Win32.Sality.3_a08786e275

by malwarelabrobot on October 28th, 2014 in Malware Descriptions.

Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Trojan.Win32.Swrort.3.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Virus, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: a08786e27598fbc8e8b8b368b2d0968b
SHA1: cdd5687be621e87ff7add4273e4a47f3c7874f7e
SHA256: ba1b48f9adaaf5bbd441ee6279762c35b36f2116b2ede8326259583f04e89d25
SSDeep: 12288:byBeCMQR zqgG9lzoCPKns5doSttclTO LwRlo8Q:b6MQR 25zoCCE9tclK LUib
Size: 450416 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-08-25 18:52:09
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1756
Explorer.EXE:1572

Mutexes

The following mutexes were created/opened:

{1B655094-FE2A-433c-A877-FF9793445069}
c:!documents and settings!adm!local settings!history!history.ie5!mshist012014102720141028!
_!SHMSFTHISTORY!_
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
wmiprvse.exeM_1564_
vmtoolsd.exeM_1716_
jqs.exeM_1592_
spoolsv.exeM_1440_
svchost.exeM_1104_
svchost.exeM_940_
vmacthlp.exeM_924_
services.exeM_756_
smss.exeM_540_
csrss.exeM_688_
winlogon.exeM_712_
%original file name%.exeM_1756_
ShimCacheMutex
lsass.exeM_768_
uxJLpe1m
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex

File activity

The process %original file name%.exe:1756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\sd_100710_46b91[1].jpg (23256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\hair-master-19[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA27SHI3.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (303 bytes)
C:\autorun.inf (293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\sd_100710_46b91[1].jpg (20906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\pubads_impl_52[1].js (3071 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CACJQ5I5.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\campaign-101363,100710[1] (1742 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAQV4TW9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\analytics[1].js (1008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\f[1].txt (1768 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winbhvxt.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\f[1].txt (392 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (10507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\fad58-b4c72[1].css (5 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\e07eb-ab7f5[1].js (6987 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\universaldownloader-prefetch[1].htm (975 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAO3DJ2U.gif (35 bytes)
C:\vretii.exe (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\CAEJIZMT.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\f[2].txt (6865 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (9667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAZ5XBDJ.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\container[1].html (1287 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA49AFGD.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\campaign-101363,100710[1].htm (1663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\sd_101363_400c1[1].jpg (28444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (245 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\container[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\fad58-b4c72[2].css (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\f[1].txt (6416 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (9324 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA4HMZ4X.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\pubads_impl_52[2].js (4850 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAZ5XBDJ.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA49AFGD.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winbhvxt.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAO3DJ2U.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA27SHI3.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\pubads_impl_52[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAQV4TW9.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\CAEJIZMT.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA4HMZ4X.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CACJQ5I5.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\fad58-b4c72[1].css (0 bytes)

Registry activity

The process %original file name%.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494851520"
"a2_349" = "2502018124"
"a2_346" = "2480517434"
"a2_347" = "2487692539"
"a2_344" = "2466182207"
"a2_345" = "2473352223"
"a2_342" = "2451833972"
"a2_343" = "2459002376"
"a2_340" = "2437500383"
"a2_341" = "2444667204"
"a2_180" = "1290439275"
"a2_181" = "1297605511"
"a2_182" = "1304773776"
"a2_183" = "1311956164"
"a2_184" = "1319122679"
"a2_185" = "1326292851"
"a2_186" = "1333458451"
"a2_187" = "1340633740"
"a2_188" = "1347791460"
"a2_189" = "1354960114"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074704922"
"a2_742" = "1024517196"
"a2_743" = "1031687424"
"a2_740" = "1010185247"
"a2_741" = "1017353234"
"a2_746" = "1053204605"
"a2_747" = "1060368836"
"a2_744" = "1038850617"
"a2_745" = "1046035331"
"a1_503" = "3155457736"
"a1_502" = "1047377761"
"a1_501" = "2052921731"
"a1_500" = "2663470278"
"a1_507" = "3597927333"
"a1_506" = "2244743918"
"a1_505" = "4218697479"
"a1_504" = "3506316707"
"a1_509" = "2634895328"
"a1_508" = "4190442533"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "659304823"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "3571144087"
"a1_434" = "720409292"
"a1_433" = "1881006920"
"a1_432" = "441403150"
"a1_431" = "3336257332"
"a1_430" = "2197461059"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a3_449" = "3202245640"
"a1_636" = "4157110343"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "543740145"
"a1_728" = "573619338"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "935172231"
"a2_748" = "1067540043"
"a1_593" = "1401992175"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_984" = "1913495681"
"a1_983" = "3491329742"
"a1_982" = "1075356780"
"a1_981" = "1952158185"
"a1_980" = "1504846682"
"a3_869" = "1918293868"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a1_855" = "2391090507"
"a3_655" = "383827462"
"a1_857" = "3228923333"
"a1_856" = "2958584972"
"a1_851" = "2533771686"
"a1_850" = "1772302919"
"a1_853" = "3749058832"
"a3_654" = "376767975"
"a1_859" = "700557747"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "3127999397"
"a1_184" = "1086088837"
"a1_183" = "606715160"
"a1_182" = "3545605578"
"a1_181" = "3318293966"
"a1_180" = "84383503"
"a1_963" = "84520631"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "1470314756"
"a1_801" = "3993985501"
"a4_824" = "1612388408"
"a4_393" = "2817464553"
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "1348566817"
"a4_866" = "1913491490"
"a1_933" = "683046020"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "3723315356"
"a4_863" = "1891984127"
"a1_936" = "976078870"
"a4_862" = "1884815006"
"a1_937" = "120721238"
"a2_405" = "2903502346"
"a2_404" = "2896316985"
"a2_407" = "2917840150"
"a2_406" = "2910661622"
"a2_401" = "2874813598"
"a2_400" = "2867645238"
"a2_403" = "2889161452"
"a2_402" = "2881978384"
"a1_935" = "1317422323"
"a2_409" = "2932163489"
"a2_408" = "2924994799"
"a2_975" = "2694928012"
"a2_974" = "2687759213"
"a2_977" = "2709260519"
"a2_976" = "2702093319"
"a2_971" = "2666243389"
"a2_970" = "2659087178"
"a2_973" = "2680592735"
"a4_896" = "2128565120"
"a2_979" = "2723610606"
"a2_978" = "2716426072"
"a1_222" = "1069759392"
"a1_223" = "196674859"
"a1_220" = "2263491599"
"a1_221" = "4116913892"
"a1_226" = "4083709046"
"a1_227" = "3076984266"
"a1_224" = "532668055"
"a1_225" = "2572899200"
"a1_228" = "427213233"
"a1_229" = "3490357128"
"a2_579" = "4150926777"
"a2_578" = "4143758955"
"a2_571" = "4093574467"
"a2_570" = "4086391529"
"a2_573" = "4107908230"
"a2_572" = "4100742656"
"a2_575" = "4122241141"
"a2_574" = "4115073756"
"a2_577" = "4136574698"
"a2_576" = "4129422431"
"a2_351" = "2516369056"
"a2_350" = "2509187348"
"a2_353" = "2530702242"
"a2_352" = "2523536083"
"a2_355" = "2545035301"
"a2_354" = "2537876979"
"a2_357" = "2559372877"
"a2_356" = "2552214837"
"a2_359" = "2573692510"
"a2_358" = "2566539409"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383599990"
"a2_192" = "1376474723"
"a2_191" = "1369305909"
"a2_190" = "1362126871"
"a2_197" = "1412311030"
"a2_196" = "1405144387"
"a2_195" = "1397976212"
"a2_194" = "1390807477"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426658344"
"a2_198" = "1419493154"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014102720141028]
"CachePrefix" = ":2014102720141028:"

[HKCU\Software\Aas]
"a3_625" = "168917752"
"a2_759" = "1146389198"
"a3_626" = "175906587"
"a2_755" = "1117722054"
"a2_754" = "1110556441"
"a2_757" = "1132065314"
"a3_627" = "183481274"
"a2_751" = "1089037913"
"a2_750" = "1081871555"
"a2_753" = "1103387430"
"a2_752" = "1096207268"
"a1_536" = "2479229644"
"a1_537" = "1386224672"
"a1_534" = "3722880806"
"a1_535" = "394861962"
"a1_89" = "3312719637"
"a1_88" = "2174583084"
"a1_530" = "4042347022"
"a1_531" = "1711250540"
"a1_85" = "3863350159"
"a1_84" = "3088357359"
"a1_87" = "2196205226"
"a1_86" = "597024217"
"a1_81" = "2549980683"
"a1_80" = "1324493837"
"a1_83" = "540181799"
"a1_82" = "771434924"
"a3_914" = "2274560123"
"a2_898" = "2142896658"
"a1_896" = "442833214"
"a1_890" = "3103993478"
"a2_899" = "2150078582"
"a1_67" = "2240522040"
"a1_66" = "522175154"
"a1_65" = "3726747124"
"a3_133" = "970345548"
"a1_63" = "3649441557"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "329601902"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "3653922367"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "2028628707"
"a1_68" = "1381432969"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "3262542282"
"a1_409" = "3676918758"
"a1_402" = "3119801863"
"a1_403" = "3398279882"
"a1_400" = "2295716267"
"a1_401" = "71767278"
"a1_406" = "2145060232"
"a1_407" = "548825329"
"a1_404" = "2595328462"
"a1_405" = "1854485448"
"a2_823" = "1605210936"
"a2_822" = "1598057148"
"a2_821" = "1590883921"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633900956"
"a1_628" = "2777972805"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "3484804333"
"a2_826" = "1626731920"
"a2_825" = "1619550132"
"a1_718" = "3127526320"
"a1_719" = "596399674"
"a1_716" = "2192920560"
"a1_717" = "684671738"
"a1_714" = "914747185"
"a1_715" = "2418087860"
"a1_712" = "1505870748"
"a1_713" = "2289730813"
"a1_710" = "2725597274"
"a1_711" = "2704977460"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "2289510691"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"

"a3_448" = "3194799081"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a2_941" = "2451173258"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "1901315884"
"a1_889" = "1605005820"
"a1_886" = "404187188"
"a1_887" = "2967523084"
"a1_884" = "2601367213"
"a1_885" = "202298012"
"a1_882" = "2633869668"
"a1_883" = "3670402251"
"a1_880" = "2968224815"
"a1_881" = "2248672158"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251292432"
"a3_444" = "3166269973"
"a3_445" = "3206813364"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Aas]
"a1_831" = "3382709874"
"a2_592" = "4244126583"
"a1_930" = "3227704127"
"a1_948" = "3960477199"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "4058440377"
"a1_723" = "797698474"
"a1_722" = "1686263340"
"a1_721" = "284670766"
"a1_720" = "1964982379"
"a1_768" = "2857963353"
"a1_727" = "1977718473"
"a1_726" = "2811681355"
"a2_643" = "314770208"
"a2_790" = "1368645616"
"a1_725" = "3914285921"
"a2_642" = "307602836"
"a1_724" = "3692718817"
"a2_641" = "300436607"
"a2_640" = "293268821"
"a2_647" = "343445804"
"a2_646" = "336285816"
"a1_158" = "2080019734"
"a1_159" = "4078816358"
"a2_645" = "329119611"
"a1_150" = "2047469750"
"a1_151" = "3910618763"
"a1_152" = "2905067499"
"a1_153" = "415459890"
"a1_154" = "3154192001"
"a1_155" = "1401222002"
"a1_156" = "3652182634"
"a1_157" = "1956387535"
"a1_235" = "3390854581"
"a1_234" = "523734261"
"a1_237" = "2443074963"
"a1_236" = "2182459577"
"a1_231" = "1101874396"
"a1_230" = "1787467338"
"a1_233" = "4050322563"
"a1_232" = "4033645758"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Aas]
"a1_239" = "1016554811"
"a1_238" = "2310343528"
"a2_210" = "1505513185"
"a2_211" = "1512675700"
"a2_212" = "1519859848"
"a2_213" = "1527031700"
"a2_214" = "1534184225"
"a2_215" = "1541362773"
"a2_216" = "1548529422"
"a2_217" = "1555695944"
"a2_218" = "1562863188"
"a2_219" = "1570045428"
"a1_966" = "1313304447"
"a2_508" = "3641905377"
"a2_384" = "2752951455"
"a2_504" = "3613229537"
"a2_505" = "3620413576"
"a2_506" = "3627581217"
"a2_507" = "3634747056"
"a2_500" = "3584568921"
"a2_501" = "3591728596"
"a2_502" = "3598895993"
"a2_503" = "3606065149"
"a2_791" = "1375811682"
"a2_698" = "709078647"
"a2_699" = "716246099"
"a2_694" = "680397171"
"a2_695" = "687577719"
"a2_696" = "694731883"
"a2_697" = "701913886"
"a2_690" = "651734953"
"a2_691" = "658893112"
"a2_692" = "666062825"
"a2_693" = "673225281"
"a2_324" = "2322800505"
"a2_325" = "2329967294"
"a2_326" = "2337109473"
"a2_327" = "2344299656"
"a2_320" = "2294115920"
"a2_321" = "2301294699"
"a2_322" = "2308462613"
"a2_323" = "2315616515"
"a1_521" = "1757505072"
"a1_520" = "3797296755"
"a1_523" = "316864326"
"a1_522" = "2135851748"
"a2_328" = "2351466055"
"a2_329" = "2358649538"
"a1_527" = "1345932028"
"a1_526" = "1694191604"
"a2_799" = "1433162991"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Aas]
"a2_798" = "1425982356"
"a4_962" = "2601727106"
"a1_98" = "4149991448"
"a1_99" = "756082141"
"a1_92" = "2022045802"
"a1_93" = "4232334755"
"a1_90" = "1538306342"
"a1_91" = "2501964864"
"a1_96" = "3752651332"
"a1_97" = "1966118896"
"a1_94" = "57275568"
"a1_95" = "3388605762"
"a1_74" = "1994309855"
"a1_75" = "2987831831"
"a1_76" = "2460008081"
"a1_77" = "3983402647"
"a1_70" = "3317804521"
"a1_71" = "2427497564"
"a1_72" = "1438968562"
"a1_73" = "374192408"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "329142476"
"a1_79" = "3695093434"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "217682322"
"a1_418" = "3241047263"
"a3_953" = "2520368944"
"a1_415" = "2317317115"
"a1_414" = "3217709761"
"a1_417" = "4099067083"
"a1_416" = "3664941344"
"a1_411" = "756947467"
"a1_410" = "949788682"
"a1_413" = "2267200304"
"a1_412" = "3866486178"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "2730095300"
"a1_700" = "1226704391"
"a1_703" = "1780184461"
"a1_702" = "1301606560"
"a1_705" = "465087057"
"a1_704" = "2938945416"
"a1_707" = "240677038"
"a1_706" = "1629487548"
"a1_709" = "3659932668"
"a1_708" = "3278751230"
"a2_360" = "2580886599"
"a4_838" = "1712756102"
"a2_361" = "2588055273"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595220581"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609557251"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616722498"
"a2_366" = "2623905503"
"a2_367" = "2631071891"
"a1_743" = "2308222286"
"a2_168" = "1204406226"
"a2_169" = "1211590616"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147053447"
"a4_973" = "2680587437"
"a2_161" = "1154220558"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "2837354021"
"a3_776" = "1251683361"
"a1_893" = "2078417039"
"a1_892" = "1865396367"
"a1_895" = "1170728662"
"a1_894" = "3057951207"
"a1_897" = "1284930911"
"a3_777" = "1292288064"
"a1_899" = "261622765"
"a1_898" = "2691882551"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261953016"
"a1_617" = "3118702484"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "B66E8494-AE49-4553-831E-E37A7618A695"

[HKCU\Software\Aas]
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "640949581"
"a2_459" = "3290621979"
"a3_678" = "548713167"
"a1_614" = "3376396168"
"a1_820" = "4154867466"
"a1_821" = "1442905519"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Aas]
"a1_822" = "2953596711"

"a1_149" = "2445537983"
"a1_148" = "399405105"
"a1_143" = "291208050"
"a1_142" = "957161144"
"a1_141" = "2594899504"
"a1_140" = "1127636825"
"a1_147" = "948691174"
"a1_146" = "1750502408"
"a1_145" = "3818415183"
"a1_144" = "777464455"
"a1_826" = "270421318"
"a1_827" = "3751273732"
"a2_203" = "1455329029"
"a2_202" = "1448161003"
"a2_201" = "1440990880"
"a2_200" = "1433826353"
"a2_207" = "1484010681"
"a2_206" = "1476845205"
"a2_205" = "1469662658"
"a2_204" = "1462494359"
"a2_209" = "1498338068"
"a2_208" = "1491177711"
"a2_519" = "3720780994"
"a2_518" = "3713612172"
"a2_517" = "3706432014"
"a2_516" = "3699264156"
"a2_515" = "3692098860"
"a2_514" = "3684929853"
"a2_513" = "3677764122"
"a2_512" = "3670596506"
"a2_511" = "3663415844"
"a2_510" = "3656249297"
"a2_689" = "644559421"
"a2_688" = "637391335"
"a2_687" = "630222996"
"a2_686" = "623041513"
"a2_685" = "615875142"
"a2_684" = "608704480"
"a2_683" = "601545633"
"a2_682" = "594375738"
"a2_681" = "587207810"
"a2_680" = "580040903"
"a2_337" = "2415999531"
"a2_336" = "2408815700"
"a2_335" = "2401649978"
"a2_334" = "2394484649"
"a2_333" = "2387314830"
"a2_332" = "2380139949"
"a2_331" = "2372983809"
"a2_330" = "2365815009"
"a1_554" = "59905689"
"a1_555" = "2455117154"
"a1_556" = "133721073"
"a1_557" = "1413791060"
"a3_242" = "1718323611"
"a1_551" = "2057034619"
"a2_339" = "2430333664"
"a2_338" = "2423136005"
"a4_673" = "529851137"
"a1_918" = "2053791338"
"a1_919" = "2060168190"
"a3_243" = "1725243962"
"a1_852" = "1216193947"
"a1_914" = "2231531755"
"a1_398" = "661939331"
"a1_399" = "1768811806"
"a4_679" = "572865863"
"a1_392" = "3963898620"
"a1_393" = "4067553695"
"a1_390" = "4020290777"
"a1_391" = "1033361022"
"a1_396" = "1265393701"
"a1_397" = "1556573651"
"a1_394" = "1828576560"
"a1_395" = "3525759526"
"a1_858" = "3850480452"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "32642037"
"a1_48" = "2724753278"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "2174302425"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "2548954515"
"a1_775" = "116242717"
"a1_776" = "1433814108"
"a1_777" = "1518910128"
"a1_191" = "825896929"
"a1_771" = "2543202676"
"a1_772" = "2460862425"
"a1_773" = "1275927294"
"a1_953" = "4198215079"
"a3_927" = "2367492374"
"a1_778" = "3752784500"
"a1_779" = "698464254"
"a3_926" = "2326953207"
"a2_17" = "121880052"
"a2_16" = "114708515"
"a2_15" = "107521270"
"a2_14" = "100360688"
"a2_13" = "93192241"
"a2_12" = "86028259"
"a2_11" = "78860029"
"a2_10" = "71682385"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "4276141070"
"a2_19" = "136205204"
"a2_18" = "129044703"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "799489810"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "512124202"
"a1_596" = "1936848234"
"a1_597" = "2112707434"
"a1_608" = "585581021"
"a1_609" = "3761067919"
"a3_378" = "2693094675"
"a3_379" = "2700145074"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Aas]
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "3837227557"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "2718363976"
"a3_484" = "3486690637"
"a1_952" = "358135702"
"a2_925" = "2336468793"
"a1_954" = "3107275042"
"a1_955" = "2101658991"
"a1_956" = "1701750378"
"a3_485" = "3460055532"
"a1_958" = "4225634114"
"a2_922" = "2314970140"
"a1_750" = "3944185975"
"a1_751" = "3869983410"
"a1_756" = "3194510622"
"a1_757" = "3129252971"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "3693189924"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "3511256879"
"a4_903" = "2178748967"
"a1_188" = "1604921742"
"a4_900" = "2157241604"
"a1_187" = "998212994"
"a4_901" = "2164410725"
"a1_186" = "3872517817"
"a2_929" = "2365149449"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "1501132056"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "3366472288"
"a4_968" = "2644741832"
"a1_558" = "2835144759"
"a1_559" = "462642579"
"a1_606" = "1368704933"
"a3_925" = "2319505492"
"a1_178" = "2922616524"
"a1_179" = "408738286"
"a1_176" = "1209198201"
"a1_177" = "819662412"
"a1_174" = "2615167155"
"a1_175" = "97040406"
"a1_172" = "1357377395"
"a1_173" = "2600150262"
"a1_170" = "1508237521"
"a1_171" = "246464155"
"a1_550" = "1317701170"
"a2_236" = "1691914389"
"a2_237" = "1699082611"
"a2_234" = "1677580109"
"a2_235" = "1684748464"
"a2_232" = "1663227875"
"a2_233" = "1670413884"
"a2_230" = "1648899220"
"a2_231" = "1656065440"
"a1_553" = "3000365776"
"a2_238" = "1706250116"
"a2_239" = "1713418010"
"a2_522" = "3742281761"
"a2_523" = "3749448516"
"a2_520" = "3727948423"
"a2_521" = "3735116965"
"a2_526" = "3770949719"
"a2_527" = "3778117762"
"a2_524" = "3756617187"
"a2_525" = "3763783530"
"a2_838" = "1712752866"
"a2_839" = "1719919296"
"a2_528" = "3785298029"
"a2_529" = "3792468280"
"a3_688" = "620670617"
"a1_626" = "2203755406"
"a1_541" = "4126313793"
"a1_627" = "3136724002"
"a1_624" = "364647774"
"a1_549" = "630418268"
"a1_548" = "1577521511"
"a1_547" = "3105812533"
"a1_546" = "2908738197"
"a1_545" = "160569176"
"a1_544" = "700545140"
"a1_543" = "2254423697"
"a1_542" = "1984066955"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a1_540" = "302356463"
"a2_658" = "422320271"
"a2_659" = "429475426"
"a2_308" = "2208095438"
"a2_309" = "2215250426"
"a2_302" = "2165079313"
"a2_303" = "2172245475"
"a2_300" = "2150741030"
"a2_301" = "2157908473"
"a2_306" = "2193745643"
"a2_307" = "2200927148"
"a2_304" = "2179410439"
"a2_305" = "2186589372"
"a2_786" = "1339959853"
"a2_787" = "1347138587"
"a2_784" = "1325615262"
"a2_785" = "1332795022"
"a2_782" = "1311291601"
"a2_783" = "1318461045"
"a2_780" = "1296944662"
"a2_781" = "1304109592"
"a2_788" = "1354296335"
"a2_789" = "1361462738"
"a1_389" = "3682007850"
"a1_388" = "2269534906"
"a1_385" = "2868728731"
"a1_384" = "1660953919"
"a1_387" = "3148843517"
"a1_386" = "2880994075"
"a1_381" = "1838530400"
"a1_380" = "545335087"
"a1_383" = "1844069220"
"a1_382" = "837609932"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Aas]
"a1_58" = "3625340599"
"a1_59" = "3105691360"
"a1_56" = "1246925590"
"a1_57" = "4178975312"
"a1_54" = "1336459117"
"a1_55" = "1850882440"
"a1_52" = "1955182729"
"a1_53" = "3389997387"
"a1_50" = "422526784"
"a1_51" = "398839022"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "4178161366"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a2_916" = "2271944607"
"a3_893" = "2090093684"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014102720141028]
"CacheOptions" = "11"

[HKCU\Software\Aas]
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "1173570418"
"a1_764" = "2426447818"

"a1_762" = "2121437296"
"a1_761" = "2537612102"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257601500"
"a4_858" = "1856138522"
"a1_586" = "3198842452"
"a1_789" = "737766983"
"a3_720" = "849951481"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "1406487242"
"a1_619" = "1334446037"
"a1_618" = "3492155362"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "3952051487"
"a4_522" = "3742281162"
"a2_62" = "444493802"
"a4_523" = "3749450283"
"a2_63" = "451645454"
"a4_524" = "3756619404"
"a1_971" = "1396457604"
"a2_60" = "430151807"
"a4_525" = "3763788525"
"a1_943" = "1325215290"
"a1_942" = "2622427324"
"a1_941" = "4246320848"
"a2_61" = "437318160"
"a1_947" = "2561418144"
"a4_526" = "3770957646"
"a1_945" = "2251347402"
"a1_944" = "18671922"
"a2_66" = "473169725"
"a1_949" = "240308523"
"a4_527" = "3778126767"
"a2_67" = "480337284"
"a2_64" = "458818103"
"a2_65" = "465988143"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "2920313223"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "1246880461"
"a1_41" = "1650864477"
"a1_40" = "459840152"
"a1_43" = "2586351093"
"a3_819" = "1559971962"
"a1_42" = "3566803908"
"a3_813" = "1516544548"
"a1_45" = "860021700"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "3052731106"
"a1_47" = "3861899901"
"a1_46" = "4186457048"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a1_783" = "1370043777"
"a3_757" = "1115339004"
"a1_959" = "1463848454"
"a2_907" = "2207428796"
"a1_161" = "3952297137"
"a1_160" = "4202141556"
"a1_163" = "2548512627"
"a1_162" = "314474044"
"a1_165" = "11196362"
"a1_164" = "2084315658"
"a1_167" = "1546750356"
"a1_166" = "3631778972"
"a1_169" = "4260785232"
"a1_168" = "211428412"
"a3_727" = "933979486"
"a2_535" = "3835482369"
"a2_534" = "3828318081"
"a2_537" = "3849819737"
"a2_536" = "3842639925"
"a2_531" = "3806799928"
"a2_530" = "3799633381"
"a2_533" = "3821134802"
"a2_532" = "3813966145"
"a2_829" = "1648236423"
"a2_828" = "1641070363"
"a2_539" = "3864153425"
"a2_538" = "3856985693"
"a4_447" = "3204597087"
"a1_572" = "1318037898"
"a1_573" = "2966807215"
"a1_570" = "864110004"
"a1_571" = "167526047"
"a1_576" = "1806007805"
"a1_577" = "3161212620"
"a1_574" = "758273344"
"a1_575" = "2673703104"
"a1_578" = "2988717750"
"a1_579" = "3115526202"
"a2_649" = "357786422"
"a2_648" = "350618192"
"a2_319" = "2286947493"
"a2_318" = "2279779409"
"a2_315" = "2258282129"
"a2_314" = "2251097655"
"a2_317" = "2272619814"
"a2_316" = "2265447299"
"a2_311" = "2229594276"
"a2_310" = "2222429610"
"a2_313" = "2243928249"
"a2_312" = "2236760543"
"a2_229" = "1641731344"
"a2_228" = "1634565494"
"a2_221" = "1584380922"
"a2_220" = "1577215900"
"a2_223" = "1598712032"
"a2_222" = "1591546446"
"a2_225" = "1613049442"
"a2_224" = "1605881613"
"a2_227" = "1627398980"
"a2_226" = "1620215189"
"a1_370" = "3303771500"
"a1_371" = "4246287661"
"a1_372" = "2784179330"
"a1_373" = "110311792"
"a1_374" = "269864155"
"a1_375" = "3346213733"
"a1_376" = "764813093"
"a1_377" = "1883599540"
"a1_378" = "975679861"
"a1_379" = "1469371429"
"a2_793" = "1390143653"
"a2_792" = "1382977661"
"a2_795" = "1404477488"
"a2_794" = "1397309872"
"a2_797" = "1418828498"
"a2_796" = "1411645467"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "2470988596"
"a1_28" = "1159463509"
"a1_590" = "483732274"
"a1_23" = "423033355"
"a1_22" = "2652258825"
"a1_21" = "2453019207"
"a1_20" = "238579008"
"a1_27" = "2137853414"
"a1_26" = "1832866186"
"a1_25" = "1959383236"
"a1_24" = "3029899428"
"a1_284" = "1539783402"
"a1_285" = "2056819108"
"a1_286" = "3709537287"
"a1_287" = "2407900011"
"a1_280" = "2114568872"
"a1_281" = "3073681462"
"a1_282" = "238553855"
"a1_283" = "3152391557"
"a3_31" = "205278614"
"a1_288" = "410139259"
"a1_289" = "2204804821"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746436"
"a1_591" = "1535598939"
"a3_32" = "212854281"
"a2_972" = "2673426329"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "3482102293"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "2286220836"
"a1_599" = "3119632512"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222233800"
"a2_30" = "215080432"
"a2_33" = "236580328"
"a2_32" = "229415711"
"a2_35" = "250912985"
"a2_34" = "243746908"
"a2_37" = "265263129"
"a2_36" = "258096777"
"a2_39" = "279597824"
"a2_38" = "272433083"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186758719"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193942474"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014102720141028]
"CacheRepair" = "0"

[HKCU\Software\Aas]
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "355554821"
"a1_625" = "2611885448"
"a1_622" = "931867120"
"a1_623" = "1200923829"
"a1_620" = "3324757852"
"a1_621" = "820789275"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "222"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "3191170110"
"a2_588" = "4215445271"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222603690"
"a1_976" = "3188475929"
"a1_977" = "3071924992"
"a1_974" = "1300354238"
"a1_975" = "1345917141"
"a1_972" = "3943698786"
"a1_973" = "1334334233"
"a1_970" = "831398359"
"a3_827" = "1616916338"
"a1_770" = "3113932968"
"a1_978" = "3723862105"
"a1_979" = "1527229351"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Aas]
"a4_199" = "1426655079"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Aas]
"a3_504" = "3596547281"
"a2_363" = "2602389419"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157244526"
"a1_746" = "3614357880"
"a4_827" = "1633895771"
"a2_901" = "2164419759"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171582378"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185915447"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193081840"
"a2_906" = "2200248123"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "1912481924"
"a1_115" = "3871762856"
"a1_116" = "1388847239"
"a1_117" = "2522103781"
"a1_110" = "675191424"
"a1_111" = "111448006"
"a1_112" = "3177583822"
"a1_113" = "2169659528"
"a1_824" = "3222361990"
"a1_118" = "185935354"
"a1_119" = "3243179838"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570227485"
"a2_499" = "3577383029"
"a2_492" = "3527209367"
"a2_493" = "3534378221"
"a2_490" = "3512877050"
"a2_491" = "3520041825"
"a2_496" = "3555877847"
"a2_497" = "3563058589"
"a2_494" = "3541542983"
"a2_495" = "3548712621"
"a2_816" = "1555027303"
"a2_817" = "1562198020"
"a2_814" = "1540688292"
"a2_815" = "1547874626"
"a2_812" = "1526365327"
"a3_740" = "1026900557"
"a2_810" = "1512014026"
"a2_811" = "1519183430"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569367885"
"a2_819" = "1576549509"
"a1_565" = "721499000"
"a1_564" = "799208346"
"a1_567" = "4227393689"
"a1_566" = "4169786729"
"a1_561" = "2593793500"
"a1_560" = "2560021382"
"a1_563" = "569046856"
"a1_562" = "3315203788"
"a1_569" = "2497244197"
"a1_568" = "4154303882"
"a1_525" = "379115766"
"a2_678" = "565705167"
"a2_679" = "572858414"
"a2_676" = "551357635"
"a2_677" = "558522654"
"a2_674" = "537024783"
"a2_675" = "544192487"
"a2_672" = "522675829"
"a2_673" = "529856798"
"a2_670" = "508342136"
"a2_671" = "515506975"
"a3_982" = "2728158783"
"a2_258" = "1849635981"
"a2_259" = "1856805564"
"a2_254" = "1820951680"
"a2_255" = "1828121540"
"a2_256" = "1835302389"
"a2_257" = "1842469158"
"a2_250" = "1792285869"
"a2_251" = "1799442129"
"a2_252" = "1806625545"
"a2_253" = "1813785034"
"a1_363" = "3936873702"
"a1_362" = "2520089463"
"a1_361" = "1237155328"
"a1_360" = "588782950"
"a1_367" = "1054153401"
"a1_366" = "1735255912"
"a1_365" = "28866080"
"a1_364" = "531216518"
"a1_369" = "3986457605"
"a1_368" = "615949062"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "3820409522"
"a1_39" = "397379516"
"a1_30" = "4050740592"
"a1_31" = "936209421"
"a1_32" = "3543813467"
"a1_33" = "175344846"
"a1_34" = "3526634201"
"a1_35" = "1313821685"
"a1_36" = "2451134233"
"a1_37" = "490754984"
"a1_297" = "3878894905"
"a1_296" = "950802429"
"a1_295" = "895575740"
"a1_294" = "3059729338"
"a1_293" = "2580626124"
"a1_292" = "1984927442"
"a1_291" = "1587477245"
"a1_290" = "3685550940"
"a1_299" = "3484291685"
"a1_298" = "3816068775"
"a3_769" = "1234824520"
"a1_600" = "2731224950"
"a2_668" = "494008194"
"a1_601" = "1768455404"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "1680425029"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774259065"
"a2_109" = "781426634"
"a4_878" = "1999520942"
"a1_603" = "958310434"
"a2_100" = "716902446"
"a2_101" = "724077050"
"a2_102" = "731245516"
"a2_103" = "738426540"
"a2_104" = "745593535"
"a2_105" = "752760350"
"a2_106" = "759926278"
"a2_107" = "767094102"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "2655662289"
"a1_589" = "3238954903"
"a1_588" = "3955502739"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "1712714103"
"a1_748" = "3874962737"
"a2_28" = "200730395"
"a2_29" = "207912138"
"a2_26" = "186395697"
"a2_27" = "193541306"
"a2_24" = "172061639"
"a2_25" = "179230553"
"a2_22" = "157728584"
"a2_23" = "164894216"
"a2_20" = "143376644"
"a2_21" = "150545577"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139223578"
"a2_7" = "50177757"
"a2_6" = "43009171"
"a2_5" = "35842997"
"a2_4" = "28674598"
"a2_3" = "21509374"
"a2_2" = "14346776"
"a2_1" = "7173030"
"a2_0" = "7512"
"a1_639" = "35653190"
"a1_638" = "3043348226"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64527498"
"a2_8" = "57357481"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124890335"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "706542254"
"a1_533" = "799493518"
"a4_845" = "1762939949"
"a2_853" = "1820318936"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 5C E9 C4 F3 D0 ED 21 B9 72 F6 08 38 9F D0 DB"

[HKCU\Software\Aas]
"a1_968" = "2851907514"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "1446467043"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "3947136598"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "2708894703"
"a2_911" = "2236099362"
"a1_957" = "584563008"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0700687474703A2F2F747863697265626F6E2E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F67656E6A692D73637265656E70726F746563746F722E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F796F75746265722E6869746F77792E706C2F6C6F676F2E67696600687474703A2F2F7A737A726970627964676F737A637A2E7A612E706C2F6C6F676F2E67696600687474703A2F2F7A6C6F746F2E6672696B6F2E706C2F6C6F676F2E67696600687474703A2F2F616E6A6F6D616E2E756173742D6D616C617965722E61632E69722F696D6167652F6C6F676F2E67696600687474703A2F2F6368676B2E67652F6C6F676F2E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014716263"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "2018543889"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "2584314606"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013862519"
"a1_107" = "3628891464"
"a1_106" = "190566527"
"a1_105" = "2380265472"
"a1_104" = "595699494"
"a1_103" = "2291540050"
"a1_102" = "2210657721"
"a1_101" = "2793201683"
"a1_100" = "889637299"
"a3_134" = "943841519"
"a1_109" = "3584931069"
"a1_62" = "2238275681"
"a1_61" = "3222009708"
"a3_137" = "998890944"
"a2_883" = "2035360521"
"a3_686" = "606179783"
"a2_489" = "3505693175"
"a2_488" = "3498525711"
"a3_687" = "613616230"
"a2_485" = "3477028527"
"a2_484" = "3469861961"
"a2_487" = "3491360742"
"a2_486" = "3484201633"
"a2_481" = "3448355738"
"a2_480" = "3441175861"
"a2_483" = "3462691640"
"a2_482" = "3455509634"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028195817"
"a3_976" = "2685262841"
"a2_809" = "1504848439"
"a2_808" = "1497690536"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447496219"
"a2_800" = "1440329923"
"a2_803" = "1461844361"
"a3_681" = "570649632"
"a2_805" = "1476181248"
"a2_804" = "1469013618"
"a2_807" = "1490515037"
"a2_806" = "1483349745"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049711365"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443824394"
"a2_660" = "436657427"
"a2_663" = "458154922"
"a3_146" = "1063277947"
"a2_665" = "472489666"
"a2_664" = "465322192"
"a2_667" = "486839569"
"a2_666" = "479659915"
"a2_669" = "501183671"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021024794"
"a3_143" = "1008236550"
"a2_249" = "1785117440"
"a2_248" = "1777935458"
"a2_247" = "1770766752"
"a2_246" = "1763599009"
"a2_245" = "1756443784"
"a2_244" = "1749258149"
"a2_243" = "1742099361"
"a2_242" = "1734934487"
"a2_241" = "1727751942"
"a2_240" = "1720596769"
"a1_356" = "3888533169"
"a1_357" = "26719752"
"a1_354" = "2935333874"
"a1_355" = "1042115006"
"a1_352" = "269407657"
"a1_353" = "994198936"
"a1_350" = "2560322498"
"a1_351" = "71742934"
"a2_855" = "1834625543"
"a3_639" = "269411382"
"a1_358" = "947392502"
"a1_359" = "403813161"
"a3_638" = "295912343"
"a2_887" = "2064044480"
"a2_886" = "2056865523"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583717150"
"a2_119" = "853127183"
"a2_118" = "845963644"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810112912"
"a2_112" = "802943660"
"a2_111" = "795778008"
"a2_110" = "788611011"
"a2_117" = "838793916"
"a2_116" = "831611407"
"a2_115" = "824456276"
"a2_114" = "817277589"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533531189"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422969452"
"a2_58" = "415802603"
"a2_53" = "379966635"
"a2_52" = "372800866"
"a2_51" = "365619409"
"a2_50" = "358453054"
"a2_57" = "408636973"
"a2_56" = "401467912"
"a2_55" = "394299324"
"a2_54" = "387134097"
"a4_842" = "1741432586"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "659074909"
"a1_645" = "483409881"
"a1_646" = "2999036538"
"a1_647" = "3942120092"
"a1_640" = "2452552095"
"a1_641" = "367076541"
"a1_642" = "403363692"
"a1_643" = "589842684"
"a1_648" = "2254871118"
"a1_649" = "207728583"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas]
"a2_953" = "2537197108"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "2558495973"
"a1_829" = "631508855"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "2808298982"
"a1_916" = "3059098588"
"a1_917" = "1703562008"
"a1_910" = "249355985"
"a1_911" = "2328122721"
"a1_912" = "3403014837"
"a1_913" = "3526413535"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "2500204400"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "164127479"
"a1_139" = "2458450174"
"a3_907" = "2190592386"
"a1_132" = "4072955482"
"a1_133" = "3334579120"
"a1_130" = "2111786748"
"a1_131" = "433889240"
"a1_136" = "1460876710"
"a1_137" = "1174828204"
"a1_134" = "1249215635"
"a1_135" = "3893298065"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369490254"
"a2_471" = "3376647702"
"a2_472" = "3383820529"
"a2_473" = "3390991133"
"a2_474" = "3398158335"
"a2_475" = "3405324924"
"a2_476" = "3412493430"
"a2_477" = "3419676337"
"a2_478" = "3426840756"
"a2_479" = "3434017362"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "1186703913"
"a2_878" = "1999526319"
"a2_879" = "2006695515"
"a2_874" = "1970840935"
"a2_875" = "1978011031"
"a2_876" = "1985178687"
"a2_877" = "1992358294"
"a2_870" = "1942173756"
"a2_871" = "1949339718"
"a2_872" = "1956509066"
"a2_873" = "1963683300"
"a1_349" = "3452958457"
"a1_348" = "2289681282"
"a2_586" = "4201113181"
"a2_587" = "4208278876"
"a2_580" = "4158093043"
"a2_581" = "4165256966"
"a2_582" = "4172420305"
"a2_583" = "4179592887"
"a1_341" = "656546331"
"a1_340" = "2194156392"
"a1_343" = "2920510440"
"a1_342" = "616092712"
"a1_345" = "2769148683"
"a1_344" = "2315813398"
"a1_347" = "105412787"
"a1_346" = "2494547764"
"a2_614" = "106881351"
"a2_615" = "114048823"
"a2_616" = "121219769"
"a2_617" = "128382035"
"a2_610" = "78188517"
"a2_611" = "85373786"
"a2_612" = "92532420"
"a2_613" = "99697962"
"a2_618" = "135547225"
"a2_619" = "142710106"
"a2_272" = "1950006956"
"a2_273" = "1957171537"
"a2_270" = "1935657293"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978674947"
"a2_277" = "1985854900"
"a2_274" = "1964339550"
"a2_275" = "1971505224"
"a2_908" = "2214597475"
"a2_909" = "2221767481"
"a2_278" = "1993021648"
"a2_279" = "2000191190"
"a1_842" = "891058973"
"a2_298" = "2136393501"
"a2_299" = "2143561646"
"a1_841" = "2417231484"
"a2_290" = "2079041884"
"a2_291" = "2086208661"
"a2_292" = "2093377859"
"a2_293" = "2100559056"
"a2_294" = "2107726154"
"a2_295" = "2114893823"
"a2_296" = "2122058168"
"a2_297" = "2129227647"
"a2_728" = "924144597"
"a2_729" = "931316502"
"a2_720" = "866797907"
"a2_721" = "873965786"
"a2_722" = "881132656"
"a2_723" = "888300672"
"a2_724" = "895482969"
"a2_725" = "902650374"
"a2_726" = "909816877"
"a2_727" = "916984238"
"a1_594" = "3331985315"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917644711"
"a2_129" = "924813742"
"a2_126" = "903315065"
"a2_127" = "910486820"
"a2_124" = "888965627"
"a2_125" = "896146119"
"a2_122" = "874627549"
"a2_123" = "881796842"
"a2_120" = "860297281"
"a2_121" = "867460892"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612383727"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "190420972"
"a1_13" = "1472648598"
"a1_10" = "690880632"
"a1_11" = "3293322137"
"a1_16" = "2504481557"
"a1_17" = "1741872907"
"a1_14" = "316240880"
"a1_15" = "1340800129"
"a1_18" = "3909505384"
"a1_19" = "1672389005"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563810"
"a2_48" = "344125943"
"a2_49" = "351284366"
"a1_846" = "2836560885"
"a2_40" = "286755667"
"a2_41" = "293930625"
"a2_42" = "301093408"
"a2_43" = "308281190"
"a2_44" = "315449643"
"a2_45" = "322616157"
"a2_46" = "329783263"
"a2_47" = "336949814"
"a2_897" = "2135731527"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "3856972504"
"a1_656" = "2675446596"
"a1_655" = "1313191807"
"a1_632" = "2014538445"
"a1_653" = "740512035"
"a1_652" = "448857417"
"a1_651" = "960393202"
"a1_650" = "2020057201"
"a3_796" = "1428649909"
"a1_659" = "302718950"
"a1_658" = "1954909527"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233080923"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Aas]
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "2117928850"
"a1_838" = "977249588"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "2514484735"
"a1_906" = "2443821078"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "3957758846"
"a1_902" = "2619063165"
"a1_901" = "2189824702"
"a1_900" = "3106887879"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "289299702"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "2535502766"
"a2_644" = "321952230"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "287679024"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "4236258856"
"a1_879" = "3288925729"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "3390239423"
"a1_128" = "3686959912"
"a1_125" = "1465250064"
"a1_124" = "2711920694"
"a1_127" = "2626188658"
"a1_126" = "1089994224"
"a1_121" = "1891378030"
"a1_120" = "2574213462"
"a1_123" = "2730940199"
"a1_122" = "3790133889"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "3320918688"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "802830843"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "740463619"
"a4_793" = "1390145657"
"a1_836" = "1265233785"
"a1_835" = "3987126442"
"a1_754" = "2023806959"
"a1_834" = "33554010"
"a1_634" = "991545933"
"a2_463" = "3319305391"
"a2_462" = "3312138409"
"a2_461" = "3304970444"
"a2_460" = "3297789806"
"a2_467" = "3347973806"
"a2_466" = "3340808113"
"a2_465" = "3333639742"
"a2_464" = "3326474653"
"a2_469" = "3362323832"
"a2_468" = "3355154691"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014102720141028]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014102720141028\"

[HKCU\Software\Aas]
"a1_934" = "1059624538"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934993193"
"a2_868" = "1927824827"
"a2_867" = "1920657952"
"a2_866" = "1913490729"
"a2_865" = "1906325092"
"a2_864" = "1899157895"
"a2_863" = "1891989088"
"a1_791" = "2017555318"
"a2_861" = "1877640266"
"a2_860" = "1870471317"
"a2_597" = "4279962970"
"a2_596" = "4272788307"
"a2_595" = "4265629523"
"a2_594" = "4258460663"
"a1_338" = "2549323360"
"a1_339" = "1961527901"
"a2_591" = "4236941928"
"a2_590" = "4229775497"
"a1_334" = "1702267061"
"a1_335" = "1231517121"
"a1_336" = "3377574024"
"a1_337" = "3556214466"
"a1_330" = "3568781259"
"a1_331" = "482325975"
"a1_332" = "3767007096"
"a1_333" = "3801280832"
"a2_607" = "56698274"
"a2_606" = "49514359"
"a3_30" = "231909751"
"a2_604" = "35179611"
"a1_64" = "1848299118"
"a2_602" = "20852581"
"a2_601" = "13680090"
"a2_600" = "6510759"
"a4_875" = "1978013579"
"a2_609" = "71029842"
"a2_608" = "63861815"
"a2_265" = "1899822958"
"a2_264" = "1892651362"
"a2_267" = "1914154408"
"a2_266" = "1906988054"
"a2_261" = "1871148964"
"a2_260" = "1863969640"
"a2_263" = "1885472317"
"a2_262" = "1878305941"
"a2_919" = "2293450208"
"a1_908" = "431759486"
"a2_269" = "1928488068"
"a2_268" = "1921319891"
"a1_905" = "3572902485"
"a2_884" = "2042543171"
"a1_482" = "822640233"
"a1_483" = "1500524550"
"a2_289" = "2071873543"
"a2_288" = "2064709443"
"a1_486" = "2414385498"
"a1_487" = "3315946750"
"a1_484" = "3625214431"
"a1_485" = "1097713387"
"a2_283" = "2028857381"
"a2_282" = "2021691266"
"a2_281" = "2014527225"
"a2_280" = "2007358796"
"a2_287" = "2057543125"
"a2_286" = "2050374117"
"a2_285" = "2043192198"
"a2_284" = "2036025252"
"a2_739" = "1003016770"
"a2_738" = "995836489"
"a3_522" = "3725445091"
"a2_733" = "960001387"
"a2_732" = "952834072"
"a2_731" = "945666472"
"a2_730" = "938484992"
"a2_737" = "988668434"
"a2_736" = "981502985"
"a2_735" = "974327972"
"a2_734" = "967170289"
"a4_446" = "3197427966"
"a1_637" = "2872303585"
"a3_912" = "2226582457"
"a1_240" = "3914162598"
"a1_241" = "368054570"
"a1_242" = "1774484204"
"a1_243" = "175122024"
"a1_244" = "1797974462"
"a1_245" = "355368602"
"a1_246" = "1263923946"
"a1_247" = "2461472041"
"a1_248" = "3269589384"
"a1_249" = "427519500"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939149845"
"a2_130" = "931979417"
"a2_133" = "953498032"
"a2_132" = "946328865"
"a2_135" = "967822121"
"a2_134" = "960666833"
"a2_137" = "982159907"
"a2_136" = "974998341"
"a2_139" = "996515579"
"a2_138" = "989333181"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566352891"
"a2_78" = "559186661"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "4051736640"
"a1_583" = "2129314653"
"a1_794" = "1523375491"
"a1_795" = "2555114121"
"a1_792" = "607265700"
"a1_793" = "622712331"
"a1_790" = "4049576728"
"a1_582" = "3826714934"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "442509593"
"a1_798" = "4203925599"
"a1_799" = "3268275063"
"a1_580" = "4084067227"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737942610"
"a1_585" = "458287344"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "3630791528"
"a1_469" = "2926224540"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "960181793"
"a1_461" = "1148107000"
"a1_462" = "952022037"
"a1_463" = "2802472636"
"a1_464" = "875698145"
"a1_465" = "4206667149"
"a1_466" = "2630149676"
"a1_467" = "2271991117"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "3181922729"
"a1_669" = "2494865601"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655395329"
"a3_499" = "3560555322"
"a2_831" = "1662569904"
"a3_498" = "3587059355"
"a2_832" = "1669734026"
"a3_497" = "3579611768"
"a2_833" = "1676903995"
"a3_496" = "3539014105"
"a2_834" = "1684084794"
"a3_495" = "3532029350"
"a2_835" = "1691241294"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698426387"
"a3_493" = "3551077604"
"a2_837" = "1705584645"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a1_837" = "570378655"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "629759545"
"a1_807" = "1208019739"
"a1_804" = "3636065803"
"a1_805" = "1188795335"
"a1_802" = "2455522732"
"a1_803" = "2800577551"
"a1_800" = "1282622299"

"a1_808" = "2041110417"
"a1_809" = "1406868944"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "2496674518"
"a1_939" = "457655956"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407970231"
"a1_875" = "3163683640"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "2877702257"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "318358117"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269120457"
"a2_457" = "3276279918"
"a2_454" = "3254784993"
"a3_380" = "2741212629"
"a2_452" = "3240433860"
"a2_453" = "3247605125"
"a2_450" = "3226102617"
"a2_451" = "3233267900"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283454162"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "161116098"
"a2_852" = "1813121467"
"a1_730" = "4043930088"
"a2_850" = "1798787976"
"a2_851" = "1805955606"
"a2_856" = "1841806907"
"a2_857" = "1848973033"
"a2_854" = "1827456718"
"a1_731" = "2559070254"
"a3_632" = "252486993"
"a2_858" = "1856140101"
"a2_859" = "1863305469"
"a1_732" = "3287444263"
"a2_714" = "823776337"
"a1_733" = "1366999458"
"a1_329" = "785419687"
"a1_328" = "58421606"
"a1_327" = "3704482141"
"a1_326" = "441069535"
"a1_325" = "1726273520"
"a1_324" = "2549304336"
"a1_323" = "1487933917"
"a1_322" = "548350834"
"a1_321" = "2559556630"
"a1_320" = "3389383013"
"a2_650" = "364969653"
"a1_436" = "2043315305"
"a1_736" = "3122014302"
"a3_631" = "211878206"
"a1_737" = "1484754939"
"a2_652" = "379305469"
"a3_923" = "2339079058"
"a2_926" = "2343633253"
"a2_927" = "2350799720"
"a2_924" = "2329302137"
"a2_653" = "386470802"
"a4_887" = "2064043031"
"a2_923" = "2322134693"
"a2_920" = "2300619615"
"a2_921" = "2307800285"
"a2_654" = "393638425"
"a2_928" = "2357971658"
"a2_655" = "400816124"
"a3_630" = "204893343"
"a2_657" = "415138054"
"a3_922" = "2298015603"
"a1_495" = "3809655613"
"a1_494" = "918592625"
"a1_497" = "3112773891"
"a1_496" = "2738932213"
"a1_491" = "3462732373"
"a1_490" = "2646953214"
"a1_493" = "2936499404"
"a1_492" = "904982353"
"a1_499" = "713531207"
"a1_498" = "936631416"
"a3_637" = "288468852"
"a2_708" = "780764971"
"a2_709" = "787946373"
"a2_706" = "766430039"
"a2_707" = "773598860"
"a2_704" = "752095395"
"a2_705" = "759264771"
"a2_702" = "737763246"
"a2_703" = "744927408"
"a2_700" = "723411110"
"a2_701" = "730579975"
"a4_885" = "2049704789"
"a2_638" = "278936613"
"a2_639" = "286103823"
"a3_808" = "1481095169"
"a2_632" = "235917742"
"a2_633" = "243084514"
"a2_630" = "221581794"
"a2_631" = "228749432"
"a2_636" = "264585767"
"a2_637" = "271769598"
"a2_634" = "250264041"
"a2_635" = "257417644"
"a1_253" = "355900562"
"a1_252" = "4232910245"
"a1_251" = "3021001579"
"a1_250" = "1041972260"
"a1_257" = "2709353532"
"a1_256" = "792825301"
"a1_255" = "923011917"
"a1_254" = "626768204"
"a3_920" = "2284050097"
"a1_259" = "1875198808"
"a1_258" = "1450553241"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032344243"
"a2_145" = "1039519340"
"a2_146" = "1046682264"
"a2_147" = "1053867008"
"a2_140" = "1003682787"
"a2_141" = "1010847873"
"a2_142" = "1018016670"
"a2_143" = "1025182736"
"a1_781" = "87736641"
"a1_780" = "2741905910"
"a2_68" = "487491929"
"a2_69" = "494671255"
"a2_148" = "1061032568"
"a2_149" = "1068201707"
"a1_787" = "891523809"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a1_904" = "560478405"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "1917062671"
"a1_478" = "593096784"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "1538648048"
"a1_472" = "1969960577"
"a1_471" = "1704700105"
"a1_470" = "3475807829"
"a1_477" = "1893215245"
"a1_476" = "451385966"
"a1_475" = "1350642686"
"a1_474" = "4052794068"
"a4_533" = "3821141493"
"a1_679" = "128087289"
"a1_678" = "1497692095"
"a4_532" = "3813972372"
"a1_675" = "1327746541"
"a1_674" = "767329593"
"a1_677" = "731321810"
"a1_676" = "3255417754"
"a1_671" = "2289201513"
"a4_531" = "3806803251"
"a1_673" = "1217235799"
"a1_672" = "3433538437"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a1_868" = "526065215"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_984" = "2776284913"
"a2_151" = "1082532633"
"a2_150" = "1075365688"
"a1_869" = "145003036"
"a2_271" = "1942838758"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "107475047"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139872662"
"a4_758" = "1139226422"
"a2_158" = "1132717410"
"a1_925" = "2911658932"
"a1_924" = "306975313"
"a1_927" = "2388530541"
"a1_926" = "4189658509"
"a1_921" = "31294796"
"a1_920" = "2856415913"
"a3_787" = "1363737626"
"a1_922" = "1363880166"
"a3_80" = "590099577"
"a1_929" = "3021142623"
"a1_928" = "1689381886"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "3947468300"
"a1_818" = "2470641218"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "698648092"
"a1_810" = "2355474320"
"a1_813" = "3871307094"
"a1_812" = "2809499749"
"a1_815" = "1115145872"
"a1_814" = "793408690"
"a1_817" = "2656830297"
"a1_816" = "285919360"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454665336"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"

[HKCU\Software\Aas\695404737]
"50183847" = "31A3F08575516963CF600FD24D1E42B121C858023A008E530EE8AE0357CA2B963062D64AC958C1A70F7D89BC940B96490928D04696263F96215C45832789E7B48C22A5AA92DC925D8B9BC1B7D8C632DADB5A9D1DA001C0EE092508B3F990883DC81C8743B0D6A7305D37F80F86B73F87308A47CBC84E060F3AE159AB9FDB306F"

[HKCU\Software\Aas]
"a2_845" = "1762937658"
"a2_844" = "1755773606"
"a2_847" = "1777272932"
"a2_846" = "1770103125"
"a2_841" = "1734271352"
"a2_840" = "1727088215"
"a2_843" = "1748603568"
"a2_842" = "1741423125"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791622738"
"a2_848" = "1784454433"
"a1_312" = "138878086"
"a1_313" = "155534379"
"a1_310" = "3925819848"
"a1_311" = "1450335339"
"a1_316" = "3452110432"
"a1_317" = "407064644"
"a1_314" = "90908467"
"a1_315" = "2337309290"
"a3_620" = "166490309"
"a1_318" = "45571408"
"a1_319" = "2253245837"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218936189"
"a2_448" = "3211770891"
"a3_621" = "140449124"
"a2_441" = "3161584483"
"a2_440" = "3154421426"
"a2_443" = "3175919217"
"a2_442" = "3168753041"
"a2_445" = "3190254205"
"a2_444" = "3183085290"
"a2_447" = "3204601960"
"a2_446" = "3197434834"
"a2_939" = "2436860332"
"a2_938" = "2429669638"
"a4_893" = "2107057757"
"a2_931" = "2379486553"
"a2_930" = "2372320618"
"a2_933" = "2393819947"
"a2_932" = "2386645379"
"a2_935" = "2408153233"
"a2_934" = "2400985345"
"a2_937" = "2422505429"
"a2_936" = "2415336330"
"a3_818" = "1552537563"
"a2_711" = "802280736"
"a2_710" = "795113912"
"a2_713" = "816612807"
"a2_712" = "809448123"
"a2_715" = "830949228"
"a1_510" = "1543632673"
"a2_717" = "845296957"
"a2_716" = "838117009"
"a2_719" = "859622516"
"a2_718" = "852467044"
"a1_587" = "1754401074"
"a3_623" = "187965990"
"a2_629" = "214414556"
"a2_628" = "207234583"
"a2_625" = "185731642"
"a2_624" = "178565416"
"a2_627" = "200080209"
"a2_626" = "192900407"
"a2_621" = "157050040"
"a2_620" = "149883984"
"a2_623" = "171404254"
"a2_622" = "164233033"
"a1_266" = "312894421"
"a1_267" = "4102287462"
"a1_264" = "295341847"
"a1_265" = "2161025332"
"a1_262" = "426773272"
"a1_263" = "3260264987"
"a1_260" = "3654871387"
"a1_261" = "3896077141"
"a1_268" = "2319326"
"a1_269" = "3843196767"
"a2_157" = "1125558799"
"a2_156" = "1118375638"
"a2_155" = "1111219172"
"a2_154" = "1104049861"
"a2_153" = "1096869553"
"a2_152" = "1089715282"
"a2_99" = "709751252"
"a2_98" = "702576009"
"a2_97" = "695407418"
"a2_96" = "688242165"
"a2_95" = "681057490"
"a2_94" = "673892627"
"a2_93" = "666725363"
"a2_92" = "659556643"
"a2_91" = "652381526"
"a2_90" = "645225784"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "3387069949"
"a1_847" = "1689301853"
"a3_404" = "2913010493"
"a1_844" = "30812530"
"a3_405" = "2886510428"
"a1_845" = "1030950422"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_862" = "1884809094"
"a4_983" = "2752278647"
"a1_961" = "1610155535"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "4293246068"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "1799560682"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "2424081258"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "3893200793"
"a1_449" = "2314066803"
"a1_446" = "1128323459"
"a3_408" = "2941554865"
"a1_444" = "1114920761"
"a1_445" = "3801855415"
"a1_442" = "1983509807"
"a1_443" = "798052197"
"a1_440" = "4237118466"
"a3_409" = "2949002448"
"a1_680" = "630225907"
"a1_681" = "893273522"
"a1_682" = "1337824980"
"a1_683" = "674351472"
"a2_561" = "4021871268"
"a1_685" = "2731463896"
"a1_686" = "3536021430"
"a1_687" = "1307446257"
"a1_688" = "4039588380"
"a1_689" = "575424190"

"a3_834" = "1700949547"
"a1_767" = "1240151750"
"a1_766" = "2660155747"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294297040"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "2685655622"
"a2_605" = "42346475"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "3609249041"
"a2_603" = "28011717"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "1213439239"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "1985369167"
"a1_441" = "628798627"
"a4_964" = "2616065348"
"a1_744" = "2281674487"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250431590"
"a1_747" = "1444043813"
"a2_912" = "2243265759"

"a2_651" = "372135336"
"a2_910" = "2228930900"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "264"

[HKCU\Software\Aas]
"a2_917" = "2279119156"
"a4_883" = "2035366547"
"a2_509" = "3649081122"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "1626145401"
"a1_867" = "2211599746"
"a1_860" = "3127310585"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Aas]
"a1_862" = "2138364871"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "4086570976"
"a2_918" = "2286282177"
"a4_168" = "1204412328"
"a1_194" = "1904179933"
"a1_195" = "949401949"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287117651"
"a1_192" = "2208539062"
"a1_193" = "2732991854"
"a1_969" = "1795501412"
"a4_934" = "2400991718"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "1932296827"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a3_505" = "3603458416"
"a1_305" = "4035563559"
"a1_304" = "2818464868"
"a1_307" = "2296559229"
"a1_306" = "753120703"
"a1_301" = "1000641814"
"a1_300" = "150772530"
"a1_303" = "4100619166"
"a1_302" = "3426227285"
"a3_792" = "1399711281"
"a1_309" = "3707788105"
"a1_308" = "4140735246"
"a2_540" = "3871320533"
"a2_541" = "3878501194"
"a2_542" = "3885671697"
"a1_481" = "1703819308"
"a2_544" = "3900002531"
"a2_545" = "3907170172"
"a2_546" = "3914336546"
"a2_547" = "3921500304"
"a2_548" = "3928685705"
"a2_549" = "3935851458"
"a2_894" = "2114228843"
"a2_895" = "2121396936"
"a2_892" = "2099894411"
"a2_893" = "2107049916"
"a2_890" = "2085545348"
"a2_891" = "2092714737"
"a2_438" = "3140068721"
"a2_439" = "3147251168"
"a2_434" = "3111390693"
"a2_435" = "3118565705"
"a2_436" = "3125728611"
"a2_437" = "3132899343"
"a2_430" = "3082719108"
"a2_431" = "3089885908"
"a2_432" = "3097067111"
"a2_433" = "3104235245"
"a2_948" = "2501355927"
"a2_949" = "2508522726"
"a4_908" = "2214594572"
"a2_944" = "2472688343"
"a2_945" = "2479854475"
"a2_946" = "2487022653"
"a2_947" = "2494188260"
"a2_940" = "2444004892"
"a1_488" = "3793141565"
"a2_942" = "2458338959"
"a2_943" = "2465519762"
"a1_279" = "526077672"
"a1_278" = "2828224814"
"a1_489" = "1455677569"
"a1_271" = "4258684662"
"a1_270" = "654164031"
"a1_273" = "4159732268"
"a1_272" = "208778665"
"a1_275" = "764143758"
"a1_274" = "564586124"
"a1_277" = "2169486556"
"a1_276" = "2203516101"
"a2_764" = "1182238316"
"a2_765" = "1189405291"
"a2_766" = "1196574473"
"a2_767" = "1203742954"
"a2_760" = "1153557039"
"a2_761" = "1160739050"
"a2_762" = "1167908778"
"a2_763" = "1175075828"
"a2_768" = "1210923935"
"a2_769" = "1218062208"
"a2_382" = "2738607661"
"a2_383" = "2745775049"
"a2_380" = "2724260008"
"a2_381" = "2731441571"
"a2_386" = "2767277429"
"a2_387" = "2774442525"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_385" = "2760108035"
"a2_388" = "2781610634"
"a2_389" = "2788792585"
"a1_613" = "843350550"
"a1_612" = "139775354"
"a1_611" = "681209151"
"a2_368" = "2638238591"
"a2_369" = "2645407850"
"a1_610" = "1544270736"
"a2_88" = "630888845"
"a2_89" = "638057114"
"a2_84" = "602208245"
"a2_85" = "609370446"
"a2_86" = "616541779"
"a2_87" = "623708802"
"a2_80" = "573523923"
"a2_81" = "580705169"
"a2_82" = "587859612"
"a2_83" = "595044446"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161401323"
"a2_163" = "1168569725"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190071209"
"a2_167" = "1197235853"
"a2_164" = "1175739214"
"a2_165" = "1182902962"
"a3_690" = "668723035"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "2313626849"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "2484264107"
"a1_450" = "2219188792"
"a1_453" = "284853347"
"a1_452" = "89641869"
"a1_455" = "3151848026"
"a1_454" = "4163600943"
"a1_457" = "4236680100"
"a1_456" = "3194961268"
"a1_459" = "3968292646"
"a1_458" = "1457911036"
"a1_693" = "1242442939"
"a1_692" = "461664616"
"a1_691" = "3800468847"
"a1_690" = "1440532681"
"a1_697" = "511146807"
"a1_696" = "2109555296"
"a1_695" = "2430664472"
"a1_694" = "3151372348"
"a1_699" = "2049674884"
"a1_698" = "2986130597"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "2440517961"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "2114262233"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "3579985969"
"a4_387" = "2774449827"
"a1_940" = "1192809517"
"a1_752" = "2035936734"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537689876"
"a2_74" = "530520389"
"a1_763" = "4160922946"
"a2_77" = "552015188"
"a2_76" = "544855178"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509002425"
"a2_70" = "501836983"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523352684"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "987378175"
"a1_876" = "1018549411"
"a4_759" = "1146395543"
"a2_72" = "516167781"
"a1_873" = "666672509"
"a1_872" = "1236239932"
"a1_871" = "1281534046"
"a1_870" = "1558562434"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "2772785457"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "3432611154"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "2566446767"
"a1_437" = "3583942569"
"a3_960" = "2604335593"
"a2_553" = "3964532070"
"a2_552" = "3957353987"
"a2_551" = "3950186617"
"a2_550" = "3943019013"
"a2_557" = "3993206008"
"a2_556" = "3986039251"
"a2_555" = "3978855783"
"a2_554" = "3971688197"
"a2_889" = "2078389325"
"a2_888" = "2071210159"
"a2_559" = "4007540024"
"a2_558" = "4000374467"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075550999"
"a2_428" = "3068380275"
"a2_427" = "3061216752"
"a2_426" = "3054050003"
"a2_425" = "3046879296"
"a2_424" = "3039713490"
"a2_423" = "3032531479"
"a2_422" = "3025366145"
"a2_421" = "3018197738"
"a2_420" = "3011032481"
"a1_758" = "2053441123"
"a2_565" = "4050558888"
"a4_984" = "2759447768"
"a2_959" = "2580225331"
"a2_958" = "2573056332"
"a2_957" = "2565875048"
"a2_956" = "2558705761"
"a2_955" = "2551541428"
"a2_954" = "2544382798"
"a1_785" = "3479830735"
"a2_952" = "2530037871"
"a2_951" = "2522828544"
"a2_950" = "2515691369"
"a1_208" = "3165335294"
"a1_209" = "3707052303"
"a1_204" = "1694930736"
"a1_205" = "2189632144"
"a1_206" = "607433049"
"a1_207" = "2904330752"
"a1_200" = "975180197"
"a1_201" = "1896226031"
"a1_202" = "324869075"
"a1_203" = "749317559"
"a2_777" = "1275441282"
"a2_776" = "1268275275"
"a2_775" = "1261093360"
"a2_774" = "1253926385"
"a2_773" = "1246758451"
"a2_772" = "1239588947"
"a2_771" = "1232423872"
"a2_770" = "1225258600"
"a2_779" = "1289776740"
"a2_778" = "1282611024"
"a2_395" = "2831809924"
"a2_394" = "2824628999"
"a2_397" = "2846143066"
"a2_396" = "2838979259"
"a2_391" = "2803124582"
"a2_390" = "2795948993"
"a2_393" = "2817459141"
"a2_392" = "2810292537"
"a2_399" = "2860468744"
"a2_398" = "2853344281"
"a2_568" = "4072057141"
"a2_569" = "4079224254"
"a2_379" = "2717090843"
"a2_378" = "2709918797"
"a2_373" = "2674089020"
"a2_372" = "2666907403"
"a2_371" = "2659738125"
"a2_370" = "2652583109"
"a2_377" = "2702766170"
"a2_376" = "2695591999"
"a2_375" = "2688423044"
"a2_374" = "2681254719"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283272949"
"a2_178" = "1276108347"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254588569"
"a2_174" = "1247421256"
"a2_177" = "1268939290"
"a2_176" = "1261772227"
"a2_171" = "1225921172"
"a2_170" = "1218753984"
"a2_173" = "1240256226"
"a3_249" = "1801832560"
"a4_960" = "2587388864"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Aas]
"a1_511" = "3809559587"
"a1_512" = "935756383"
"a1_513" = "3487605981"
"a1_514" = "2553172479"
"a1_515" = "3975317650"
"a1_516" = "461962203"
"a1_517" = "4065357016"
"a1_518" = "3135740819"
"a1_519" = "824303731"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "2207464359"
"a3_514" = "3667976427"
"a2_543" = "3892837172"
"a1_424" = "3613721878"
"a1_425" = "2545075527"
"a1_426" = "2284577214"
"a1_427" = "3827074681"
"a1_420" = "965518725"
"a1_421" = "389258039"
"a1_422" = "1203502783"
"a1_423" = "2901891739"
"a3_199" = "1409969486"
"a1_428" = "3213566839"
"a1_429" = "871833300"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623240291"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "3453529561"
"a1_739" = "515763290"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "2679447645"
"a2_915" = "2264783274"
"a1_865" = "2782876572"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_861" = "4096106659"
"a1_863" = "802517837"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014102720141028]
"CacheLimit" = "8192"

[HKCU\Software\Aas]
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"

"a4_871" = "1949337095"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "198298082"
"a1_849" = "381987841"
"a1_439" = "1562786073"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450989056"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "2275861579"
"a1_199" = "352741950"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "4274987917"
"a4_145" = "1039522545"
"a1_190" = "1566024743"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752277008"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "3222864333"
"a1_663" = "2180349977"
"a3_965" = "2639793036"
"a1_660" = "2292973994"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "3091158752"
"a1_664" = "1764133255"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "1428016293"
"a1_0" = "2514730635"
"a1_1" = "4004069688"
"a1_2" = "2176320953"
"a1_3" = "1379181547"
"a1_4" = "3165243369"
"a1_5" = "3041985694"
"a1_6" = "1121826769"
"a1_7" = "950956472"
"a1_8" = "3683744053"
"a1_9" = "1523905588"
"a2_566" = "4057725933"
"a2_567" = "4064890546"
"a2_564" = "4043390297"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029040212"
"a2_563" = "4036222201"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953686141"
"a2_413" = "2960838990"
"a2_410" = "2939343961"
"a2_411" = "2946511060"
"a2_416" = "2982347693"
"a2_417" = "2989528230"
"a2_414" = "2968024847"
"a2_415" = "2975182666"
"a2_418" = "2996698409"
"a2_419" = "3003864612"
"a2_962" = "2601724532"
"a2_963" = "2608892520"
"a2_960" = "2587390176"
"a2_961" = "2594555799"
"a2_966" = "2630409089"
"a2_967" = "2637577233"
"a2_964" = "2616058071"
"a4_950" = "2515697654"
"a1_631" = "710021938"
"a2_968" = "2644744543"
"a2_969" = "2651908406"
"a4_564" = "4043384244"
"a1_219" = "3528044454"
"a1_218" = "2599751648"
"a1_217" = "745062731"
"a1_216" = "2560251748"
"a1_215" = "2993026842"
"a1_214" = "15130541"
"a1_213" = "4238431212"
"a1_212" = "2681335087"
"a1_211" = "2023350734"
"a1_210" = "2485353931"
"a4_567" = "4064891607"
"a1_630" = "1868386054"
"a2_980" = "2730777860"
"a4_560" = "4014707760"
"a2_982" = "2745110973"
"a4_956" = "2558712380"
"a2_984" = "2759445826"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "2336091497"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
0a26887f783d5a6d3819660b1a89ab76 c:\vretii.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name: Application Setup
Product Version: 1.41.4.2
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.41.4.2
File Description: Application Setup
Comments:
Language: Spanish (Spain, International Sort)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
8WMyi27H 4096 688128 0 0 d41d8cd98f00b204e9800998ecf8427e
VxfhqYjV 692224 323584 323584 5.54435 164ef9b99924a9bef5d918449b84af69
.rsrc 1015808 98304 98304 5.40053 359f625b61b42497d80099143c6f5ea1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://softonic-analytics.net/blank.gif?product=st_activity&event=window:app:loaded&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&params={"api_version":"1.41.4","country":"us","flavour":"2","id_file":"65249","machine_id":"a8a67a25000000000000000c298a8b37","os":"[OS:2600,5,1,2,1,256,3,0,Service Pack 3]","ts":"1414396778","url":"hxxp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch","user_agent":"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4"}
hxxp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch 46.28.209.70
hxxp://hair-master.sd.softonic.fr/js/generated/e07eb-ab7f5.js 46.28.209.70
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=1814690754&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=2013811550&utmr=-&utmp=/65249/universaldownloader-prefetch&utmht=1414396784697&utmac=UA-48247475-1&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_session&event=prefetch:session:create&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&ab_test=&download_date=1414396767&execution_date=1414396787681&client_timezone=2&api_version=1.41.4&id_machine=a8a67a25000000000000000c298a8b37&id_user=B66E8494-AE49-4553-831E-E37A7618A695&os=WindowsXP&default_browser=iexplorer&default_browser_version=6.0.2900.5512&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=300&id_file=65249&id_section=94&id_main_section=94
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&default_rpm=320&campaign_id=100710&default_rpm=1491&campaign_id=100709&default_rpm=1596&campaign_id=100708&default_rpm=510&campaign_id=100516&default_rpm=1205&campaign_id=50701&default_rpm=1&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&excluded=0&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&excluded=0&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&id_campaign=101363&id_campaign=100710
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j30&a=2013811550&t=pageview&_s=1&dl=http://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch&ul=en-us&de=utf-8&dt=Téléchargement et installation de Hair Master&sd=32-bit&sr=1276x846&vp=650x450&je=0&fl=11.6 r602&_utma=44451261.1524841092.1414396784.1414396784.1414396784.1&_utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&_utmht=1414396788025&_u=MQACAEAAI~&jid=1730105865&cid=1524841092.1414396784&tid=UA-48247475-3&_r=1&z=50426474
hxxp://hair-master.sd.softonic.fr/universaldownloader-track 46.28.209.70
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=1293&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=134&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://c.global-ssl.fastly.net/nr-476.min.js
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784 46.28.209.70
hxxp://hair-master.sd.softonic.fr/css/generated/fad58-b4c72.css 46.28.209.70
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100710/sd_100710_46b91.jpg
hxxp://screenshots.fr.sftcdn.net/fr/scrn/65000/65249/hair-master-19.jpg 46.28.209.55
hxxp://hair-master.sd.softonic.fr/shared/img/sd_client/gradientbg.png 46.28.209.70
hxxp://hair-master.sd.softonic.fr/shared/img/sd_client/loading.gif 46.28.209.70
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101363/sd_101363_400c1.jpeg
hxxp://hair-master.sd.softonic.fr/shared/img/sd_client/sprite.png 46.28.209.70
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1636295462&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=-&utmp=/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784&utmht=1414396789884&utmac=UA-48247475-1&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1749760115&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1414396789963&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=897717982&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1414396789978&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=679004254&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1414396790041&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100710/sd_100710_46b91.jpg?v=0.9219147022042804
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=1932323225&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1414396790056&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1740459931&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/C101363--load1&utmht=1414396790088&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1840762859&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/C100710--load2&utmht=1414396790103&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://partnerad.l.doubleclick.net/gpt/pubads_impl_52.js
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-0/html/container.html
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1740459931&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/C101363--load1&utmht=1414396790088&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://js-agent.newrelic.com/nr-476.min.js 23.235.44.175
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-1&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-1&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-3&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-2&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-2&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1130&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=897717982&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1414396789978&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://sd.softonic-analytics.net/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&id_campaign=101363&id_campaign=100710 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-3&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-1&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=679004254&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1414396790041&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://tpc.googlesyndication.com/safeframe/1-0-0/html/container.html
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-2&sc_type=ns&met=true&sd_flag=1 46.28.209.74
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=1814690754&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=2013811550&utmr=-&utmp=/65249/universaldownloader-prefetch&utmht=1414396784697&utmac=UA-48247475-1&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=1932323225&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1414396790056&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1131&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-3&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1239&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1259&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://static.sd.softonic.fr/js/generated/e07eb-ab7f5.js 46.28.209.70
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&default_rpm=320&campaign_id=100710&default_rpm=1491&campaign_id=100709&default_rpm=1596&campaign_id=100708&default_rpm=510&campaign_id=100516&default_rpm=1205&campaign_id=50701&default_rpm=1&sd_flag=1 46.28.209.74
hxxp://static.sd.softonic.fr/shared/img/sd_client/sprite.png 46.28.209.70
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1131&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=134&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 46.28.209.74
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js 74.125.226.121
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1749760115&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1414396789963&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1259&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1124&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1132&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1130&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_session&event=prefetch:session:create&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&ab_test=&download_date=1414396767&execution_date=1414396787681&client_timezone=2&api_version=1.41.4&id_machine=a8a67a25000000000000000c298a8b37&id_user=B66E8494-AE49-4553-831E-E37A7618A695&os=WindowsXP&default_browser=iexplorer&default_browser_version=6.0.2900.5512&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=300&id_file=65249&id_section=94&id_main_section=94 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=1293&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1124&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://www.google-analytics.com/analytics.js
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-1&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-2&sc_type=ns&met=true&sd_flag=1 46.28.209.74
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1636295462&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=-&utmp=/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784&utmht=1414396789884&utmac=UA-48247475-1&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://static.sd.softonic.fr/css/generated/fad58-b4c72.css 46.28.209.70
hxxp://static.sd.softonic.fr/shared/img/sd_client/gradientbg.png 46.28.209.70
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&excluded=0&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1239&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://static.sd.softonic.fr/shared/img/sd_client/loading.gif 46.28.209.70
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-3&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&excluded=0&sd_flag=1 46.28.209.74
hxxp://www.googletagservices.com/tag/js/gpt.js 74.125.226.122
hxxp://partner.googleadservices.com/gpt/pubads_impl_52.js 173.194.43.89
hxxp://www.google-analytics.com/r/collect?v=1&_v=j30&a=2013811550&t=pageview&_s=1&dl=http://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch&ul=en-us&de=utf-8&dt=Téléchargement et installation de Hair Master&sd=32-bit&sr=1276x846&vp=650x450&je=0&fl=11.6 r602&_utma=44451261.1524841092.1414396784.1414396784.1414396784.1&_utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&_utmht=1414396788025&_u=MQACAEAAI~&jid=1730105865&cid=1524841092.1414396784&tid=UA-48247475-3&_r=1&z=50426474
hxxp://sd.softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1132&sc_type=ns&met=false&sd_flag=1 46.28.209.74
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1840762859&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/C100710--load2&utmht=1414396790103&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /gpt/pubads_impl_52.js HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: partner.googleadservices.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Mon, 13 Oct 2014 09:22:11 GMT
Date: Fri, 24 Oct 2014 12:36:12 GMT
Expires: Sat, 24 Oct 2015 12:36:12 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 32815
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 242616
Alternate-Protocol: 80:quic,p=0.01
......n.....w..F.8..^...#..."......l.%q.%.Q.>.FR."@..|...l...m.>
......:;3;.N..(.L'.sw...#v...A.8.t.w..I..O....x....|.B#.s.bQ.......,..
.....5./.(.. t.......$..$.lG.9.uD[.......H..L....D..ug.i>.6.|z.....
.......tD....L..u.z...d.J..;.k..&.q...C...%.^......8I..$.v..l6.D..T..,
...o.c.8..p.yw..lKTf9.s.;.J...om.8...m..}.......V.(K.e.d.y|....L..J...
]...Z.........7...K.v"....!LT. .K.Vy..u.g.... ...[.v.....3$.....*.....
|'.00s.W... .M..<9_..s..e........;.p .........<h...?..H...F...F.
6wC8L..{.3&y.=.X/......?.^o.....M...P...,F..t.......gY.a.j=. P,...._..
.d.A...E,..p...Y..[].fL..].M.u....<....^kgS..j...gr........d;... ..
.].}.}-..{..D[....Y.P .-.rX.\.Q...L...r'v..$:...Y.\._.....fv......?...
N.......wv.....i...........<.....}..U}mGx.D...a....{...7I..#3...p..
.Q>...R.,....z..:;QW......v..XC.........t!Q..........f.~r..hx:.Q.l.
......C. !.<tn..|...K|.u..*f.d..%..g.z.....Q..?6gm..I`.Xd.tL...a..g
Z......eg7.......'YN..0..eyF.......<..p.EM......c...o..qg.E{\]Z.@..
..,.Z.L...V2..]>..p.Us....1.(...l-..3..2...U3_a......{ku_c..<xZ.
....\ pC..._...e<...)....~....~.....k....7...Bpk...~..>..u.....\
....N.. .....?...BW..].wrm<.@...."...I........G....r.y...x...m.. ..
.jn^pf..D4..a.w..K.vJ.!....p..|~..MG.................-..A....{.ri.....
|:~......I.*...fk..........m...j:.g...`.....;.-$...l.U.&.6HWp4..w.v..?
~.....&.t...A..m.E.p:.&..$..k.["v...C..q.".....Q..:>`.|1.=5.Qu.cs..
.,...3...]7.........np..Yv..Cn.._r.XtJ<....{.,.`....).'..`pN.9.s...
.i>...e0D....u...(.~V..[.G......\w...a{...ga..5W.u.*j.Z......{_
<<< skipped >>>


GET /shared/img/sd_client/sprite.png HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: static.sd.softonic.fr
Connection: Keep-Alive
Cookie: _FCfr=100516||.100709||.100710|1|1414396787.101363|1|1414396787; _ga=GA1.2.1524841092.1414396784; _gat=1


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:46 GMT
Server: Apache
Last-Modified: Thu, 29 May 2014 10:13:26 GMT
Accept-Ranges: bytes
Content-Length: 7892
Cache-Control: max-age=172800
Expires: Wed, 29 Oct 2014 07:59:46 GMT
Keep-Alive: timeout=3, max=10
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE..............
......................................................................
...............................................h......................
.f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R.
.............>....:n........M..].T*..:.....m....tV.....]........7..
..Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H.
.I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v
...B:[email protected]..>/g..m..p..i...<..=.z:.g.;b..z:[email protected]?[ZW
.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.
)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..
'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...
................*................>.j.....tRNS......................
......................................................................
......................................................................
......................................................................
.............~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks 
CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w.
.bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>[email protected]\..
fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}...
...r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac...
....jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C..
..................(.Jro.P............wqo....7....<...7*.z......
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:45 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1124&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1259&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1130&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=134&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&id_campaign=101363&id_campaign=100710 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1131&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-2&sc_type=ns&met=true&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1239&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1124&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /__utm.gif?utmwv=5.4.6&utms=1&utmn=1814690754&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=2013811550&utmr=-&utmp=/65249/universaldownloader-prefetch&utmht=1414396784697&utmac=UA-48247475-1&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291177
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 23 Oct 2014 23:06:45 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 291177..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;....


GET /r/collect?v=1&_v=j30&a=2013811550&t=pageview&_s=1&dl=http://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch&ul=en-us&de=utf-8&dt=Téléchargement et installation de Hair Master&sd=32-bit&sr=1276x846&vp=650x450&je=0&fl=11.6 r602&_utma=44451261.1524841092.1414396784.1414396784.1414396784.1&_utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&_utmht=1414396788025&_u=MQACAEAAI~&jid=1730105865&cid=1524841092.1414396784&tid=UA-48247475-3&_r=1&z=50426474 HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Mon, 27 Oct 2014 07:59:45 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Mon, 27 Oct 2014 07:59:45 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.002..GIF89a......
.......,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=2&utmn=1636295462&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=-&utmp=/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784&utmht=1414396789884&utmac=UA-48247475-1&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=897717982&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1414396789978&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=1932323225&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1414396790056&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=1840762859&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/C100710--load2&utmht=1414396790103&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 23 Oct 2014 23:06:45 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 291182..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;..



GET /65249/universaldownloader-prefetch HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: hair-master.sd.softonic.fr
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:37 GMT
Server: Apache
Set-Cookie: sd_client_fr-admin=deleted; expires=Sun, 27-Oct-2013 07:59:36 GMT; path=/; domain=sd.softonic.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Vary: Accept-Language,Accept-Encoding
Content-Encoding: gzip
Content-Length: 8825
Keep-Alive: timeout=3, max=10
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
...........}.~......S`...3.@..%..:.3..l.vf.......D.@.(......q_.....b'.
.b...1.wuu.].~.u.f.....J.d.Ko.=}.|[email protected]/%..K'...^....W...
eI.%..S....W...0.VO...8...y...zV....?|D'...Al...h....,.v0..A$c.N.{....
.....b'.&..\N.%'.".~.?..T~..{...W^...{uu...5..j..m.D}'.....]L<.#.6t
...........f.y....,y..n.....~D..z......u*.F.@....)............I..ikF.&
a....|.M....V........tX"....i..v#.L#.!|.v.:.B-...y-N%....,..-......BT.
-_.....f.......`...........j..\.....n_tzy.....\.(...Vg..v....x........
.........)6.8R5...>v........=......A.5..3...i/9.A...T..0...........
z.Y.....1s.p....fa..52.........8.....H.wb.O>..6~:...D.....-....pH..
.Y."..XV.D...(..3(..-r|.l$.O5B.q.u.1........m......i1.Mt9s.8e..D.L.H.z
[email protected]..^8d.c.Su.HuF..u.~..8...x.hQ C..xc.....v......5.j?...'#/.B
....1.SU;[[email protected].....=$Vru%[email protected]..... .l...K.....M!.h.8.F.yw.."....b
..E:O...].)#...ed..OdU..W.*.p....eP.P....24...Z0Q&.....4"q..X[........
.....CZ.tqk.Q..K..-..M....({....J....(uU..1.H./9Mc.6.2.....x..W..G FH.
....L.0.qW...,O...T....=X......F.#)%... vv,C.A.6.[. .#..n .C....H]....
.o..lo;.u.........x.t....9vXO....G.NC.uZ.........i"..>...t...`....1
.......?.Q 4n..^......,.[.[M..8.D.KO5.,....,...h(...J... L.**#....H..d
............`.. .7.$.7g..."....rC....nO\......zMH.\*. S.jl.a*.. ......
T.uD.u`>...s...Qq...s..D...>?..s]w..R.\[email protected]..<..
p..L&.mf...Qy.......a..,Y.....J`...b;...q8.j...u.U..S...3.%@..*.P._..C
.U...u......KPF...`J`.Z.h/p...6......!j...........Z.....,2b...xL!=..u.
...?G.T....^r].8^_......P... .._....p?<..9.....<..-....S.\'.
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=1293&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /campaign/scrn/100000/100710/sd_100710_46b91.jpg HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: screenshots.en.sftcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 20 Feb 2014 09:16:17 GMT
Cache-Control: max-age=172800
Content-Type: image/jpeg
Content-Length: 55511
Accept-Ranges: bytes
Date: Mon, 27 Oct 2014 07:59:46 GMT
Connection: keep-alive
Age: 0
X-Served-By: screenshots
X-Cache: HIT
X-Cache-Hits: 27489
Expires: Wed, 29 Oct 2014 07:59:46 GMT
......JFIF.....%.%.....C..............................................
......................C...............................................
..........................|...........................................
...p...........................!..1A...Qaq.."RT....2SV...........$&'38
Ur....#46BXfvw...%(CDFHWb.....)5gsu..7G...............................
.........c........................!..1.AQ..."aq2R.......#ST.....3BU...
$Kd....&56CDcerstu.....EVv....FW...............?........T.I$.e.QC...
..&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY.
..*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.... yn.2<..3..
#....n...(.u .......O{wtRY...M%.6.........$f. ..Y.....M.].._G....D....
$..D.>H....=......F*....U...6p[.......pE..J...k3.d.>..r..RAR....
F..%.:..............}7D.{..h...qu..{}e&.n..i..b..au..&.5...yd....BM...
.m..>....>....(4....p.]...,.g....a`k...Xn......k.J........5...r.
K....J.'..R....`....`..|.~.~I?..=~.......5|.z.....n..R.kMHi.<.>.
.....)...*1P|....Kv2 ......x{}.{..{.dSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJS
JSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJV..........h..K..
. (A...Y..;!grU]DC3n.Rn.....t.....Z.T.vA...G...E.......kz..[j....R.ZU.
[.{kX.....Y#.wo .....N..W._.o..(.R........4~ ..L...a.\.Z.V...!.u.....$
.I..=....w-....f_:...h.|.7...h.U..uyL...jekc.F.."[.W.:..1....M.<U.^
....M...&.....E...x..b...SO}..K}&.co..u[[Y....{..;.....".:D....(z.O./.
w....%W\W.p^.p...i.......z..ky4....V..-..M.....eXL......<D...*..l..
.d.Y..DJ.AKO.f$....c..M.E_.\..4R@.*I8p..8.m.9...../..W...M........
<<< skipped >>>

GET /campaign/scrn/100000/100710/sd_100710_46b91.jpg?v=0.9219147022042804 HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: screenshots.en.sftcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 20 Feb 2014 09:16:17 GMT
Cache-Control: max-age=172800
Content-Type: image/jpeg
Content-Length: 55511
Accept-Ranges: bytes
Date: Mon, 27 Oct 2014 07:59:47 GMT
Connection: keep-alive
Age: 0
X-Served-By: screenshots
X-Cache: MISS
X-Cache-Hits: 0
Expires: Wed, 29 Oct 2014 07:59:47 GMT
......JFIF.....%.%.....C..............................................
......................C...............................................
..........................|...........................................
...p...........................!..1A...Qaq.."RT....2SV...........$&'38
Ur....#46BXfvw...%(CDFHWb.....)5gsu..7G...............................
.........c........................!..1.AQ..."aq2R.......#ST.....3BU...
$Kd....&56CDcerstu.....EVv....FW...............?........T.I$.e.QC...
..&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY.
..*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.... yn.2<..3..
#....n...(.u .......O{wtRY...M%.6.........$f. ..Y.....M.].._G....D....
$..D.>H....=......F*....U...6p[.......pE..J...k3.d.>..r..RAR....
F..%.:..............}7D.{..h...qu..{}e&.n..i..b..au..&.5...yd....BM...
.m..>....>....(4....p.]...,.g....a`k...Xn......k.J........5...r.
K....J.'..R....`....`..|.~.~I?..=~.......5|.z.....n..R.kMHi.<.>.
.....)...*1P|....Kv2 ......x{}.{..{.dSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJS
JSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJSJV..........h..K..
. (A...Y..;!grU]DC3n.Rn.....t.....Z.T.vA...G...E.......kz..[j....R.ZU.
[.{kX.....Y#.wo .....N..W._.o..(.R........4~ ..L...a.\.Z.V...!.u.....$
.I..=....w-....f_:...h.|.7...h.U..uyL...jekc.F.."[.W.:..1....M.<U.^
....M...&.....E...x..b...SO}..K}&.co..u[[Y....{..;.....".:D....(z.O./.
w....%W\W.p^.p...i.......z..ky4....V..-..M.....eXL......<D...*..l..
.d.Y..DJ.AKO.f$....c..M.E_.\..4R@.*I8p..8.m.9...../..W...M........
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1132&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /js/generated/e07eb-ab7f5.js HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: static.sd.softonic.fr
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:39 GMT
Server: Apache
Last-Modified: Tue, 21 Oct 2014 08:30:14 GMT
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Wed, 26 Nov 2014 07:59:39 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=3, max=10
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/javascript
1faa...............z.H.0....B......H..B.. Kr....e......@.$n...".~.:..N
l...]53.9..n.@"......e..Zr..'.t..M.7.........d.C.%...6...d.'..$}....9.
......8.L...<....l..f^......d._d.......&.. .?........4.f..C/......A
..ts6.{.4...x<.....u>..<z..?M6G...y..}......a.f..~..6'.l4.L.w
.L......~.8.. .z=..Shj4.^....*:..a....,.i....??..:..O.nJ..z]..d3...?f.
.k.y......i6......h.]..~...M.0..8;......8....=.B..u..Gq~18.... ...;..{
3...|......y.%...}..``..1u3...`z.O...Vy9..i6...=h.....Q>....|...0..
....'.R..`..IP......g*...6/bZ..O.^`.U...M......|8.o.G.....lj..{.......
./...;....4.q<qO..T...lzz..xU....Ll/.d8/..7?.J.:.nx......66] |..,-.
......W...r..oa..G=....r.m.fC.w..X6<n./.xz..V7....T......zpz....'..
..m<^.X!z\4.KUocL.J`7.......lT;.G.%.y>_Q...b...x...g..J.%..O.q&g
t;........n..z.Z.L......uu.y..#. .?....,.&k......z5..O(.jb.8...h]..k..
!..?S}x=..R.p!V\].ah..%,[email protected]/O..$[..p|.e>.
w..Y.....7..~..7j...?85..l.`?.n.....?}.e....0.D.E.7.^...66./U...x:.r..
.O.j:Lf.d......gY...&..z.3......nm.......{2]..r..k..cZ..^..*...q6...k1
..Xd.I..m.....\...D..VN..'6...$......m.. .....&>......N,.._...*...p
...........*....s....>.GqR..Oa.......\...w...!....J.W.yU....CUA.G..
..vO"..,..G.....I.|.....i..E[...&g...._....:.y......{..6....0.-....gi.
...l].....r..g<...V.`...#....t.k.=2.6.<D4.....7.'..`..=/.e...e..
N...q.`.F7............&O.3e..`[email protected]..."
..Uk.~.fA3..f..i7D..Rp;g...^.j..a.'...<4....#5...E..Ge#..u.}.d<.
]......37<bJ...."....Kf.P..*P....?._...`[email protected].!Ov.
<<< skipped >>>


POST /universaldownloader-track HTTP/1.1
md5_hash: b4f4a17849cc9120609067e723d7f501
Accept-Language: en-us
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
x-requested-with: XMLHttpRequest
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: hair-master.sd.softonic.fr
Content-Length: 9749
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: __utma=44451261.1524841092.1414396784.1414396784.1414396784.1; __utmb=44451261.1.10.1414396784; __utmc=44451261; __utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_65249=false; UACA_65249=false; UD1_POSITION_65249=; _FCfr=100516||.100709||.100710|1|1414396787.101363|1|1414396787

id_session=B472B290-97DB-4317-8B14-1312B4B0D812&id_machine=a8a67a25000000000000000c298a8b37&id_user=B66E8494-AE49-4553-831E-E37A7618A695&id_file=65249&id_section=94&id_main_section=94&ab_test=&api_version=1.41.4×tamp=1414396784&download_browser=unknown_browser&download_browser_version=unknown_version&client_timezone=2&test_track=false&flavour=2&av_installed=&step=prefetch_events&events=[["special_conditions_evaluation",[{"campaign_id":"100516","campaign_priority":1205,"campaign_reranked_priority":null,"special
HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: sd_client_fr-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=sd.softonic.com
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 35
Keep-Alive: timeout=3, max=10
Connection: Keep-Alive
Content-Type: application/json; charset=utf-8
...........V*.I,)-V.R..V.....l.........


GET /65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: hair-master.sd.softonic.fr
Connection: Keep-Alive
Cookie: __utma=44451261.1524841092.1414396784.1414396784.1414396784.1; __utmb=44451261.1.10.1414396784; __utmc=44451261; __utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_65249=false; UACA_65249=false; UD1_POSITION_65249=; _FCfr=100516||.100709||.100710|1|1414396787.101363|1|1414396787; _ga=GA1.2.1524841092.1414396784; _gat=1


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: sd_client_fr-admin=deleted; expires=Sun, 27-Oct-2013 07:59:45 GMT; path=/; domain=sd.softonic.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 12098
Keep-Alive: timeout=3, max=9
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
...........}.r....Y.....%.)....T...Ri....hA HB....P.......s...9..9.\..
......q..l$HQ....f.f)[email protected]}..\.>..$.|.xY.,......7..
..\(.s.Z.....f..}.!...9 ....m..Z..n...x....Y}.{.....3./V..w}..k)`.....
w.....e:n......_......sn.3<...?|5..j=.vY.Y.a.1,.Q..8:..yC...R.1w.(.
!.>.(.h..e\.m{<C4....Z...Kgw9b...4...)F...<....Z.....l.lS7.@.
.>..k..x..:0.......Py.g577...v..-Ck.v...\]#.lN..]..........6.M.c...
,....B.-..].nS31@!.R5...M.=..F~.....~..]......v......c.&.Q.^.-.@.<.
zY....0...[.;.MC,8..vmX...L...#[email protected].....[.Ew..,
....V.....W.....d................y.[.e............J....i}cw.:[..3.....
..I.MI..Hx...(..x..,.R..EVZd.<m/v.. .cf{.7.7.0.%..W/.M$G..yo.|..8.6
4..l.d/6..z.Z_.....B...[[email protected]\..s..l....g..[..C......QU.=TO..
}%...........3..`...................`2....Ha.9.y.k.Q..(.#...|.0...%..9
5..?...& ..E.....HI}.2F3.M....?.^.......).'....][email protected].^........T..
B[ :....]..@.,.`..Gu...........*....pVj..J.!a/.aT.\[email protected]
[email protected]`di..!.e..w......\..W.m.......<....
.R.D:.m..... .5....0..0...5....c!%.2..9.....>C*...6...a...9........
.A>.>...0K....>O.q....gQRv..7./...-=...~S..v]..'.?.(x...(....
......]@y.ID74gY.C.....1..!6.e.c#.>..".MV.k..$).c]...U...2.fF......
.M1G.R.$r..J......[..P.]......9.....C....'....d~..........y.<).P0..
....RK/....`....&..B.e..=u9.s.@d.".!%?.`[email protected].][email protected]..
UENi.....,*...c...:..x...........3.`....q$n...3p.gV>[email protected]
.r.......L._...o..U.7.L...`...(........*..S...OE. .$.|..<}. ..[
<<< skipped >>>


GET /fr/scrn/65000/65249/hair-master-19.jpg HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: screenshots.fr.sftcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Mon, 16 May 2011 14:25:16 GMT
Cache-Control: max-age=172800
Content-Type: image/jpeg
Content-Length: 1743
Accept-Ranges: bytes
Date: Mon, 27 Oct 2014 07:59:46 GMT
Connection: keep-alive
Age: 0
X-Served-By: screenshots
X-Cache: MISS
X-Cache-Hits: 0
Expires: Wed, 29 Oct 2014 07:59:46 GMT
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 75....C................................... $.' ",#..(7),01444.
'9=82<.342...C...........2!.!22222222222222222222222222222222222222
222222222222......(.d.."..............................................
..............}........!1A..Qa."q.2....#B...R..$3br........%&'()*45678
9:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................
......................................................................
....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'
()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.............................
.......................................................?..{3....s_.S..
Z7.......K...j../..m6.......I.}...q..c..../..qn..e.....c].m..Pi....}.;
.9b..Ee:..0{....RcN.W...5....>z....E.<.c.:....U...Dw..,.k=...$..
!..{..r..^[.q...g.r.........'..k.D.S..,1_9.....i|:.}-\".E_W........88.
..;.V&.F......[.[......r...q.....4.>x...k..[..ya@. .......i^.*.&.o.
O...wQ.......O...c7.......r:...z..kRjs.........:.......Wf...;'...]Q...
.S....h.....MO..?.....Q.... G..C......:.....7O.p.\..........s_.\...u.'
H[49......r.\.Ti..Q]..Ew..*.t...sv.L.}.......{.........1.ty.<.i.d..
..GZ..m..M..H.neo:U.....kn... {..[t.H...z5..g.........P...)....tK.z...
......d.....;f..$h..*..W.=...E. .J0.........I\...~..:J:....pJO..I...L.
[email protected]...}...8~e>.OAMFx...'t.......M$O..V.]:S=..
..}..v..8Q.`.LUK......y*.......x.".o2-..Rly@..$..Q.....,...e....j.....
.E._.^...V.{9E....cQ.3.......m..c...1A..c..H.q.2.$Q...G.P=j..l.!r.
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1132&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1131&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /pagead/show_companion_ad.js HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: pagead2.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 6665989392593805695
Date: Mon, 27 Oct 2014 07:00:00 GMT
Expires: Mon, 27 Oct 2014 08:00:00 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 48300
X-XSS-Protection: 1; mode=block
Age: 3588
Cache-Control: public, max-age=3600
Alternate-Protocol: 80:quic,p=0.01
............i[.L.(.._a49D..c..d..!fI..d...K...-.. .......Z.If.y..w..V.
[uuum....;..................m.q.Og.a........e/.m 9..\....R8....V...k..
..j7.......n.... w..O.s5.k..V..F5.Mt.{U.....iwmM...n/...Q5V.....5...,.
.6..B&E=...Q.j<..k'.g.:..x.N....9..!......XC..`C.^....cM...((..^.k#
...N5.r..B..[... [}[email protected]%"S..b;..cK..h:.6K...t..vJ...C[..&.A.
Ko...Z..W.&...F..\ .X.p6p........fC..zC..V.T\y._..=.....q.......!.j~..
..4#;9Qo..........l....U...K.-.~..D.p.y...].2..$za%{.^....6...b2,..!r.
.<@..j......%.h../.....C.1%..M..e.]............eC..i\.N..D..'.d....
..9....t`....&..-...j...dtWhL&.wh.l.D.....{...e....b.."lS.|!.\..*oT..f
C.|bh....l...Y,..f.)..`afBBkEn,.}........$1.?.Q......?..._~..y..k.....
...?...5.%....6VY6.......Ni<..9...Q:.............n>..m...L_.i.H.
.......M.e..6K.Y....Wn<n....lt.TD..;..1%w...d.NG....v.....,....w.\.
D.m...:0yt^..]..=.............3.5....`...[.S}...pAu....V)g*.E...<..
w....Fi.....j...........8gd[......z.xS2^...M.0...Y^..*..g.l.n.#...m...
....x...,...EY~../] .... .l"...)D...s....?......!.....mk`...*....}..SB
..s..{gg.$m.Y.lW...m.....M..V.v..9....c...9....!.3.u.....N.....v.ToKC.
....`...vM...(.Y......sm.k.h.....s.|.Nl.9.-A.)D..7..u.Rtca.&N.q..d...y
.....Vq.}=..0...)....ipY..f..=.W5#.;...T....N".#F...........j....!....
.k[....v...;>..4.(.%}5..w2..Qd2.f2..Kg~.=OgVG...y.n...9)..7..r.D<
;c.<..::.... {..;.{......~5......{..X-|^.g...vv.....5...._...K(\.k.
...)E.....|.G..buL.B....#f..i....i..Q....Sr'>.....-........$...^.l.
o6.....=...ZGBZ....BJ..v.I}.....k..U..T :.p..q.W`..q..3G..M.LF.}.`
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /tag/js/gpt.js HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.googletagservices.com
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 14837949062835288565
Date: Mon, 27 Oct 2014 07:56:08 GMT
Expires: Mon, 27 Oct 2014 08:56:08 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 14794
X-XSS-Protection: 1; mode=block
Age: 219
Cache-Control: public, max-age=3600
Alternate-Protocol: 80:quic,p=0.01
...........}iS....w~...q.c.....X(..Y....!\j4.m.a;.......{...;....U%X..
.l=.M..=..y.O........;..Q....Na..4.g.x.r....5.gs....y.?..F..*...mM.o..
-...x.........9...).q.j....Ua....Z.<,...k{.N.....'o.4....%..E.8.5X.
.....)....d.J`T........ J.E5..D.a>Z_.f.0...(....l..<Z....Fi~..=.
.Q...`...lK ..z...>.}...X,v..Uiea..WQ#5..<J.hU~...../XW..$P.._.b
uP.`..q........6w.k.CL.*...RA.P.EC<w.M.fD`.......L&I..%....V......'
U......k>....=w9.-.L.Y......j..'......v.`:\...G.:..2...Df.n.r=.....
t......\rY:...........~.9.(.\.>I.Ij.|....dO...>.<c6gH.r*.,...
..........P.q6...l.wC]....5.y.....!swX....&.Q........E....N.^..C.Uc...
.*...!.....e..U..,J.4j"...S.W94k.....x.X.m....GW......`......g.rlv.w..
...'.T......]M.`V.mE.S.f..d........;..s{.....y..A....-..?..n.SC".~c...
...WwO[_.......;w.......O[N...{^-C...`c........4....i/..M.?..N..i.0{/.
 ...X}..'..x...N...w......;....7U ."......2Q`....":....,w..\IH.e.Ze.xn
...D.;..<.r....:.....R..r}.......De...Y9......o...k...uN.VuA...:Xj.
o.....{.........l...#....*sj...e.W.#)f%e..Y_...w.Ix...uD.W~......d.D9.
......s.M..UK.. `..a...Y.I`.'..T.....h.&a......8..q....l.&YhA.k]...y..
[email protected]....%.l..T..9.....u....XS6.X.)......3b.|ra9..i....f.a;[email protected]...(
..[.h.q....p.T.4.6..@.(..f..U....(......u....hru.5..Y....[.{4>/.O..
..EJ..R|.............P._0... ?..D.Dd.'.i.X...*...9A...B;.*.$T..$R.?...
...~5.C.~x?..........z..s......`?@K...|N.s../..B.=./4.c.B..]...T...L.&
lt;..\.l....B.f....R...]...v-_...../....-..c......B9..=..Zs#_..].B.?./
T.ey..u....Y..`].YU.q.....x..(S;.~..eP.Z0u........z.Oq...m..z..B..
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&default_rpm=320&campaign_id=100710&default_rpm=1491&campaign_id=100709&default_rpm=1596&campaign_id=100708&default_rpm=510&campaign_id=100516&default_rpm=1205&campaign_id=50701&default_rpm=1&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&excluded=0&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /css/generated/fad58-b4c72.css HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: static.sd.softonic.fr
Connection: Keep-Alive
Cookie: _FCfr=100516||.100709||.100710|1|1414396787.101363|1|1414396787; _ga=GA1.2.1524841092.1414396784; _gat=1


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:46 GMT
Server: Apache
Last-Modified: Tue, 21 Oct 2014 08:30:13 GMT
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Wed, 26 Nov 2014 07:59:46 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5296
Keep-Alive: timeout=3, max=10
Connection: Keep-Alive
Content-Type: text/css
...........<i..8r.. .~h.nCrK...b..E...2..A.0h...-K.I..o....x.x.....
2.3c.dU.X...Kz$MK.....G.7..z.......].'......hGZ..Iw...I..*2........._.
.E..U.K...........\.U..yxL..8<N..4<...<........sZd..0/.s.v.sG
.J.:..U...s...;.]&F\N.9..:..$....>.yI.#...n.,......z.U..6J.. uK...F
...$.......?.....t.P. ...m.........Q.V...}.$~".e_.].v/.].ly...'..8....
r..E..CKzUp......"?.......?.'....8~.C..zG..i....;.\R6.......d.kB.6U.r.
.X..-.K..l._.QdM...D/...6....*=...T....x........-.oFo6.6.....x.g.wUw.|
..|..y..>.YF....,/9N.......{......81..n.......GUY.l..p$....q.LxL...
......H.]Ge....8k.C..,X..cX{. F'.T..B.I.M[5......0.Z.y.....D.}Q=;dl..L
z...]{nH.~....*h..........!H#.e..1...*......k........_.....aK.6ji...C&
lt;..^...R .dG...R..d...g..:.38.A.3.q...;...d.~....6.)..x.....J.......
#.8.xiR.Ep....c~....Z....`.......)&.e.T" ..{X....`..t/5..w.O..].......
...w..X0..i..K.....y.gg.>U...?....).......,.9..uC..Dn,......v$...`.
...y...I.@(..*rDOP .......J}et.Z.'\.k0..I?...\f.sS......L..g6.}.m."g..
}.tIGGuyx.. Z...b.b_VQCkJ.....l.nz{.[H.)..*i."t..ni.K.)%.......J.|...c
[.-l......6../Za"..b.)....A..%..!..&`.c..7...b.g...!'q....#.BX.K&....f
.g..l.U......6[..a...QD-...A..%xmO.>|......& zY..........C..Z...&(.
....:..ich1...q".2.^.98'6,.g.e.`[.T'RZ..\.f...N\c".(...0.n.H....S..@..
.D..1f<S.-e..n...,*.m[J......#ce..8..l8o....S...?(..^=...gg&b.Ey...
.{)L..L]U.mU.....8...e.I.efz?.b.uf.....aB..W~..c..`..E>iJ.i0...L.F3
.tk.......`8.A......k.....G0~ N..!...g..1...N.=X...N...6.&...h...V....
..1w-6*Z.KO.Q.3..4T..#O.T..X3I..wV<..&...9.........H..m..].~.A.
<<< skipped >>>

GET /shared/img/sd_client/gradientbg.png HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: static.sd.softonic.fr
Connection: Keep-Alive
Cookie: _FCfr=100516||.100709||.100710|1|1414396787.101363|1|1414396787; _ga=GA1.2.1524841092.1414396784; _gat=1


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:46 GMT
Server: Apache
Last-Modified: Thu, 27 Mar 2014 08:15:24 GMT
Accept-Ranges: bytes
Content-Length: 2958
Cache-Control: max-age=172800
Expires: Wed, 29 Oct 2014 07:59:46 GMT
Keep-Alive: timeout=3, max=9
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE...........................................................
......................................................................
...........................O *E...4tRNS...............................
.....................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.
s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./
...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.&l
t;.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T
..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w.
.:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K..
..uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..
c.}.J.q.N.*..:g)%...!.. ..,[email protected]..,9.:l....c....<...
G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cd
a...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S
...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D...
...0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.
f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@
......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g.
.<Gs......".5c.R.4QC.5.][email protected]....
%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z.
_.......k.}...^?v..w.O..........t.x...~..x..}.........................
..............=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..
<<< skipped >>>

GET /shared/img/sd_client/loading.gif HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: static.sd.softonic.fr
Connection: Keep-Alive
Cookie: _FCfr=100516||.100709||.100710|1|1414396787.101363|1|1414396787; _ga=GA1.2.1524841092.1414396784; _gat=1


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:46 GMT
Server: Apache
Last-Modified: Thu, 27 Mar 2014 08:15:24 GMT
Accept-Ranges: bytes
Content-Length: 1553
Cache-Control: max-age=172800
Expires: Wed, 29 Oct 2014 07:59:46 GMT
Keep-Alive: timeout=3, max=8
Connection: Keep-Alive
Content-Type: image/gif
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................~..}..|..z..y..x
..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!...
..|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#..
...^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3&l
t;9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|
<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........1
73/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..
?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *........
..!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:
_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.....
..|2....................!.....|.,..........z.|.|.(591#...'258=AE<..
.)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\
......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2
-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_
M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...............
............$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.
)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|
.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|
<<< skipped >>>


GET /blank.gif?product=st_activity&event=window:app:loaded&id_session=B472B290-97DB-4317-8B14-1312B4B0D812¶ms={"api_version":"1.41.4","country":"us","flavour":"2","id_file":"65249","machine_id":"a8a67a25000000000000000c298a8b37","os":"[OS:2600,5,1,2,1,256,3,0,Service Pack 3]","ts":"1414396778","url":"hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch","user_agent":"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4"}
 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:36 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:36 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&excluded=0&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1130&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive

GET /collect?v=1&_v=j30&a=1064647252&t=pageview&_s=1&dl=http://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784&ul=en-us&de=utf-8&dt=Téléchargement et installation de Hair Master&sd=32-bit&sr=1276x846&vp=650x450&je=0&fl=11.6 r602&_utma=44451261.1524841092.1414396784.1414396784.1414396784.1&_utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&_utmht=1414396789509&_u=MACCAEAAI~&jid=&cid=1524841092.1414396784&tid=UA-48247475-3&z=1750159595 HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 24 Oct 2014 21:00:43 GMT
Server: Golfe2
Content-Length: 35
Age: 212343
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *
..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options
: nosniff..Content-Type: image/gif..Date: Fri, 24 Oct 2014 21:00:43 GM
T..Server: Golfe2..Content-Length: 35..Age: 212343..Cache-Control: pri
vate, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Proto
col: 80:quic,p=0.002..GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=3&utmn=1749760115&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1414396789963&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=679004254&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1414396790041&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=1740459931&utmhn=hair-master.sd.softonic.fr&utmcs=utf-8&utmsr=1276x846&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Téléchargement et installation de Hair Master&utmhid=1064647252&utmr=http://unknown_browser_unknown_version&utmp=/C101363--load1&utmht=1414396790088&utmac=UA-152357-4&utmcc=__utma=44451261.1524841092.1414396784.1414396784.1414396784.1;+__utmz=44451261.1414396784.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1


Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 23 Oct 2014 23:06:45 GMT
Server: Golfe2
Content-Length: 35
Age: 291182
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 23 Oct 2014 23:06:45 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 291182..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=101363&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&sc_id=1239&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_session&event=prefetch:session:create&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&ab_test=&download_date=1414396767&execution_date=1414396787681&client_timezone=2&api_version=1.41.4&id_machine=a8a67a25000000000000000c298a8b37&id_user=B66E8494-AE49-4553-831E-E37A7618A695&os=WindowsXP&default_browser=iexplorer&default_browser_version=6.0.2900.5512&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=300&id_file=65249&id_section=94&id_main_section=94 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100709&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /nr-476.min.js HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: js-agent.newrelic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: 2Gl KTflPp4XJZusKpCM o27woO8uJaEoBP/yXCwv6BuN0y7sMNgDaQUPbmlsPtG
x-amz-request-id: 3CCA735B6B7C657A
Cache-Control: public, max-age=315360000
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Last-Modified: Tue, 30 Sep 2014 18:19:08 GMT
ETag: "d131658362c40cedda15546bb81e9644"
Content-Type: application/javascript
Server: AmazonS3
Content-Length: 18146
Accept-Ranges: bytes
Date: Mon, 27 Oct 2014 07:59:45 GMT
Via: 1.1 varnish
Age: 2289305
Connection: keep-alive
X-Served-By: cache-dfw1833-DFW
X-Cache: HIT
X-Cache-Hits: 24626
X-Timer: S1414396785.794501781,VS0,VE0
Vary: Accept-Encoding
!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var u="function"=
=typeof __nr_require&&__nr_require;if(!i&&u)return u(t,!0);if(o)return
 o(t,!0);throw new Error("Cannot find module '" t "'")}var a=e[t]={exp
orts:{}};n[t][0].call(a.exports,function(e){var o=n[t][1][e];return r(
o?o:e)},a,a.exports)}return e[t].exports}for(var o="function"==typeof 
__nr_require&&__nr_require,i=0;i<t.length;i  )r(t[i]);return r}({1:
[function(n,e){e.exports=function(n,e){return"addEventListener"in wind
ow?addEventListener(n,e,!1):"attachEvent"in window?attachEvent("on" n,
e):void 0}},{}],2:[function(n,e){function t(n,e,t,o){l("bstAgg",[n,e,t
,o]),m[n]||(m[n]={});var i=m[n][e];return i||(m[n][e]=i={params:t||{}}
),i.metrics=r(o,i.metrics),i}function r(n,e){return e||(e={count:0}),e
.count =1,c(n,function(n,t){e[n]=o(t,e[n])}),e}function o(n,e){return 
e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.t*e.t,c:1}),e.c =1,e.t =n,
e.sos =n*n,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}functi
on i(n,e){return e?m[n]&&m[n][e]:m[n]}function u(n){for(var e,t={},r="
",o=0;o<n.length;o  )r=n[o],t[r]=a(m[r]),t[r].length&&(e=!0),delete
 m[r];return e?t:null}function a(n){return"object"!=typeof n?[]:c(n,fu
nction(n,e){return e})}function s(n,e){"undefined"==typeof e&&(e=(new 
Date).getTime()),p[n]=e}function f(n,e,r){var o=p[e],i=p[r];"undefined
"!=typeof o&&"undefined"!=typeof i&&t("measures",n,{value:i-o})}var c=
n(1),l=n("handle"),d=n(2),m={},p={};e.exports={store:t,take:u,get:i,ma
rk:s,measure:f},setTimeout(function(){d("bstAgg",function(){})},1e
<<< skipped >>>


GET /campaign/scrn/101000/101363/sd_101363_400c1.jpeg HTTP/1.1
Accept: */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: screenshots.en.sftcdn.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 26 Sep 2014 09:59:32 GMT
Cache-Control: max-age=172800
Content-Type: image/jpeg
Content-Length: 61189
Accept-Ranges: bytes
Date: Mon, 27 Oct 2014 07:59:46 GMT
Connection: keep-alive
Age: 0
X-Served-By: screenshots
X-Cache: HIT
X-Cache-Hits: 1923865
Expires: Wed, 29 Oct 2014 07:59:46 GMT
......JFIF.....H.H......Exif..II*................/hXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021
 79.155772, 2014/01/13-19:44:00        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:/
/ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" 
xmpMM:InstanceID="xmp.iid:39322BED44B511E4B3569C92536E32BF" xmpMM:Docu
mentID="xmp.did:39322BEE44B511E4B3569C92536E32BF"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:39322BEB44B511E4B3569C92536E32BF" stRe
f:documentID="xmp.did:39322BEC44B511E4B3569C92536E32BF"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>...C...........................................................
.........C............................................................
..........................................................`...........
................!1..."AQ.a2Bq......#R.3b..$r....%CSs....478cuv.&'(Dt..
....9TUWe.....................................F.......................
...!"1A..2QRaBq..#3....b..C..r.4ST...6Dd.................?...........4
.M.m.....i......f...u..BS..$..z.w...: ..zE..uerP?.l..W%.....#.<.bg.
.........&...O....h.q<.e}..?. .....f.a.~....^1jmO(..{.p.r..Z..\...m
^M.yk_.m;[]]g.bkHA../...s..B)U..k4....x...s.Z......B.,....q...Y...
<<< skipped >>>


GET /safeframe/1-0-0/html/container.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://hair-master.sd.softonic.fr/65249/universaldownloader/campaign-101363,100710?sd_timestamp=1414396784
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: tpc.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Last-Modified: Tue, 14 Jan 2014 13:13:27 GMT
Date: Fri, 24 Oct 2014 14:01:55 GMT
Expires: Sat, 24 Oct 2015 14:01:55 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1287
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 237473
Alternate-Protocol: 80:quic,p=0.01
......n....VyS.8...Oa<.G".....4.#C.Q.B.= Iw.[q\.;......>.N..;;.3
MyO...]Vs...}{w}d..8..j....9.<...*R.....8.|,.v.(.¶.R....As..O.e..
h.J.0..p..*J.B...4|P.(.4..Z6`...BMeb.....m..y.m..BU.!....a.].....E!W.l
m..4.. ..j$.8....0...n.2..!I`Lh.l.....:@b.<S.I .WCb^M..&.So......w.
u....szd........DaR.... .718.P...t;.......?.&....4..*.0.a.$.X.!.......
A.O...[..5X.]..h..(0.9.y[.Q...4.B....v..I...*....a......M=MD:4.ZO.6.&l
t;.g.@/...G.z.....^.FI..=.4...7 ..N.R.h.a....arQ..L.!.N.:.-.P....B.D..
.=...n.a....e".`J....'\f.8N."s]j.(.%!9..@..`.<..<..v.`... g...Y.
...6.......C....h.......b.s_..G.......-....2..v6.#EL...je;....p.......
d."...]U.e..b.s.R.[O.j.E...../.X..p.".......b.^/..R..w.....|.........V
....@.=...,........l"..n._..,.......8............"...u....U. .._y.[.i.
.../T...C..GQ,...yYx.7...h...mL.;.#.zla.-..lw:n;.O..I9......ZC..q5..j&
uN.rY...fO......7..;Y..e.......I...{.U..Y..}L..G...1..^....~..P..Sp~..
...H/...f..w...).T.8...~s.X..w.X....*..Q5...l.$I.Q......8z...p....b.$.
....D.4...p...og.A.$..uj.t.t.....u..ej...e.]....Sa.G.....A.;_.s.)A.5..
i&....*.].9....."..(..C...n\.....M..j..V..h....3..e..z...n...]_..d.\;.
kW..&"..D...h...T7I..R].u.....).t....e.........C.;.......=...]A!{o...l
"..........H..*.o{..E..w..PD.......po.L#L5v....i.gUM....8.....5f..3^..
.U.l....-............... ......S.S.......Si.......
<<< skipped >>>


GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100516&sc_id=-2&sc_type=ns&met=true&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..



GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=B472B290-97DB-4317-8B14-1312B4B0D812&campaign_id=100710&sc_id=1259&sc_type=ns&met=false&sd_flag=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.4
Host: sd.softonic-analytics.net
Accept: */*


HTTP/1.1 200 OK
Date: Mon, 27 Oct 2014 07:59:45 GMT
Server: Apache
Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 27-Oct-2013 07:59:44 GMT; path=/; domain=softonic-analytics.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Length: 35
Connection: close
Content-Type: image/gif
GIF89a.............,...........D..;..

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1756:

`.rsrc
PSSSSSSh
PSSSSh
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;<IIIIIIII=>II?@ABCDEFIIIIGIIIIH
88888888888888888
%u$Vj%
t.Gj:W
xSSSh
FTPjKS
FtPj;S
C.PjRV
[%s %s %s]
Send failure: %s
Failed writing body (%d != %d)
%s:%d
WARNING: failed to save cookies in %s
About to connect() to %s%s port %d (#%d)
Connected to %s (%s) port %d (#%d)
<url> malformed
:]://%[^
[^:]:%[^
Protocol %s not supported or disabled in libcurl
http_proxy
%5[^:@]:%5[^@]
%5[^:]:%5[^
:%5[^@]
Port number too large: %lu
%s://%s%s%s:%d%s%s
ftps
[%*39[0123456789abcdefABCDEF:.%]%c
Couldn't find host %s in the _netrc file; using defaults
[email protected]
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
Connection #%d seems to be dead!
Connection (#%d) was killed to make room (holds %d)
Re-using existing connection! (#%ld) with host %s
%s://%s
Connection #%ld to host %s left intact
operation aborted by callback
HTTP/
ioctl callback returned error %d
the ioctl callback returned %d
seek callback returned error %d
The requested URL returned error: %d
HTTP/1.0 connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.0 proxy connection set to keep alive!
HTTP 1.0, assume close after body
HTTP =
HTTP/%d.%d =
No URL set!
[^?&/:]://%c
Violate RFC 2616/10.3.2 and switch from POST to GET
Disables POST, goes with %s
Issue another request to this URL: '%s'
Maximum (%d) redirects followed
Received problem %d in the chunky parser
HTTP server doesn't seem to support byte ranges. Cannot resume.
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Leftovers after chunking. Rewinding %d bytes
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
unspecified error %d
%s cookie %s="%s" for domain %s, path %s, expire %d
#HttpOnly_
httponly
I99[^;
skipped cookie with bad tailmatch domain: %s
skipped cookie with illegal dotcount domain: %s
23[^;=]=I99[^;
%s%s%s
# Fatal libcurl error
# Netscape HTTP Cookie File
# hXXp://curl.haxx.se/rfc/cookie_spec.html
# This file was generated by libcurl! Edit at your own risk.
bind failure: %s
Local port: %d
Bind to local port %d failed, trying next
couldn't find my own IP address (%s)
Bind local address to %s
Couldn't bind to '%s'
TCP_NODELAY set
Could not set TCP_NODELAY: %s
Failed to connect to %s: %s
Trying %s...
Internal error removing splay node = %d
Internal error clearing splay node = %d
Error in the SSH layer
Caller must register CURLOPT_CONV_ callback options
TFTP: No such user
TFTP: Unknown transfer ID
TFTP: Illegal operation
TFTP: Access Violation
TFTP: File Not Found
Login denied
Issuer check against peer certificate failed
Invalid LDAP URL
Unrecognized HTTP Content-Encoding
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with known CA certificates
Problem with the local SSL certificate
SSL peer certificate or SSH md5 fingerprint was not OK
A libcurl function was given a bad argument
Operation was aborted by an application callback
FTP: command REST failed
FTP: command PORT failed
HTTP response code said error
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't set file type
FTP: can't figure out the host in the PASV response
FTP: unknown 227 response format
FTP: unknown PASV reply
FTP: unknown PASS reply
FTP: weird server reply
URL using bad/illegal format or missing URL
Unsupported protocol
Winsock version not supported
Protocol family not supported
Address family not supported
Operation not supported
Socket is unsupported
Protocol is unsupported
Protocol option is unsupported
Unknown error %d (%#x)
Resolving host timed out: %s
Could not resolve host: %s; %s
Could not resolve proxy: %s; %s
Could not resolve host: %s
gethostbyname(2) failed for %s:%d; %s
init_resolve_thread() failed for %s; %s
TFTP
set timeouts for state %d; Total %d, retry %d maxtry %d
tftp_rx: giving up waiting for block %d
Received unexpected DATA packet block %d
Timeout waiting for block %d ACK. Retries = %d
tftp_rx: internal error
tftp_tx: giving up waiting for block %d ack
Received ACK for block %d, expecting %d
tftp_tx: internal error
bind() failed; %s
tftp_send_first: internal error
%s%c%s%c
TFTP finished
Can't get the size of %s
Can't open %s for writing
Last-Modified: %s, d %s M d:d:d GMT
Couldn't open file %s
There are more than %d entries
LDAP remote: %s
LDAP local: ldap_simple_bind_s %s
LDAP local: Cannot connect to %s:%d
LDAP local: trying to establish %s connection
LDAP local: %s
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
CLIENT libcurl 7.19.0
MATCH %s %s %s
DEFINE %s %s
insufficient winsock version to support telnet
WSAStartup failed (%d)
%s %d %d
%s %s %d
%s %s %s
%s IAC %d
%s IAC %s
Sending data failed (%d)
%d (unknown)
%s (unsupported)
%s IAC SB
Syntax error in telnet option: %s
Unknown telnet option %s
7[^= ]%*[ =]%5s
USER,%s
%c%c%c%c%s%c%c
%c%s%c%s
7[^,],7s
%c%c%c%c
FreeLibrary(wsock2) failed (%d)
WSACloseEvent failed (%d)
WSACreateEvent failed (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to load WS2_32.DLL (%d)
WS2_32.DLL
Excessive FTP response line length received, %zd bytes. Stripping
FTP response reading failed
FTP response aborted due to select/poll error: %d
FTP response timeout
Failed FTP upload: 

RETR response: d
Connecting to %s (%s) port %d
Uploading to a URL without a file name!
FTPS not supported!
USER %s
socket(2) failed (%s)
PORT %d,%d,%d,%d,%d,%d
Telling server to connect to %d.%d.%d.%d:%d
Failed to resolve host name %s
getsockname() failed: %s
Connect data stream passively
REST %d
SIZE %s
STOR %s
APPE %s
Bad PASV/EPSV response: d
Can't resolve new host %s:%d
%d.%d.%d.%d
Skips %d.%d.%d.%d for data connection, uses %s instead
%d,%d,%d,%d,%d,%d
%c%c%c%u%c
Failed to do PORT
Got a d response code instead of the assumed 200
RETR %s
ftp server doesn't support SIZE
PBSZ %d
Access denied: d
ACCT %s
PASS %s
ACCT rejected by server: d
QUOT string not accepted: %s
TYPE %c
MDTM %s
ddd d:d:d GMT
dddddd
unsupported MDTM reply format
server did not report OK, got %d
Remembering we are in dir "%s"
CWD %s
Failed to MKD dir: d
MKD %s
QUOT command failed with d
Entry path is '%s'
PROT %c
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
AUTH %s
Got a d ftp-server response when 220 was expected
%sAuthorization: Basic %s
%s:%s
Server auth using %s with user '%s'
Proxy auth using %s with user '%s'
Failed sending HTTP POST request
Content-Type: application/x-www-form-urlencoded
Internal HTTP POST error!
Failed sending HTTP request
If-Unmodified-Since: %s
Last-Modified: %s
If-Modified-Since: %s
%s, d %s M d:d:d GMT
%s%s=%s
%s %s%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
Content-Range: bytes %s/%lld
Content-Range: bytes %s%lld/%lld
Range: bytes=%s
;type=%c
ftps://
PTF://
Host: %s%s%s:%d
Host: %s%s%s
Accept-Encoding: %s
Referer: %s
Received HTTP code %d from proxy after CONNECT
%d bytes of chunk left
HTTP/1.%d %d
Read %d bytes of chunk, continue
CONNECT %s:%d HTTP/1.0
%s%s%s%s
Host: %s
Establish HTTP proxy tunnel to %s:%d
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Failed to resolve "%s" for SOCKS4 connect.
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
SOCKS5 GSSAPI per-message authentication is not supported.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Failed to resolve "%s" for SOCKS5 connect.
User was rejected by the SOCKS5 server (%d %d).
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
--:--:--
= %s = %s = %s %s %s %s %s %s %s
password
login
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
%s, algorithm="%s"
%s, opaque="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%s:%s:x:%s:%s:%s
%s:%s:%s
%5[^=]=23[^
%5[^=]="23[^"]"
d:d:d
%c%c==
%c%c%c=
.html
.jpeg
--%s--
Content-Type: %s
; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Type: multipart/mixed, boundary=%s
%s; boundary=%s
()$^.* ?[]|\-{},:=!
:/-_.!~*'()
xxxxx
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
GetProcessWindowStation
portuguese-brazilian
operator
()$^.* ?[]|\-{},:=!
Kernel32.DLL
invalid map<K, T> key
User-Agent: %s
http/
NOINT_MSG
urls_to_restore_on_startup
startup_urls
search_url
keyword
zcÁ
.?AVHTTPClientImplementation@@
.?AVHTTPClientInterface@@
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AVWindowsAPI@@
.?AUDWebBrowserEvents2@@
.?AUIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AVCurlMultiDownloadJob@@
c:\%original file name%.exe
GetCPInfo
GetProcessHeap
PeekNamedPipe
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
ShellExecuteW
ShellExecuteExW
URLDownloadToFileW
UrlMkGetSessionOption
UrlMkSetSessionOption
GetAsyncKeyState
GetKeyState
EnumChildWindows
EnumDesktopWindows
InternetOpenUrlA
.text
`.rdata
@.data
.rsrc
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.1.1.0" processorArchitecture="X86" name="Softonic.UniversalDownloader" type="win32"></assemblyIdentity><description>Universal Downloader Download Helper.</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
ole32.dll
OLEAUT32.dll
PSAPI.DLL
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
urlmon.dll
USER32.dll
VERSION.dll
WININET.dll
WLDAP32.dll
WSOCK32.dll
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]Aucune connexion internet d
e[ENDVALUE][KEY]NOINT_MSG[VALUE]Softonic Downloader a besoin d'une connection internet pour fonctionner. Merci de vous connecter et d'essayer
nouveau.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Merci de patienter...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]T
chargement et installation de Hair Master[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_foY
SHELL32.DLL
ShellExecuteA
%original file name%.exe
.fLo$
hXXp://txcirebon.com/images/logo.gif
hXXp://genji-screenprotector.com/images/logo.gif
hXXp://youtber.hitowy.pl/logo.gif
hXXp://zszripbydgoszcz.za.pl/logo.gif
hXXp://zloto.friko.pl/logo.gif
hXXp://anjoman.uast-malayer.ac.ir/image/logo.gif
hXXp://chgk.ge/logo.gif
hXXp://maheenkhan.com/images/logo.gif
hXXp://kiangtawantour.com/image/logo.gif
hXXp://madcatfestival.com/images/logo.gif
/logo.gif
.info/J
home.gifI888
KERNEL32.dll
h.rata
Bkrnl.exe?
= =$=(=,=
322%2`.50728)
.klkjw:9fqwi
FamXf39.sys
.pBTa8
%s:*:
Bg.laXV
&?%x=
GUrlA'
Web%w|nc
HTTP)
2GUARDCMD.
.ENHCDM
PL/KPCKwWEB
MM.PFW.
.bssf
J:CRT
MSVCRT.dll
WS2_32.dll
SHFileOperationA
H[%s] %s
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
Glog.txt
HKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
WUSER32.DLL
.temp
Ld-d-d
[%d] [%lld|%lld]
1.41.4
Got Elevation URL. [%s]
New URL was not valid.
@Received message %s
xxxxxxxxxxx
explorer.exe "
[%d %d]
Hchrome
firefox
0.0.0.0
Web View
Web Host
%d|%d|%d
errorUrl
%s(%s)
%s --> (%s)
.swf?
.jpg?
.gif?
.png?
Value: %d
%s\*.*
%s\%s
Proxy by URL are not supported.
Automatic proxy discovery are not supported.
http=
https=
CPTF://
- URL:
[%d] Starting thread...
[%d] Thread Creation OK!
[%d] Error creating thread! trying again...
[%d] Thread started...
Bhttp/
%d - [%d][%lld/%lld][%lld]
json_writer.cpp
Hjson_value.cpp
Software\Classes\http\shell\open\command\
http\shell\open\command\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
chrome.exe
iexplore.exe
firefox.exe
opera.exe
opera
safari.ex
browser.startup.homepage
browser.search.order.1
browser.search.order.2
browser.search.order.3
prefs.js
\"(.)*.;
browser.search.selectedEngine
browser.search.defaultenginename
browser.search.useDBForOrder
user_pref("browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder.*
%s*.*
Software\Mozilla\Mozilla Firefox\
\Google\Chrome
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
PathToExe
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
\search-metadata.json
ljson_reader.cpp
log.txt
Assertion failed: %s, file %s, line %d
1.41.4.2

%original file name%.exe_1756_rwx_00401000_000F7000:

PSSSSSSh
PSSSSh
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;<IIIIIIII=>II?@ABCDEFIIIIGIIIIH
88888888888888888
%u$Vj%
t.Gj:W
xSSSh
FTPjKS
FtPj;S
C.PjRV
[%s %s %s]
Send failure: %s
Failed writing body (%d != %d)
%s:%d
WARNING: failed to save cookies in %s
About to connect() to %s%s port %d (#%d)
Connected to %s (%s) port %d (#%d)
<url> malformed
:]://%[^
[^:]:%[^
Protocol %s not supported or disabled in libcurl
http_proxy
%5[^:@]:%5[^@]
%5[^:]:%5[^
:%5[^@]
Port number too large: %lu
%s://%s%s%s:%d%s%s
ftps
[%*39[0123456789abcdefABCDEF:.%]%c
Couldn't find host %s in the _netrc file; using defaults
[email protected]
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
Connection #%d seems to be dead!
Connection (#%d) was killed to make room (holds %d)
Re-using existing connection! (#%ld) with host %s
%s://%s
Connection #%ld to host %s left intact
operation aborted by callback
HTTP/
ioctl callback returned error %d
the ioctl callback returned %d
seek callback returned error %d
The requested URL returned error: %d
HTTP/1.0 connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.0 proxy connection set to keep alive!
HTTP 1.0, assume close after body
HTTP =
HTTP/%d.%d =
No URL set!
[^?&/:]://%c
Violate RFC 2616/10.3.2 and switch from POST to GET
Disables POST, goes with %s
Issue another request to this URL: '%s'
Maximum (%d) redirects followed
Received problem %d in the chunky parser
HTTP server doesn't seem to support byte ranges. Cannot resume.
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Leftovers after chunking. Rewinding %d bytes
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
unspecified error %d
%s cookie %s="%s" for domain %s, path %s, expire %d
#HttpOnly_
httponly
I99[^;
skipped cookie with bad tailmatch domain: %s
skipped cookie with illegal dotcount domain: %s
23[^;=]=I99[^;
%s%s%s
# Fatal libcurl error
# Netscape HTTP Cookie File
# hXXp://curl.haxx.se/rfc/cookie_spec.html
# This file was generated by libcurl! Edit at your own risk.
bind failure: %s
Local port: %d
Bind to local port %d failed, trying next
couldn't find my own IP address (%s)
Bind local address to %s
Couldn't bind to '%s'
TCP_NODELAY set
Could not set TCP_NODELAY: %s
Failed to connect to %s: %s
Trying %s...
Internal error removing splay node = %d
Internal error clearing splay node = %d
Error in the SSH layer
Caller must register CURLOPT_CONV_ callback options
TFTP: No such user
TFTP: Unknown transfer ID
TFTP: Illegal operation
TFTP: Access Violation
TFTP: File Not Found
Login denied
Issuer check against peer certificate failed
Invalid LDAP URL
Unrecognized HTTP Content-Encoding
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with known CA certificates
Problem with the local SSL certificate
SSL peer certificate or SSH md5 fingerprint was not OK
A libcurl function was given a bad argument
Operation was aborted by an application callback
FTP: command REST failed
FTP: command PORT failed
HTTP response code said error
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't set file type
FTP: can't figure out the host in the PASV response
FTP: unknown 227 response format
FTP: unknown PASV reply
FTP: unknown PASS reply
FTP: weird server reply
URL using bad/illegal format or missing URL
Unsupported protocol
Winsock version not supported
Protocol family not supported
Address family not supported
Operation not supported
Socket is unsupported
Protocol is unsupported
Protocol option is unsupported
Unknown error %d (%#x)
Resolving host timed out: %s
Could not resolve host: %s; %s
Could not resolve proxy: %s; %s
Could not resolve host: %s
gethostbyname(2) failed for %s:%d; %s
init_resolve_thread() failed for %s; %s
TFTP
set timeouts for state %d; Total %d, retry %d maxtry %d
tftp_rx: giving up waiting for block %d
Received unexpected DATA packet block %d
Timeout waiting for block %d ACK. Retries = %d
tftp_rx: internal error
tftp_tx: giving up waiting for block %d ack
Received ACK for block %d, expecting %d
tftp_tx: internal error
bind() failed; %s
tftp_send_first: internal error
%s%c%s%c
TFTP finished
Can't get the size of %s
Can't open %s for writing
Last-Modified: %s, d %s M d:d:d GMT
Couldn't open file %s
There are more than %d entries
LDAP remote: %s
LDAP local: ldap_simple_bind_s %s
LDAP local: Cannot connect to %s:%d
LDAP local: trying to establish %s connection
LDAP local: %s
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
CLIENT libcurl 7.19.0
MATCH %s %s %s
DEFINE %s %s
insufficient winsock version to support telnet
WSAStartup failed (%d)
%s %d %d
%s %s %d
%s %s %s
%s IAC %d
%s IAC %s
Sending data failed (%d)
%d (unknown)
%s (unsupported)
%s IAC SB
Syntax error in telnet option: %s
Unknown telnet option %s
7[^= ]%*[ =]%5s
USER,%s
%c%c%c%c%s%c%c
%c%s%c%s
7[^,],7s
%c%c%c%c
FreeLibrary(wsock2) failed (%d)
WSACloseEvent failed (%d)
WSACreateEvent failed (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to load WS2_32.DLL (%d)
WS2_32.DLL
Excessive FTP response line length received, %zd bytes. Stripping
FTP response reading failed
FTP response aborted due to select/poll error: %d
FTP response timeout
Failed FTP upload: 

RETR response: d
Connecting to %s (%s) port %d
Uploading to a URL without a file name!
FTPS not supported!
USER %s
socket(2) failed (%s)
PORT %d,%d,%d,%d,%d,%d
Telling server to connect to %d.%d.%d.%d:%d
Failed to resolve host name %s
getsockname() failed: %s
Connect data stream passively
REST %d
SIZE %s
STOR %s
APPE %s
Bad PASV/EPSV response: d
Can't resolve new host %s:%d
%d.%d.%d.%d
Skips %d.%d.%d.%d for data connection, uses %s instead
%d,%d,%d,%d,%d,%d
%c%c%c%u%c
Failed to do PORT
Got a d response code instead of the assumed 200
RETR %s
ftp server doesn't support SIZE
PBSZ %d
Access denied: d
ACCT %s
PASS %s
ACCT rejected by server: d
QUOT string not accepted: %s
TYPE %c
MDTM %s
ddd d:d:d GMT
dddddd
unsupported MDTM reply format
server did not report OK, got %d
Remembering we are in dir "%s"
CWD %s
Failed to MKD dir: d
MKD %s
QUOT command failed with d
Entry path is '%s'
PROT %c
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
AUTH %s
Got a d ftp-server response when 220 was expected
%sAuthorization: Basic %s
%s:%s
Server auth using %s with user '%s'
Proxy auth using %s with user '%s'
Failed sending HTTP POST request
Content-Type: application/x-www-form-urlencoded
Internal HTTP POST error!
Failed sending HTTP request
If-Unmodified-Since: %s
Last-Modified: %s
If-Modified-Since: %s
%s, d %s M d:d:d GMT
%s%s=%s
%s %s%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
Content-Range: bytes %s/%lld
Content-Range: bytes %s%lld/%lld
Range: bytes=%s
;type=%c
ftps://
PTF://
Host: %s%s%s:%d
Host: %s%s%s
Accept-Encoding: %s
Referer: %s
Received HTTP code %d from proxy after CONNECT
%d bytes of chunk left
HTTP/1.%d %d
Read %d bytes of chunk, continue
CONNECT %s:%d HTTP/1.0
%s%s%s%s
Host: %s
Establish HTTP proxy tunnel to %s:%d
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Failed to resolve "%s" for SOCKS4 connect.
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
SOCKS5 GSSAPI per-message authentication is not supported.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Failed to resolve "%s" for SOCKS5 connect.
User was rejected by the SOCKS5 server (%d %d).
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
--:--:--
= %s = %s = %s %s %s %s %s %s %s
password
login
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
%s, algorithm="%s"
%s, opaque="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%s:%s:x:%s:%s:%s
%s:%s:%s
%5[^=]=23[^
%5[^=]="23[^"]"
d:d:d
%c%c==
%c%c%c=
.html
.jpeg
--%s--
Content-Type: %s
; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Type: multipart/mixed, boundary=%s
%s; boundary=%s
()$^.* ?[]|\-{},:=!
:/-_.!~*'()
xxxxx
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
GetProcessWindowStation
portuguese-brazilian
operator
()$^.* ?[]|\-{},:=!
Kernel32.DLL
invalid map<K, T> key
User-Agent: %s
http/
NOINT_MSG
urls_to_restore_on_startup
startup_urls
search_url
keyword
zcÁ
.?AVHTTPClientImplementation@@
.?AVHTTPClientInterface@@
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AVWindowsAPI@@
.?AUDWebBrowserEvents2@@
.?AUIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AVCurlMultiDownloadJob@@
c:\%original file name%.exe
GetCPInfo
GetProcessHeap
PeekNamedPipe
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
ShellExecuteW
ShellExecuteExW
URLDownloadToFileW
UrlMkGetSessionOption
UrlMkSetSessionOption
GetAsyncKeyState
GetKeyState
EnumChildWindows
EnumDesktopWindows
InternetOpenUrlA
.text
`.rdata
@.data
.rsrc
H[%s] %s
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
Glog.txt
HKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
WUSER32.DLL
.temp
Ld-d-d
[%d] [%lld|%lld]
1.41.4
Got Elevation URL. [%s]
New URL was not valid.
@Received message %s
xxxxxxxxxxx
explorer.exe "
[%d %d]
Hchrome
firefox
0.0.0.0
Web View
Web Host
%d|%d|%d
errorUrl
%s(%s)
%s --> (%s)
.swf?
.jpg?
.gif?
.png?
Value: %d
%s\*.*
%s\%s
Proxy by URL are not supported.
Automatic proxy discovery are not supported.
http=
https=
CPTF://
- URL:
[%d] Starting thread...
[%d] Thread Creation OK!
[%d] Error creating thread! trying again...
[%d] Thread started...
Bhttp/
%d - [%d][%lld/%lld][%lld]
json_writer.cpp
Hjson_value.cpp
Software\Classes\http\shell\open\command\
http\shell\open\command\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
chrome.exe
iexplore.exe
firefox.exe
opera.exe
opera
safari.ex
browser.startup.homepage
browser.search.order.1
browser.search.order.2
browser.search.order.3
prefs.js
\"(.)*.;
browser.search.selectedEngine
browser.search.defaultenginename
browser.search.useDBForOrder
user_pref("browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder.*
%s*.*
Software\Mozilla\Mozilla Firefox\
\Google\Chrome
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
PathToExe
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
\search-metadata.json
ljson_reader.cpp
log.txt
Assertion failed: %s, file %s, line %d

%original file name%.exe_1756_rwx_004FB000_00001000:

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.1.1.0" processorArchitecture="X86" name="Softonic.UniversalDownloader" type="win32"></assemblyIdentity><description>Universal Downloader Download Helper.</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
ole32.dll
OLEAUT32.dll
PSAPI.DLL
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
urlmon.dll
USER32.dll
VERSION.dll
WININET.dll
WLDAP32.dll
WSOCK32.dll
URLDownloadToFileW
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://hair-master.sd.softonic.fr/65249/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]Aucune connexion internet d
e[ENDVALUE][KEY]NOINT_MSG[VALUE]Softonic Downloader a besoin d'une connection internet pour fonctionner. Merci de vous connecter et d'essayer
nouveau.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Merci de patienter...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]T
chargement et installation de Hair Master[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_
1.41.4.2

Explorer.EXE_1572_rwx_00FF0000_00002000:

SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.rsrc

%original file name%.exe_1756_rwx_004FD000_00010000:

SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
%original file name%.exe
.rsrc
c:\%original file name%.exe
.fLo$
hXXp://txcirebon.com/images/logo.gif
hXXp://genji-screenprotector.com/images/logo.gif
hXXp://youtber.hitowy.pl/logo.gif
hXXp://zszripbydgoszcz.za.pl/logo.gif
hXXp://zloto.friko.pl/logo.gif
hXXp://anjoman.uast-malayer.ac.ir/image/logo.gif
hXXp://chgk.ge/logo.gif
hXXp://maheenkhan.com/images/logo.gif
hXXp://kiangtawantour.com/image/logo.gif
hXXp://madcatfestival.com/images/logo.gif
/logo.gif
.info/J
home.gifI888
.text
KERNEL32.dll
h.rata
Bkrnl.exe?
= =$=(=,=
322%2`.50728)
.klkjw:9fqwi
FamXf39.sys
.pBTa8
%s:*:
Bg.laXV
&?%x=
GUrlA'
Web%w|nc
HTTP)
2GUARDCMD.
.ENHCDM
PL/KPCKwWEB
MM.PFW.
.bssf
J:CRT
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
SHFileOperationA

%original file name%.exe_1756_rwx_00B10000_0108E000:

c:\windows
hXXp://txcirebon.com/images/logo.gif
hXXp://genji-screenprotector.com/images/logo.gif
hXXp://youtber.hitowy.pl/logo.gif
hXXp://zszripbydgoszcz.za.pl/logo.gif
hXXp://zloto.friko.pl/logo.gif
hXXp://anjoman.uast-malayer.ac.ir/image/logo.gif
hXXp://chgk.ge/logo.gif
%System%\drivers\nknip.sys
.fLo$
4670463284
.rsrc
.text
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
hXXp://89.119.67.154/testo5/
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet987.info/home.gif
KERNEL32.dll
USER32.dll
h.rdata
H.data
.reloc
ntoskrnl.exe
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
hXXp://
ipfltdrv.sys
VVV.microsoft.com
?%x=%d
&%x=%d
SYSTEM.INI
USER32.DLL
.%c%s
\\.\amsint32
NTDLL.DLL
autorun.inf
ADVAPI32.DLL
win%s.exe
%s.exe
WININET.DLL
InternetOpenUrlA
avast! Web Scanner
Avira AntiVir Premium WebGuard
cmdGuard
cmdAgent
Eset HTTP Server
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootFirewall
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Explorer.exe
A2CMD.
ASHWEBSV.
AVGCC.AVGCHSVX.
DRWEB
DWEBLLIO
DWEBIO
FSGUIEXE.
MCVSSHLD.
NPFMSG.
SYMSPORT.
WEBSCANX.
.adata
M_%d_
%c%d_%d
?456789:;<=
!"#$%&'()* ,-./0123
GetProcessHeap
GetWindowsDirectoryA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
SHFileOperationA
&3&3&3&389
.rdata
.data
Bkrnl.exe?
= =$=(=,=
322%2`.50728)
.klkjw:9fqwi
FamXf39.sys
.pBTa8
%s:*:
Bg.laXV
&?%x=
GUrlA'
Web%w|nc
HTTP)
2GUARDCMD.
.ENHCDM
PL/KPCKwWEB
MM.PFW.
.bssf
J:CRT
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
WS2_32.dll

%original file name%.exe_1756_rwx_02490000_00002000:

SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.rsrc

%original file name%.exe_1756_rwx_025A0000_00001000:

|%original file name%.exeM_1756_

Explorer.EXE_1572_rwx_01E20000_00001000:

|explorer.exeM_1572_


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %WinDir%\system.ini (70 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\sd_100710_46b91[1].jpg (23256 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\hair-master-19[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA27SHI3.gif (35 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (303 bytes)
    C:\autorun.inf (293 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\sd_100710_46b91[1].jpg (20906 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\loading[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\pubads_impl_52[1].js (3071 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CACJQ5I5.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\campaign-101363,100710[1] (1742 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAQV4TW9.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\analytics[1].js (1008 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\f[1].txt (1768 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (480 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\winbhvxt.exe (741 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\f[1].txt (392 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (10507 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\fad58-b4c72[1].css (5 bytes)
    %System%\wbem\Logs\wbemprox.log (150 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\e07eb-ab7f5[1].js (6987 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (223 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\universaldownloader-prefetch[1].htm (975 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAO3DJ2U.gif (35 bytes)
    C:\vretii.exe (103 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\CAEJIZMT.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\f[2].txt (6865 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (9667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CAZ5XBDJ.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\container[1].html (1287 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA49AFGD.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\campaign-101363,100710[1].htm (1663 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\sd_101363_400c1[1].jpg (28444 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\sprite[1].png (7 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (245 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M9XZ4A1C\container[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\fad58-b4c72[2].css (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\f[1].txt (6416 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (9324 bytes)
    %Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\CA4HMZ4X.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SPK3IBXM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PE57U6G\gradientbg[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHAB81Y7\pubads_impl_52[2].js (4850 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now