.L.i.f$. .........(.g......T..1....fl..?.
EU..s5=/.....kH..&.... .y...A.n^.{D[.Fi>...ub........ .....STA._...
_p..!........".4S.p.Hz.l..".....(.";..L.&.n...k...A y]............
<<< skipped >>>

GET /vid/xternal/jquery.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:53 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d73eef6d424f489f9b4656b26fa35d68f1403504333191; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: 3oQnrHW03yckPafAeHUYqHbo6lUwFeB4TubtFT7b35MC/6BHZNsdQ2j42KqIPKxe

x-amz-request-id: 152D9CBDFA0AA821

Last-Modified: Sat, 15 Mar 2014 17:31:09 GMT

CF-Cache-Status: HIT

Expires: Mon, 23 Jun 2014 10:18:53 GMT

Cache-Control: public, max-age=14400

CF-RAY: 13ee922279430ee5-EWR

Content-Encoding: gzip
60e7..............i..6.0....?....i.$..~.4Y.^....q.r.Q.yH....*-.X......
.PT9.....%.................M..o.#.....|.n|.....n.[...R..z.....5.m..Y..
...bq....u.i..#..(F..O.*.....h....t.J..f....z.6....(.....]..t...y....j
.4Z,.m.]..n>.n.t...?......,....J......#..q.x[@..5.....N.........hD.
.....Y.k.N..e.n.M.........g.7.N.5.:..t0#t..6........V.5f..m..=....Oi..
{...~.j%.`3K..7........N]g.fk.....`.F.v..?......Y$..`..7..~.Zb......~.
.H..6n........;w.YN}J...~>..h.J.LP..~.......{..5..q4}s.M...N......*
.k.(...y......v;.........."IOO.7....I_..i..^....."..H....D.F.F.i:..G.L
..:Vd.8.C......d..K....|..=...q..S=...F.....0...O.....)..[.J..  .NP\.A
.lz..aM...Ik..J.{!......l..|....a....o.A...........k.y5]c2~....2...,..
....<..........#..A .A...h..E......e."B...............r%."..O.\,.&l
t;...Z..(_..j_..#`..j.M.6_..,....Nr.G.v...o..b~z.qGaI.......fi,.`.6!.m
..B..^..,..b..d.k...Mo..r '.... n1.......Mq......Fn.Z.-.....oZ...?9;..
.....f.S....`Z.1X...Z...!.#.......2|.h..3.X.s...z........=4..-B.... ..
...K...2.(.nVlV).&]:.....t7..e4.e:..K>V.d...C...v. L.%<Q[.._....
....@h..'..o.a.}.*...y4.A....)..u...&.....-.-%@s.".E&.....A..q.W....q!
.#.r......l...'N7j:-...i....W..P8.......<~..:.V].Vq.'[email protected]...\
....... .A........f/.M.Q.....V..'.....N...L..|l6.......!q..}..j.......
F*.?H..p.....#..<...ko..........L..}.K..,...[izF.F...a.......Z.-0..
.k...4...Wl.g..T2.$.....2.......3^...)...W..'k.yD........j.X..uk0J..W.
b.kw.1......H..PaN.e4$....}........{.0.Eqk...N.8..R....=.hN..!..B.wPq8
.f..$.[......$..i.......N.~......b.".D& ..$.-.:a@\......^3..l...z.
<<< skipped >>>

GET /vid/xternal/img.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:54 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=dcb03e76ae95be7028f3f3b9ff54ae5ae1403504334255; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: dZo70BZCYRG17BgVaTVYsLaveIpM3eEOiUbEU9x 5vGl5lsdPcCF1jcU CeauJQ0

x-amz-request-id: 2DD2ED33147B004F

Last-Modified: Sat, 15 Mar 2014 18:04:23 GMT

CF-Cache-Status: HIT

Expires: Mon, 23 Jun 2014 10:18:54 GMT

Cache-Control: public, max-age=14400

CF-RAY: 13ee92291a3b0ee5-EWR

Content-Encoding: gzip
18c............u.An.0.E...;XQ..%%.U]...{.(..&.[c,l...w..B@H...=...5.Zg
N....3.(.,.yz$X.^.. gIJT.q..Z.U&...vFwtEi.Z..ctA.db...k.Fz.s.).I.>N
./hV...Ne..*......8}..j.{y....hh..}W....p#O..C....IS...}....f..ea...6.
.`T.j.$...?K.{...w...-=.....Z.......O.]......Y....7Y..u..t.-s'..sM...p
...V.....-U. Qpr..8.....U...sf.^ .Z. P.....6..*4..lce..D..n..(Y..Z..@.
...Q...{.,sF.e.....t.<.O.?.0gy...h.....a.......dwM......0...
...


GET /vid/xternal/footer.txt HTTP/1.1

Accept: */*

Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.downloadmovieshd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Mon, 23 Jun 2014 06:18:54 GMT

Content-Type: text/plain

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d0d6c78b94020c3ccc1dd54690b1737a51403504334283; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly

x-amz-id-2: 9dKMLe9TVbHJHJA MXlBDSZMlBwYKVi9TNHxsF/42PFFZM7CYvJS91xFMO5pg 7g

x-amz-request-id: BF696D694A6D3BA8

Last-Modified: Sat, 15 Mar 2014 17:31:07 GMT

CF-RAY: 13ee92294a460ee5-EWR

Content-Encoding: gzip
12c..............AN.0.E.bu3 .t.:...... O.N.I..u["q!...h...........8...
..f.V..U.'`./........h.....*..G9_..<@...O..EX...9.H......ro.,..n...
..|...z.p$.. IL$.!..Q..W....DVy".s ..<...O......ybg.v.<y..g.#...
..:.v_t...,.y6..2.Ohs..g.M.}..r"....c8.o.e..e..kx..k....y..V^P.....6.^
o.......$........x]........./.......a........C.....0..

GET /static/css/adfly_2.css HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:43 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "97f-51dd3f45-1ed891dab493e028"

Last-Modified: Wed, 10 Jul 2013 11:02:29 GMT

Content-Type: text/css

Content-Length: 2431

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:43 GMT
html{height:100%}..body..{..    height:100%;..    min-width:980px;..  
  overflow:hidden; ..    font-family: verdana, arial ,helvetica;..    
font-size: 12px;..    margin: 0;..    padding: 0;    ..}..#overly {.. 
   display: block;..    background-color: #317EC5;..    z-index:999;..
    position:absolute;..    top:0;..    left: 0;..    width:100%;..   
 height:100%;    ..}..div#overly p {..    font-family:arial; ..    fon
t-size:12px;..    color: #000000; ..    margin:20px auto; ..    border
:1px solid #000000; ..    width: 200px; ..    padding: 5px; ..    back
ground-color: silver;..}...black_overlay{..    display: none;..    pos
ition: absolute;..    top: 0%;..    left: 0%;..    width: 100%;..    h
eight: 100%;..    background-color: black;..    z-index:10001;..    -m
oz-opacity: 0.8;..    opacity:.30;..    filter: alpha(opacity=30);..}.
..white_content {..    display: none;..    position: absolute;..    to
p: 2%;..    left: 25%;..    width: 50%;..    height: 50%;..    padding
: 16px;..    border: 16px solid orange;..    background-color: white;.
.    z-index:10002;..    overflow: auto;..}...sm_content {..    displa
y: none;..    position: absolute;..    top: 5%;..    left: 50%;..    w
idth: 320px;..    width: 400px\9;..    height: 360px;..    height: 440
px\9;..    padding: 24px;..    border: 4px solid rgb(221, 184, 66);.. 
   background-color: white;..    z-index:10002;..    overflow: auto;..
    margin-left: -185px;..    overflow-x:hidden;..}..#sm_lo {..    pad
ding-left: 0px;..    width: 120%;..    height: 66px;..    backgrou
<<< skipped >>>

GET /static/js/view40.js HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:43 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "112ea-5372285f-283eef96a4a92c18"

Last-Modified: Tue, 13 May 2014 14:12:47 GMT

Content-Type: application/x-javascript

Content-Length: 70378

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:43 GMT
eval((function(p56){for(var Z56="",T56=0,L56=function(p56,C56){for(var
 B56=0,o56=0;o56<C56;o56  ){B56*=96;var x56=p56.charCodeAt(o56);if(
x56>=32&&x56<=127){B56 =x56-32;}}return B56;};T56<p56.length;
){if(p56.charAt(T56)!="`")Z56 =p56.charAt(T56  );else{if(p56.charAt(T5
6 1)!="`"){var d56=L56(p56.charAt(T56 3),1) 5;Z56 =Z56.substr(Z56.leng
th-L56(p56.substr(T56 1,2),2)-d56,d56);T56 =4;}else{Z56 ="`";T56 =2;}}
}return Z56;})("var b7H76=window;for(var F76 in` 6!){if(F76.length===(
(83.0E1,1.52E2)>=(125.,9.)?(94.2E1,6):(93,137)<=(0x24E,108)?7.29
E2:(124.80E1,131.)>=(83.5E1,9.31E2)?\"N\":(44.,0x1EE))&&F76.charCod
eAt(((65,0x24B)<(0x145,0xE7)?(124,1.130E2):8.07E2>(16.3E1,0x31)?
(134,3):0x194<=(93,0x193)?(85.,\'d\'):(7.28E2,0x18C)))===(142.>=
(91.9E1,0xDE)?(0x89,7.270E2):(0x20C,100)<2.15E2?(3.7E2,101):101.<
;(10.72E2,21)?80.:(0x171,70))&&F76.charCodeAt(((51.80E1,98)<=8.09E2
?(1.463E3,5):(88.,64.)<=3E0` 6 9E2,27.8E1):(8.65E2,0x8D)))===((44.,
9.6E2)>=(0xEA,7.770E2)?(57.,110):(43,0x6F))&&F76.charCodeAt(((82,14
0.3E1)>=(0x166,49.6E1)?(0x14,1):(0x1B9,118.)<110?4.0E1:0x176>
=(142.8E1,7.19E2)?60.90E1:(8.5E2,0xE)))===((0x4D,0x1C8)<=108.?(0x15
,\"R\"):(144,60.)>5.2E2?(1.213E3,192):71.<(0x104,0x13E)?(120,99)
:(0x67,0x154))&&F76.charCodeAt((57.40E1>=(140,2.)?(3.0E1,0):(116,36
.4E1)>(0x4,0x189)?142.20E1:(14.,128)>=(9.96E2,146)?(5.47E2,1.429
E3):(7.67E2,52)))===((107` : 6E3)>0x163?(0x95,115):(6.99E2,74)<=
(57,72)?(7.05E2,64):(86.,90)))break};for(var A76 in b7H76){if(A76.
<<< skipped >>>

GET /static/image/ahl6532.gif HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:46 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "c9d-51b1c54e-616cf7bbbb5ed14c"

Last-Modified: Fri, 07 Jun 2013 11:34:38 GMT

Content-Type: image/gif

Content-Length: 3229

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:46 GMT
GIF89a..:....GPL......rp3..$...{...1U2JJ-Qp.;a...........,..1...7h..y4
.....-..qOQ7..3.......5Z.................4....=Q...p..Hg..Eh.*M......[
..'%'..BUr...G............fm>.....F.....E..n......779...M]C..X...[e
=>@Fq.....ijm.6[a}._x...Q........p.3O..8Pl......\.3W.>a.....Z...
...m.... ..6.#.......Fy...U......#.!..>=6) .8l`;.....!;/.B`|J@..,A0
- .6W...7\{..R.0T./S.8^.7].;b.:a.... M.,O..Q.-P.*L.9`.)K...!.......,..
....:.....u..uR...2./...2*.....**..............o..W....W]/............
*./...(..........&.]....../............2....................v.....W...
TG..%~..*\......#J.....C(....Q....(..I..I.......eG..L..I..M~}r..i.b.!.
\...1...H.*].....P.JmZ..P..........`...A.G...L8..`..#...8.b`...^....2.
..WCx.@!...&.*n:...;g.&......9&.......r..}..C..(.{.2...0k........;...|
..e7..w^p.Fh.9.(_..y..U..8r...2g.....I....../..............M..l......l
a.`...$..ZK....v....~.6..y.5..{J(...v.'_qR8.!xE....:...[U<...(.`...
"...4..!z...Ao...F.-.`ao.h8....([email protected]<
i..h....76.....P..NJ....q.....G.......g.....@`..Vh...e....c8....f.)..A
..........yY.|.i...>.F.l,.@...`F.#8Z..."... .A..".j..m.!.g.}@..i.P\
.O......Y...rKh..4.........P..v.R......D...k....[...F{..R.K..?@.......
..3.....p...L.C..me........."1..#P...(.|/.E...e.0,..R(........k$...>
;,A...o.%......jP0.._\6.... ..@ ...38pu..J........Z..).E.q..;..a.i.pb.
-.k..wcpD....x......P....8pY.....F.....a.g...m..E.0...........N..@$.F.
..@[email protected]&.....[f.....D............*...M..D..a.|...$..
.w..z.........;...`........7...s.@o..;).....^..e8..`z....|../.a...
<<< skipped >>>

GET /static/image/d_top_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:46 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "9c-51d450e3-8ab0ff4e53d010b5"

Last-Modified: Wed, 03 Jul 2013 16:27:15 GMT

Content-Type: image/png

Content-Length: 156

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......;.....5.w.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...>IDATx.b..Ifb.........4..a......j...!.E.......z.......O...u..
...k/.........IEND.B`.....


GET /static/image/d_bottom_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:47 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "a7-51d450e3-500e6ae194574ff5"

Last-Modified: Wed, 03 Jul 2013 16:27:15 GMT

Content-Type: image/png

Content-Length: 167

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:47 GMT
.PNG........IHDR..............i.N....tEXtSoftware.Adobe ImageReadyq.e&
lt;...IIDATx.bx....................3<|.......w^.f...?....L...1.....
.,[email protected]`...

GET /1/92a411bc23?a=2344945,2334836&ap=58&fe=4593&dc=4593&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZc0xHFVZcSxYLXERBU15cRiJWXxAXDF9aUEQfTFoyUV4WEQZd&f=["err"]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: beacon-3.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=10a67ac5efe2a91c;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 21
NREUM.setToken(null).....


GET /1/92a411bc23?a=2344945,2334836&ap=22&fe=3328&dc=3328&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZZUtdTghcBRcIVkIbRlhJ&f=["err"] HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: beacon-3.newrelic.com

Connection: Keep-Alive

HTTP/1.1 204 No Content

Content-Type: image/gif

Set-Cookie: JSESSIONID=9ec585c9314f1e46;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET /static/js/b64.js HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:43 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "dc0-533ef451-73228b2e988dd6e8"

Last-Modified: Fri, 04 Apr 2014 18:05:05 GMT

Content-Type: application/x-javascript

Content-Length: 3520

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:43 GMT
function base64_encode(data) {.    //  discuss at: hXXp://phpjs.org/fu
nctions/base64_encode/.    // original by: Tyler Akins (hXXp://rumkin.
com).    // improved by: Bayron Guevara.    // improved by: Thunder.m.
    // improved by: Kevin van Zonneveld (hXXp://kevin.vanzonneveld.net
).    // improved by: Kevin van Zonneveld (hXXp://kevin.vanzonneveld.n
et).    // improved by: Rafa.. Kukawski (hXXp://kukawski.pl).    // bu
gfixed by: Pellentesque Malesuada.    //   example 1: base64_encode('K
evin van Zonneveld');.    //   returns 1: 'S2V2aW4gdmFuIFpvbm5ldmVsZA=
='.    //   example 2: base64_encode('a');.    //   returns 2: 'YQ=='.
    //   example 3: base64_encode('... .. la mode');.    //   returns 
3: '4pyTIMOgIGxhIG1vZGU='..    var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZab
cdefghijklmnopqrstuvwxyz0123456789 /=';.    var o1, o2, o3, h1, h2, h3
, h4, bits, i = 0,.        ac = 0,.        enc = '',.        tmp_arr =
 [];..    if (!data) {.        return data;.    }..    data = unescape
(encodeURIComponent(data))..    do {.        // pack three octets into
 four hexets.        o1 = data.charCodeAt(i  );.        o2 = data.char
CodeAt(i  );.        o3 = data.charCodeAt(i  );..        bits = o1 <
;< 16 | o2 << 8 | o3;..        h1 = bits >> 18 & 0x3f;.
        h2 = bits >> 12 & 0x3f;.        h3 = bits >> 6 & 0
x3f;.        h4 = bits & 0x3f;..        // use hexets to index into b6
4, and append result to encoded string.        tmp_arr[ac  ] = b64.cha
rAt(h1)   b64.charAt(h2)   b64.charAt(h3)   b64.charAt(h4);.    } 
<<< skipped >>>

GET /static/image/logo_fb2.png HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:46 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "188b-5116a59d-2f8f7edb8dce95ec"

Last-Modified: Sat, 09 Feb 2013 19:38:05 GMT

Content-Type: image/png

Content-Length: 6283

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......b.......G.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE.V.s.o*p.-**.........*r.....R.l....,........;,v.-x..h."\...
...Rw..'Ns.....C%d.GIO...aT2..0}.....T..#r..c...(...$`..Y.(j.Jy.......
...b....h..6..th..#^......."s.#j.!l.......E|.-z.'n.:v.%b. t...%.y?..3.
.....m..&f.,w.8{.].......K......'h.K..R..F.......I...(l.........C$b...
...p Z.............(k.6:B*i....$_.4j.........X......t.."\... -z.Rv~.[.
z..#u......9..@.........'f.-y.... n.rto&i....#^...;)o.%`....uf;..W s..
.7.n.'t...X T.^....A...;r.-f...:...%p.'i...9...Q...g.-x....,c.:j.!..*w
...1^.......B e.&e...^# !'v.>....T!`..V.B:,&g....$a..b.!a...!......
l....Y.....T.....M#\.w...n."c....&w...1"d....._.%f..O.#)44p.,p.1b..X.)
m....#]..].)x.VWZ.x.'r. o..y. q.#h.'_..[.!X."Z."[."Z."Z.!Y.)n.#^.'h.-{
...y#_....D.....e_T(\./j.`..&b....%\.a.y.."......$[.,|.-|.!Z. y..z.0t.
 s.3z........v.d...!IDATx....\T...7.8.... B....QS..AA..d.x......0..a..
<>....&......D.@M3Q,<.I...z.q...[..oz....^k?...s.....0{.~....
.....\s7vK.Z[[o.v.[..h. .?......~..xk...e.Hh.{...w.]A...f....:..]~ .]]
6...#.!.s...m.....g. .j.j.,. .......of.K.S..I~.[..D.....g........e.%..
$.....$ 2.....?..~o.wK"[email protected]..;..
....!..y.S.....=....?.......tW.m,K.O".H(......m..c....qj...*....&.d..*
,....!Rp..Ax.r.>|........B..QC.KT'U)J.6i..u.D.`.1.0....F..~........
..t..........cH......H ..:.* .w....FGG/z...|......$k.Km5.Y5..!.....:..
....U..zc.........K.l...1...R.VT..h,M.....(x.N..[...9!.@/.]...h..<|
U....xE..6.".H.b...B..... ..g.......=.^C`.....S....X.R.......F_..H
<<< skipped >>>

GET /static/image/skip_ad/en_tran.png HTTP/1.1

Accept: */*

Referer: hXXp://adf.ly/kjuwM

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: cdn.adf.ly

Connection: Keep-Alive

Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b

HTTP/1.1 200 OK

Date: Mon, 23 Jun 2014 06:18:46 GMT

Server: LiteSpeed

Accept-Ranges: bytes

Connection: Keep-Alive

Keep-Alive: timeout=5, max=100

ETag: "13d4-51e829a4-3949693a3ed59e6e"

Last-Modified: Thu, 18 Jul 2013 17:45:08 GMT

Content-Type: image/png

Content-Length: 5076

Cache-Control: public, max-age=604800

Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......)....."c[.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /gb.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: gb.symcb.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "21f5457deceff1b72981318a556e49f6:1403471739"

Last-Modified: Sun, 22 Jun 2014 21:15:39 GMT

Accept-Ranges: bytes

Content-Length: 50182

Date: Mon, 23 Jun 2014 06:18:52 GMT

Connection: keep-alive

Content-Type: application/pkix-crl
0...0......0...*.H........0D1.0...U....US1.0...U....GeoTrust Inc.1.0..
.U....GeoTrust SSL CA - G2..140622210100Z..140702210100Z0..>0!....)
.i}[email protected]!...H.y...)h....<....140213114347Z0!..
.M."..Z.......q...140502102942Z0!...V...&}5.2..."....140422235329Z0!..
.mc6.2..~..TU..}..140312185839Z0!...r.R.. .'......u..130703123510Z0!..
...]...j2..b..B...140520095600Z0!....0.,=..4..k......140203223109Z0!..
..P...~.I....X ...140225061225Z0!...........R:.h.#...140616105236Z0!..
......4..V..-l....140505080224Z0!.....D2..;oe.#o.....130807074235Z0!..
.....P.]56........140422152703Z0!........b.....R.....140115154059Z0!..
.Y]7_t7..W./......130718095956Z0!...j:..YY.....J3....140418175733Z0!..
...~....z...h]."..140220162440Z0!....".X......=sA....140423203230Z0!..
..Yy..]..n;.B6)(..140424141615Z0!.....L..P.8......J..140421145404Z0!..
.5.a..W*>.........140113154837Z0!....s....kd.....=...140212144128Z0
!....i#[email protected]!....?.'..=?x.=9.$...140622064002Z0
!......:5..=.|[email protected]!...0.Hg./..J........140116173320Z0
!...O...!.L|.P..6....140527182251Z0!...RB./aH.R2x..!.C..140109024350Z0
!...o(.!e..y.)8......140108231615Z0!...o..}A;h.\u.......140219232221Z0
!...yi..Bk....gZ.Y...140106053314Z0!...}b..y...[.U.t....140519222137Z0
!......h...m%....y...140109165914Z0!.....%.N..A"...Uc...140318050429Z0
!......2..7......'%..130529144825Z0!...>........`E_.....14052718225
1Z0!...QV,z.F_..c..UK...140515172826Z0!...a4.Z....%.WGG....14041713131
2Z0!...n]{.......%:.Qy..140204195753Z0!........K....U...z..1404260
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

udPh

PSSSSSSh

PSSSSSSh!

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

.EKSWU

FTPG

FTPj

FtPS

H%x\U

H%x]U

=KNILw.tT=RCNEw

_0 _8 _4;_,

SHA1 block transform for x86, CRYPTOGAMS by 

SHA256 block transform for x86, CRYPTOGAMS by 

DlSHA512 block transform for x86, CRYPTOGAMS by 

Montgomery Multiplication for x86, CRYPTOGAMS by 

6-9'6-9'

$6.:$6.:

*?#1*?#1

>8$4,8$4,

AES for x86, CRYPTOGAMS by 

Camellia for x86 by 

RC4 for x86, CRYPTOGAMS by 

FRegDeleteKeyExW

MARGIN-BOTTOM: 11px; BORDER-STYLE: solid; BORDER-COLOR: #DFDFE5; BORDER-WIDTH: 2px; BACKGROUND-COLOR: #DFDFE5; }H2 { COLOR: black; BACKGROUND-COLOR: #FFFFF; FONT-SIZE: 12pt; FONT-WEIGHT: normal; MARGIN-BOTTOM: 0px; MARGIN-TOP: 10px;}

[email protected]

Date: %d %s %d %d:%d:%d

EHLO %s

,qop=%s

,response=%s

,digest-uri="%s"

,cnonce="%s"

,nc=%s

,nonce="%s"

,realm="%s"

charset=utf-8,username="%s"

smtp/

AUTH PLAIN %s

^%s^%s

AUTH LOGIN

LOGIN

--%s--

RCPT TO:<%s>

MAIL FROM:<%s>

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

portuguese-brazilian

ADVAPI32.DLL

kernel32.dll

UxTheme.dll

OLEACC.dll

passed a null parameter

DSO support routines

x509 certificate routines

error:lX:%s:%s:%s

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

lhash part of OpenSSL 1.0.0d 8 Feb 2011

Stack part of OpenSSL 1.0.0d 8 Feb 2011

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

Big Number part of OpenSSL 1.0.0d 8 Feb 2011

ASN.1 part of OpenSSL 1.0.0d 8 Feb 2011

keylen <= sizeof key

EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

keylength

keyfunc

EVP part of OpenSSL 1.0.0d 8 Feb 2011

.\crypto\pkcs12\p12_key.c

SHA1 part of OpenSSL 1.0.0d 8 Feb 2011

SHA-256 part of OpenSSL 1.0.0d 8 Feb 2011

SHA-512 part of OpenSSL 1.0.0d 8 Feb 2011

RSA part of OpenSSL 1.0.0d 8 Feb 2011

RAND part of OpenSSL 1.0.0d 8 Feb 2011

You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

cert_info

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

NETAPI32.DLL

KERNEL32.DLL

value.single

value.set

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

%d.%d.%d.%d/%d.%d.%d.%d

%*s%s:

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

AUTHORITY_KEYID

keyid

X509_CERT_PAIR

X509_CERT_AUX

%d.%d.%d.%d

EC part of OpenSSL 1.0.0d 8 Feb 2011

ECDSA part of OpenSSL 1.0.0d 8 Feb 2011

.\crypto\ec\ec_key.c

DSA part of OpenSSL 1.0.0d 8 Feb 2011

Diffie-Hellman part of OpenSSL 1.0.0d 8 Feb 2011

.\crypto\dh\dh_key.c

\X

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:

X400Name:

othername:

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

ddddddZ

ddddddZ

pubkey

priv_key

pub_key

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

.\crypto\evp\evp_pkey.c

ECDH part of OpenSSL 1.0.0d 8 Feb 2011

%'%1%=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

X.509 part of OpenSSL 1.0.0d 8 Feb 2011

OPENSSL_ALLOW_PROXY_CERTS

x%s

%s - d:d:d%.*s %d%s

'() ,-./:=?

CONF part of OpenSSL 1.0.0d 8 Feb 2011

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

.\crypto\x509v3\v3_akey.c

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

MD5 part of OpenSSL 1.0.0d 8 Feb 2011

PROXY_CERT_INFO_EXTENSION

D:/Projects/openssl-10.0d/ssl/certs

D:/Projects/openssl-10.0d/ssl/cert.pem

SSL_CERT_DIR

SSL_CERT_FILE

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

%lu:%s:%s:%d:%s

CONF_def part of OpenSSL 1.0.0d 8 Feb 2011

[[%s]]

[%s] %s=%s

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

certs

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

%s.dll

PEM part of OpenSSL 1.0.0d 8 Feb 2011

phrase is too short, needs to be at least %d chars

Enter PEM pass phrase:

TRUSTED CERTIFICATE

CERTIFICATE REQUEST

NEW CERTIFICATE REQUEST

CERTIFICATE

X509 CERTIFICATE

PRIVATE KEY

ENCRYPTED PRIVATE KEY

ANY PRIVATE KEY

.\crypto\evp\evp_key.c

nkey <= EVP_MAX_KEY_LENGTH

?456789:;<=

!"#$%&'()* ,-./0123

Verifying - %s

OpenSSL 1.0.0d 8 Feb 2011

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

EXPORT56

EXPORT40

EXPORT

.\ssl\ssl_cert.c

SSLv3 part of OpenSSL 1.0.0d 8 Feb 2011

TLSv1 part of OpenSSL 1.0.0d 8 Feb 2011

SSLv2 part of OpenSSL 1.0.0d 8 Feb 2011

s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)

wrong number of key bits

unsupported status type

unsupported ssl version

unsupported protocol

unsupported elliptic curve

unsupported digest type

unsupported compression algorithm

unsupported cipher

unknown pkey type

unknown key exchange type

unknown certificate type

unable to find public key parameters

unable to extract public key

unable to decode ecdh certs

unable to decode dh certs

tried to use unsupported cipher

tls peer did not respond with certificate list

tls client cert req with anon cipher

tlsv1 unsupported extension

tlsv1 certificate unobtainable

tlsv1 bad certificate status response

tlsv1 bad certificate hash value

tlsv1 alert export restriction

sslv3 alert unsupported certificate

sslv3 alert no certificate

sslv3 alert certificate unknown

sslv3 alert certificate revoked

sslv3 alert certificate expired

sslv3 alert bad certificate

signature for non signing certificate

reuse cert type not zero

reuse cert length not zero

public key not rsa

public key is not rsa

public key encrypt error

peer error unsupported certificate type

peer error no certificate

peer error certificate

peer did not return a certificate

null ssl method passed

no publickey

no private key assigned

no privatekey

Peer haven't sent GOST certificate, required for selected ciphersuite

no client cert received

no client cert method

no ciphers passed

no certificate specified

no certificate set

no certificate returned

no certificate assigned

no certificates returned

missing tmp rsa pkey

missing tmp rsa key

missing tmp ecdh key

missing tmp dh key

missing rsa signing cert

missing rsa encrypting cert

missing rsa certificate

missing export tmp rsa key

missing export tmp dh key

missing dsa signing cert

missing dh rsa cert

missing dh key

missing dh dsa cert

krb5 server rd_req (keytab perms?)

key arg too long

invalid ticket keys length

http request

https proxy request

error generating tmp rsa key

ecc cert should have sha1 signature

ecc cert should have rsa signature

ecc cert not for signing

ecc cert not for key agreement

cert length mismatch

certificate verify failed

bad ecc cert

bad dh pub key length

TLS1_SETUP_KEY_BLOCK

tls1_cert_verify_mac

SSL_VERIFY_CERT_CHAIN

SSL_use_RSAPrivateKey_file

SSL_use_RSAPrivateKey_ASN1

SSL_use_RSAPrivateKey

SSL_use_PrivateKey_file

SSL_use_PrivateKey_ASN1

SSL_use_PrivateKey

SSL_use_certificate_file

SSL_use_certificate_ASN1

SSL_use_certificate

SSL_SET_PKEY

SSL_SET_CERT

SSL_SESS_CERT_NEW

SSL_GET_SIGN_PKEY

SSL_GET_SERVER_SEND_CERT

SSL_CTX_use_RSAPrivateKey_file

SSL_CTX_use_RSAPrivateKey_ASN1

SSL_CTX_use_RSAPrivateKey

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_ASN1

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_ASN1

SSL_CTX_use_certificate

SSL_CTX_set_client_cert_engine

SSL_CTX_check_private_key

SSL_CHECK_SRVR_ECC_CERT_AND_ALG

SSL_check_private_key

SSL_CERT_NEW

SSL_CERT_INSTANTIATE

SSL_CERT_INST

SSL_CERT_DUP

SSL_add_file_cert_subjects_to_stack

SSL_add_dir_cert_subjects_to_stack

SSL3_SETUP_KEY_BLOCK

SSL3_SEND_SERVER_KEY_EXCHANGE

SSL3_SEND_SERVER_CERTIFICATE

SSL3_SEND_CLIENT_KEY_EXCHANGE

SSL3_SEND_CLIENT_CERTIFICATE

SSL3_SEND_CERTIFICATE_REQUEST

SSL3_OUTPUT_CERT_CHAIN

SSL3_GET_SERVER_CERTIFICATE

SSL3_GET_KEY_EXCHANGE

SSL3_GET_CLIENT_KEY_EXCHANGE

SSL3_GET_CLIENT_CERTIFICATE

SSL3_GET_CERT_VERIFY

SSL3_GET_CERT_STATUS

SSL3_GET_CERTIFICATE_REQUEST

SSL3_GENERATE_KEY_BLOCK

SSL3_CHECK_CERT_AND_ALGORITHM

SSL3_ADD_CERT_TO_BUF

SSL2_SET_CERTIFICATE

SSL2_GENERATE_KEY_MATERIAL

REQUEST_CERTIFICATE

GET_CLIENT_MASTER_KEY

DTLS1_SEND_SERVER_KEY_EXCHANGE

DTLS1_SEND_SERVER_CERTIFICATE

DTLS1_SEND_CLIENT_KEY_EXCHANGE

DTLS1_SEND_CLIENT_CERTIFICATE

DTLS1_SEND_CERTIFICATE_REQUEST

DTLS1_OUTPUT_CERT_CHAIN

DTLS1_ADD_CERT_TO_BUF

CLIENT_MASTER_KEY

CLIENT_CERTIFICATE

key expansion

client write key

server write key

c->iv_len <= (int)sizeof(s->session->key_arg)

s->s2->key_material_length <= sizeof s->s2->key_material

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

Invalid component ID %d in SOS

Bogus message code %d

;Warning: highpass filter disabled. highpass frequency too small

http://lame.sf.net

3.99.5

Opera

?INTERNAL ERROR IN VBR NEW CODE, please send bug report

@INTERNAL ERROR IN VBR NEW CODE (986), please send bug report

INTERNAL ERROR IN VBR NEW CODE (1313), please send bug report

maxbits=%d usedbits=%d

hip: invalid layer %d

hip: error audio data exceeds framesize by %d bytes

hip: bitstream problem, resyncing skipping %d bytes...

Sorry, layer %d not supported

hip: Can't rewind stream by %d bits!

hip: Bogus region length (%d)

ADVAPI32.dll

F%D,3

QVisual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

%S#[k

?#%X.y

.\crypto\engine\eng_pkey.c

RSA PRIVATE KEY

DSA PRIVATE KEY

EC PRIVATE KEY

Load certs from files in a directory

%s%clx.%s%d

unsupported type

unsupported recpientinfo type

unsupported recipient type

unsupported kek algorithm

unsupported content type

signer certificate not found

private key does not match certificate

no public key

no private key

no msgsigdigest

no key or cert

no key

not supported for this key type

not key transport

msgsigdigest wrong length

msgsigdigest verification failure

msgsigdigest error

invalid key length

invalid encrypted key length

error setting key

error getting public key

certificate verify error

certificate has no keyid

certificate already present

CMS_SIGNERINFO_VERIFY_CERT

CMS_RecipientInfo_set0_pkey

CMS_RecipientInfo_set0_key

CMS_RecipientInfo_ktri_cert_cmp

cms_msgSigDigest_add1

CMS_GET0_CERTIFICATE_CHOICES

CMS_EncryptedData_set1_key

CMS_decrypt_set1_pkey

CMS_decrypt_set1_key

CMS_add1_recipient_cert

CMS_add0_recipient_key

CMS_add0_cert

unsupported requestorname type

no certificates in chain

error parsing url

PARSE_HTTP_LINE1

OCSP_parse_url

OCSP_cert_id_new

unimplemented public key method

invalid cmd number

invalid cmd name

failed loading public key

failed loading private key

cmd not executable

ENGINE_UNLOAD_KEY

ENGINE_load_ssl_client_cert

ENGINE_load_public_key

ENGINE_load_private_key

ENGINE_get_pkey_meth

ENGINE_get_pkey_asn1_meth

ENGINE_ctrl_cmd_string

ENGINE_ctrl_cmd

ENGINE_cmd_is_executable

unsupported version

unsupported md algorithm

invalid signer certificate purpose

ess signing certificate error

ess add signing cert error

TS_VERIFY_CERT

TS_TST_INFO_set_msg_imprint

TS_RESP_CTX_set_signer_cert

TS_RESP_CTX_set_certs

TS_REQ_set_msg_imprint

TS_MSG_IMPRINT_set_algo

TS_CHECK_SIGNING_CERTS

ESS_SIGNING_CERT_NEW_INIT

ESS_CERT_ID_NEW_INIT

ESS_ADD_SIGNING_CERT

functionality not supported

WIN32_JOINER

unsupported pkcs12 mode

key gen error

PKCS8_add_keyusage

PKCS12_PBE_keyivgen

PKCS12_newpass

PKCS12_MAKE_SHKEYBAG

PKCS12_MAKE_KEYBAG

PKCS12_key_gen_uni

PKCS12_key_gen_asc

PKCS12_add_localkeyid

unsupported option

unable to get issuer keyid

policy syntax not currently supported

operation not defined

no proxy cert policy language defined

no issuer certificate

extension setting not supported

V2I_EXTENDED_KEY_USAGE

V2I_AUTHORITY_KEYID

S2I_SKEY_ID

S2I_ASN1_SKEY_ID

R2I_CERTPOL

unsupported cipher type

unknown operation

unable to find certificate

signing not supported for this key type

operation not supported on this type

no recipient matches key

no recipient matches certificate

encryption not supported for this key type

decrypted key is wrong length

PKCS7_add_certificate

unsupported method

no port specified

no port defined

no accept port specified

broken pipe

BIO_get_port

ECDH_compute_key

data too large for key size

unsupported field

passed null parameter

not a supported NIST prime

missing private key

keys not set

invalid private key

PKEY_EC_SIGN

PKEY_EC_PARAMGEN

PKEY_EC_KEYGEN

PKEY_EC_DERIVE

PKEY_EC_CTRL_STR

PKEY_EC_CTRL

o2i_ECPublicKey

i2o_ECPublicKey

i2d_ECPrivateKey

EC_KEY_print_fp

EC_KEY_print

EC_KEY_new

EC_KEY_generate_key

EC_KEY_copy

EC_KEY_check_key

ECKEY_TYPE2PARAM

ECKEY_PUB_ENCODE

ECKEY_PUB_DECODE

ECKEY_PRIV_ENCODE

ECKEY_PRIV_DECODE

ECKEY_PARAM_DECODE

ECKEY_PARAM2TYPE

DO_EC_KEY_PRINT

d2i_ECPrivateKey

zlib not supported

wrong public key type

unsupported public key type

unsupported encryption algorithm

unsupported any defined by type

unknown public key type

unable to decode rsa private key

unable to decode rsa key

streaming not supported

private key header missing

digest and key type not supported

bad password read

X509_PKEY_new

i2d_RSA_PUBKEY

i2d_PublicKey

i2d_PrivateKey

i2d_EC_PUBKEY

i2d_DSA_PUBKEY

d2i_X509_PKEY

d2i_PublicKey

d2i_PrivateKey

d2i_AutoPrivateKey

unsupported algorithm

unknown key type

unable to get certs public key

public key encode error

public key decode error

no cert set for us to verify

method not supported

loading cert dir

key values mismatch

key type mismatch

cert already in hash table

cant check dh key

X509_verify_cert

X509_STORE_add_cert

X509_REQ_check_private_key

X509_PUBKEY_set

X509_PUBKEY_get

X509_load_cert_file

X509_load_cert_crl_file

X509_get_pubkey_parameters

X509_check_private_key

GET_CERT_BY_SUBJECT

ADD_CERT_DIR

PKEY_DSA_KEYGEN

PKEY_DSA_CTRL

unsupported key components

unsupported encryption

read key

public key no rsa

problems getting password

keyblob too short

keyblob header parse error

expecting public key blob

expecting private key blob

error converting private key

PEM_WRITE_PRIVATEKEY

PEM_READ_PRIVATEKEY

PEM_READ_BIO_PRIVATEKEY

PEM_PK8PKEY

PEM_F_PEM_WRITE_PKCS8PRIVATEKEY

DO_PK8PKEY_FP

DO_PK8PKEY

d2i_PKCS8PrivateKey_fp

d2i_PKCS8PrivateKey_bio

unsupported salt type

unsupported private key algorithm

unsupported prf

unsupported key size

unsupported key derivation function

unsupported keylength

unsuported number of rounds

private key encode error

private key decode error

operaton not initialized

operation not supported for this keytype

no operation set

no key set

keygen failure

invalid operation

expecting a ec key

expecting a ecdsa key

expecting a dsa key

expecting a dh key

expecting an rsa key

different key types

ctrl operation not implemented

command not supported

camellia key setup failed

bn pubkey error

bad key length

aes key setup failed

PKEY_SET_TYPE

PKCS5_v2_PBE_keyivgen

PKCS5_PBE_keyivgen

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover

EVP_PKEY_verify_init

EVP_PKEY_verify

EVP_PKEY_sign_init

EVP_PKEY_sign

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen

EVP_PKEY_new

EVP_PKEY_keygen_init

EVP_PKEY_keygen

EVP_PKEY_get1_RSA

EVP_PKEY_get1_EC_KEY

EVP_PKEY_GET1_ECDSA

EVP_PKEY_get1_DSA

EVP_PKEY_get1_DH

EVP_PKEY_encrypt_old

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt

EVP_PKEY_derive_set_peer

EVP_PKEY_derive_init

EVP_PKEY_derive

EVP_PKEY_decrypt_old

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_ctrl

EVP_PKEY_copy_parameters

EVP_PKEY2PKCS8_broken

EVP_PKCS82PKEY_BROKEN

EVP_PKCS82PKEY

EVP_CIPHER_CTX_set_key_length

ECKEY_PKEY2PKCS8

ECDSA_PKEY2PKCS8

DSA_PKEY2PKCS8

DSAPKEY2PKCS8

D2I_PKEY

CAMELLIA_INIT_KEY

AES_INIT_KEY

invalid public key

PKEY_DH_KEYGEN

PKEY_DH_DERIVE

GENERATE_KEY

COMPUTE_KEY

rsa operations not supported

key size too small

invalid keybits

illegal or unsupported padding mode

digest too big for rsa key

data too small for key size

RSA_generate_key

RSA_check_key

RSA_BUILTIN_KEYGEN

PKEY_RSA_VERIFYRECOVER

PKEY_RSA_SIGN

PKEY_RSA_CTRL_STR

PKEY_RSA_CTRL

.pp@0

aEÐ

 (#EÚ

ÚE<<0

RC2 part of OpenSSL 1.0.0d 8 Feb 2011

IDEA part of OpenSSL 1.0.0d 8 Feb 2011

libdes part of OpenSSL 1.0.0d 8 Feb 2011

DES part of OpenSSL 1.0.0d 8 Feb 2011

NETSCAPE_CERT_SEQUENCE

.\crypto\asn1\x_pkey.c

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventA

UrlIsW

SHLWAPI.dll

PSAPI.DLL

WS2_32.dll

COMCTL32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

FtpPutFileW

FtpCreateDirectoryW

FtpRemoveDirectoryW

FtpDeleteFileW

FtpSetCurrentDirectoryW

WININET.dll

MPR.dll

WINMM.dll

VERSION.dll

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

GetProcessHeap

KERNEL32.dll

UnregisterHotKey

RegisterHotKey

GetKeyNameTextW

MapVirtualKeyW

EnumWindows

EnumChildWindows

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyState

USER32.dll

GDI32.dll

COMDLG32.dll

ole32.dll

OLEAUT32.dll

PeekNamedPipe

.?AVECSmtp@@

zcÁ

d|{4.Nfi

^4Z.Li

\cmd'

.GL#!

*%S_A

nÂzj

GPC%FVF

GYF#FYF AR@$DQC$HXI%DW@ CWE#BQ@

(0%F{

n.JN2[

$BP%d

,hr93k{_.drj8

4.KSi

L89i

!%duO~

%duK~

;j*z%S

.iP6x

PA

\StringFileInfo\lx\%s

%Y-%m-%d_%H-%M-%S.mp3

smtps.uol.com.br

*@uol.com.br

smtp.mail.yahoo.com.br

*@yahoo.com.br

smtp.mail.yahoo.com

*@yahoo.com

smtp.comcast.net

*@comcast.net

smtp.gmx.com

*@gmx.com;*@gmx.us

smtp.hotpop.com

*@hotpop.com

smtp.aol.com

*@aol.com

smtp.gawab.com

*@gawab.com

smtp.googlemail.com

*@gmail.com;*@googlemail.com

mail.messagingengine.com

*@fastmail.fm

smtp.live.com

*@hotmail.com

smtps.bol.com.br

*@bol.com.br

smtp.aim.com

*@aim.com

smtp.ig.com.br

*@ig.com.br

Shell32.dll

RICHED20.DLL

WAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

@uxtheme.dll

@()<>,;:\"[]

Viewer.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion

test335.txt

TEST408.txt

TEST408.txt/test335.txt

4.0.7

All Files (*.*)

\Install.exe

*.exe

(*.exe)

\TEST361.txt

@USER32.DLL

4.0.7

®key=

S.ICO

\WinInit.Ini

wininet.dll

netmsg.dll

%Y-%m-%d_%H-%M-%S.jpg

@http://

S%Y-%m-%d_%H-%M-%S

CWebcam_

Keys_

.html

comctl32.dll

DNSAPI.DLL

WTL_CmdBar_InternalAutoPopupMsg

WTL_CmdBar_InternalGetBarMsg

mscoree.dll

V*(%F@4 F7*

72.JA1'

[,'&"?4-

%WinDir%\FSWKLY\HFM.exe

hotro.exe_3160:

.text

`.data

.rsrc

MSVBVM60.DLL

WebBrowser1

SHDocVwCtl.WebBrowser

ieframe.dll

WebBrowser

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\System32\ieframe.oca

user32.dll

wininet.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

HttpAddRequestHeadersA

InternetOpenUrlA

VBA6.DLL

http:///

@*\AG:\ADF\Project1.vbp

https://proj222222222.googlecode.com/svn/trunk/rent.txt

Web Browser

hotro.exe

hotromaster.exe_1040:

.text

`.data

.rsrc

MSVBVM60.DLL

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

ntdll.dll

VBA6.DLL

@*\AG:\ADF\Shell\Project1.vbp

hotro.exe

\hotro.exe

hotromaster.exe

hotrolb.exe_1844:

.text

`.data

.rsrc

MSVBVM60.DLL

WebBrowser1

SHDocVwCtl.WebBrowser

ieframe.dll

WebBrowser

E,C:\Windows\System32\ieframe.oca

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

user32.dll

wininet.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

HttpAddRequestHeadersA

InternetOpenUrlA

VBA6.DLL

ntdll.dll

@*\AG:\ADF\LB\Project1.vbp

https://proj222222222.googlecode.com/svn/trunk/rent.txt

Web Browser

hotrolb.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2756
   hotrolb.exe:1844
   hotro.exe:3160
   H_LOADER.EXE:2500
   hotromaster.exe:1040
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\H_LOADER.EXE (126 bytes)
   %WinDir%\FSWKLY\HFM.01 (81 bytes)
   %WinDir%\FSWKLY\HFM.00 (1 bytes)
   %WinDir%\FSWKLY\HFM.exe (15801 bytes)
   %WinDir%\FSWKLY\HFM.02 (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\httpErrorPagesScripts[1] (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\navcancl[1] (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\info_48[1] (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\background_gradient[1] (453 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bullet[1] (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\rent[1].txt (153 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\errorPageStrings[1] (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\ErrorPageTemplate[1] (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\b64[1].js (145 bytes)
   %Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (1254 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\92a411bc23[1] (21 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (160 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ahl6532[1].gif (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ga[1].js (22035 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\adfly_2[1].css (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery[1].js (38959 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (153 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\1market[1].htm (768 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\CC61097B94A0A007D678F95504798376 (140 bytes)
   %Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (1254 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\kjuwM[1].htm (1382 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\view40[1].js (31873 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\96D7A99548C36B10D2E8035A3E0DCA1A (7972 bytes)
   %Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (952 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\CC61097B94A0A007D678F95504798376 (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\logo_fb2[1].png (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\logo[1].png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\cloudflare.min[1].js (24826 bytes)
   %Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (92 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (871 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\96D7A99548C36B10D2E8035A3E0DCA1A (244 bytes)
   %Documents and Settings%\%current user%\Cookies\LFO58N91.txt (83 bytes)
   %Documents and Settings%\%current user%\Cookies\XWUC2JM3.txt (273 bytes)
   %Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (686 bytes)
   %Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (276 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\nr-411.min[1].js (4323 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\C6D6MG1D\www.downloadmovieshd[1].xml (13 bytes)
   %Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (510 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D4F348B882DF3F205ECCB6243795CB3A (200 bytes)
   %Documents and Settings%\%current user%\Cookies\11D1YS36.txt (125 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\footer[1].txt (579 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\42[1].htm (875 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\d_bottom_bg[1].png (167 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (200 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\en_tran[1].png (34 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\d_top_bg[1].png (156 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D4F348B882DF3F205ECCB6243795CB3A (554 bytes)
   %Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (1248 bytes)
   %Documents and Settings%\%current user%\Cookies\JA35W949.txt (1248 bytes)
   %Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (1102 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\external[1].js (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\img[1].js (764 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bag2[1] (837 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\style[1].css (1762 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery.min[1].js (57770 bytes)
   %System%\hotro.exe (32 bytes)
   %System%\hotrolb.exe (32 bytes)
   %System%\hotromaster.exe (24 bytes)
   %Documents and Settings%\All Users\Application Data\XFH\HFM.004 (1170 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "hotro" = "C:\Windows\System32\hotro.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "hotromaster" = "C:\Windows\System32\hotromaster.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "HFM Start" = "%WinDir%\FSWKLY\HFM.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.