Installer.Win32.InnoSetup.2_9c356e024f – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):No processes have been created.The Installer injects its code into the following process(es):

%original file name%.exe:3308

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3308 makes changes in the file system.

The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button.png (698 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\CH_logo_new[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\bootstrap_41124.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Progress.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00140251.log (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\main.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\ie6_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\BG.png (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\g_-_32x32_-_s_13060x20130323113056_0[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE.part (2856 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D (388 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp\osutils.vbs (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg2[1].jpg (5184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab561B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F9287878B15AB61E0E47645E5 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Icon_Generic.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button_Hover.png (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp\asgnd.json (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D (360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp.CIS.part (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG[1].jpg (7704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\ProgressBar.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FF_logo_new[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\Nininininon[1].png (41648 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D (602 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\truste[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (727 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0060A9F9287878B15AB61E0E47645E5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button_Hover.png (818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Cazurazihiz[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG_FS[1].jpg (5600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bar7[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp.CIS (141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\IE_logo_new[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar561C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg1[1].jpg (12860 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button.png (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\BG[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS.part (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FS_BG[1].png (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo_b[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0014009C.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE (164831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\PL.locale (4 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar561C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0014009C.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab561B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00140251.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\bootstrap_41124.html (0 bytes)

Registry activity

The process %original file name%.exe:3308 makes changes in the system registry.

The Installer creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\9c356e024f58aaaf0eef94bf772580c2_RASMANCS]
"MaxFileSize" = "1048576"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5	File path
65133da829359a4e4079d965d05ba5bf	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Installer file.
Delete or disinfect the following files created/modified by the Installer:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button.png (698 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\CH_logo_new[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\bootstrap_41124.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Progress.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00140251.log (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\main.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\ie6_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\BG.png (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\g_-_32x32_-_s_13060x20130323113056_0[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\0A7D17F4_stp.EXE.part (2856 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D (388 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp\osutils.vbs (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg2[1].jpg (5184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab561B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F9287878B15AB61E0E47645E5 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Icon_Generic.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Grey_Button_Hover.png (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp\asgnd.json (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D (360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\3F8C9735_stp.CIS.part (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG[1].jpg (7704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\ProgressBar.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FF_logo_new[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\Nininininon[1].png (41648 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D (602 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\truste[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (727 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0060A9F9287878B15AB61E0E47645E5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button_Hover.png (818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Cazurazihiz[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG_FS[1].jpg (5600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bar7[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\IE_logo_new[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar561C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_7C90AA5E29A4A4431A9E53E5B55F2F3D (472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bg1[1].jpg (12860 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\images\Color_Button.png (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\BG[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0D9F241E\73027C7A_stp.CIS.part (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FS_BG[1].png (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\logo_b[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0014009C.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D (773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH13109075114\locale\PL.locale (4 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Docesipete
Product Name: Fas
Product Version: 1.5
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.5.4.0
File Description: Fas Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

Company Name: Docesipete Product Name: Fas Product Version: 1.5 Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 4.5.4.0 File Description: Fas Setup Comments: This installation was built with Inno Setup.Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	40240	40448	4.66924	40b31eb39bc93f9424539fdb39075272
DATA	45056	592	1024	1.90742	1ee71d84f1c77af85f1f5c278f880572
BSS	49152	3724	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	53248	2384	2560	3.07115	bb5485bf968b970e5ea81292af2acdba
.tls	57344	8	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	61440	24	512	0.14174	9ba824905bf9c7922b6fc87a38b74366
.reloc	65536	2244	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	69632	29604	29696	4.49039	7054a066dbe600dbe7470a2e08f3818f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 16
8197620fe52fe518bbad4acca7aae4fc
1125643ad05f953d40babcd51e2dbc6a
5caba877244aaa52974afce7b032024a
32ef9d8778ba2d3a9a0c2dd03a62ac41
b485a8f370e9818645ba2d34ff89d53c
3b47164fb155d81397d265741a6713ea
476531acc1164a9968857c3dfc6a9715
3a8367511dd39951310866315aa1fdb7
a2089302b2d139131bd658058708d200
0716e334db15fd23746de448da556afb
20da70c48f8a6afc94bae07beed35c20
29d8b6c791390ff719cc42d4e36756aa
87d8b2aa73e25fbc2311bac5e7d17c8f
8c613a0e486c16e1fe2deb51ca6f510a
ab50a218591c96947ba093a678846f12
34b96f30ba9a806cc862fccc0c1b2604

Network Activity

URLs

URL	IP
hxxp://rp.bororeb.com/?v=2.0&pcrc=1858890704	54.229.91.211
hxxp://db4sw1py28nkw.cloudfront.net/pl1-sst-x.json
hxxp://awseb-e-3-awsebloa-1e879wom63989-1129466525.eu-central-1.elb.am/?f=json
hxxp://info.bororeb.com/?v=1.03&c=8b3a4081&at=740357246&cntr=0	176.34.130.130
hxxp://rp.bororeb.com/?v=2.0&pcrc=775274733	54.229.91.211
hxxp://os.bororeb.com/DobreProgramy.pl_High/?v=6.0&c=852899565&t=1312873	52.19.5.95
hxxp://gallery.dpcdn.pl/imgc/ToolIcon/13060/g_-_32x32_-_s_13060x20130323113056_0.png	194.0.171.165
hxxp://download.videolan.org/pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe	88.191.250.2
hxxp://img.bororeb.com/img/Malaromoro/bg2.jpg	146.185.27.53
hxxp://img.bororeb.com/img/Malaromoro/bg1.jpg	146.185.27.53
hxxp://img.bororeb.com/img/Tuburera/logo.png	146.185.27.53
hxxp://cdneu.dobreprogramyplcdn.com/ofr/Solululadul/osutils.cis	146.185.27.45
hxxp://cdneu.dobreprogramyplcdn.com/ofr/Solululadul/asgnd.cis	146.185.27.45
hxxp://img.bororeb.com/img/Tuburera/truste.png	146.185.27.53
hxxp://img.bororeb.com/img/Tuburera/bar7.png	146.185.27.53
hxxp://img.bororeb.com/img/Tuburera/logo_b.png	146.185.27.53
hxxp://img.bororeb.com/img/Rewudaw/BG.jpg	146.185.27.53
hxxp://img.bororeb.com/img/Rewudaw/BG_FS.jpg	146.185.27.53
hxxp://cdnus.dobreprogramyplcdn.com/ofr/Solululadul/osutils.cis	199.58.87.151
hxxp://cdnus.dobreprogramyplcdn.com/ofr/Solululadul/asgnd.cis	199.58.87.151
hxxp://img.bororeb.com/img/IE_logo_new.png	146.185.27.53
hxxp://img.bororeb.com/img/FF_logo_new.png	146.185.27.53
hxxp://img.bororeb.com/img/Cazurazihiz/Cazurazihiz.png	146.185.27.53
hxxp://img.bororeb.com/img/Nininininon/Nininininon.png	146.185.27.53
hxxp://img.bororeb.com/img/Fividof/FS_BG.png	146.185.27.53
hxxp://img.bororeb.com/img/CH_logo_new.png	146.185.27.53
hxxp://img.bororeb.com/img/Fividof/BG.png	146.185.27.53
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI=	178.255.83.1
hxxp://crl.usertrust.com/AddTrustExternalCARoot.crl	178.255.83.2
hxxp://rp.bororeb.com/?v=2.0&pcrc=1988936779	54.229.91.211
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc=	178.255.83.1
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODORSADomainValidationSecureServerCA.crl	104.16.89.188
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODORSACertificationAuthority.crl	104.16.89.188
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQCdZZ9r88cafMgPHXnOMOGm	178.255.83.1
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl
hxxp://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl	104.16.89.188
hxxp://sui-generator.sensic.net/?f=json	35.156.82.106
hxxp://config.sensic.net/pl1-sst-x.json	52.222.157.51
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQCdZZ9r88cafMgPHXnOMOGm	178.255.83.1
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl	93.184.220.20
hxxp://crl.comodoca.com/COMODORSACertificationAuthority.crl	104.16.89.188
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc=	178.255.83.1
time.windows.com	13.80.12.54
dns.msftncsi.com	131.107.255.255
pl1-sst.sensic.net	52.29.220.191

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET MALWARE DealPly Adware CnC Beacon 4

Traffic

GET /img/Malaromoro/bg2.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/jpeg

Content-Length: 59210

Connection: keep-alive

x-amz-id-2: S864L5S4TUGtpH1FbaiE 24IhQaIj 9LHPuJ6yzgkWL6AUgp3aFHgczTwVrV0qv8

x-amz-request-id: 6DC2E3436D265BB1

x-amz-version-id: JMXnkH_Q4w85o.RRxkVvr1HHBSYxTWbA

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

ETag: "3ca90bdb0184dba078b0e604eb239df0"

Accept-Ranges: bytes

......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:345E81DDDAA9E311B383BEF54B638275" xmpMM:DocumentID="xmp.did:118EE61EAA0211E3A8EABD135B592C02" xmpMM:InstanceID="xmp.iid:118EE61DAA0211E3A8EABD135B592C02" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:086B2D40FAA9E311A847ACF83C7EB2CA" stRef:documentID="xmp.did:345E81DDDAA9E311B383BEF54B638275"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................0.........................................................................................!.1.A".Qa2..q...B#3..Rb...C$45..r..cs%....S.DT....U..E&......................!1.A.Qa.q.."2......B..Rb.#..r.3...cs.$............?...@L...-..I....E.i..D2P.*..b.,...]H.Z7.|1.....v.4....M.....T.<.Q......z.....u9...\u.......M....r'.gW.hM.B...I.....I...0@.....I..:.....:.s.......:...L..._..%nh6._........b)

<<< skipped >>>

GET /img/Tuburera/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 8970

Connection: keep-alive

x-amz-id-2: Zdob5wcCDC6sUoDlSOx22Lu8ztgK heNu8iAi/1BO8dRjyzG3YFEfRxch6E8FtCI

x-amz-request-id: E1965D61B461F838

x-amz-version-id: CbercSsLGa07nAy9AshJRzsQW0lz1UK5

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:02 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

ETag: "b084c85324dcb4d88f500ebaf8ab37ce"

Accept-Ranges: bytes

.PNG........IHDR.......5.....Ap^.....tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..]......^.. l.w..... XP....%..X.1.D.$DM."".. ....J.E.u.]v....{....3.... .j....D........s.{.....D %H..B..zB...n...K.^,.Z.*..[[.K.[.._.GD|.....x/.V.g..L..Y.....44 .<U.=N..yY..B.R.....[_ ...@c.....C..._...f$...%{....1y.b.U...Oxy...YG..a..E....PRZC..?..|......e.Q.E..{./~..<.X...i.( 9..[....Dx.-N|<ZhO...F.......P.&V.?.U.l..1qLW..z.?Ld........m...B.0..8.../~....B....[..../......M..4...Dnh.....&11.......|..6DD.`......a............J..}.";E.i..._......r.......Gr.p....i{sp2.....(......8.g."...:.Db..Ix....=..^...r...}.'4.......P.0.....~../..L......EUX......1..mX.l7..*......Lf.d.........^..&....Z..W.hl.......e.R.B..z..=~.......}E..Ã¥...W.........l.]Lr...............kD.....:8.N\<.#..m.......%CZ-x...../g.............s6`..L....!..L.8....y......2..^||<..... ..G...........#._e.........[...#..x..Fl.QL......W!1!..=9....J_..z...~..._~yN.q.3..,........EBB.4.].aG[................8.......E|....Bw.../~..@.H...9..... m.......>1...\F....C..xy...-(..W....[......_......&Q.p<...=....8...p...........X?6*...I.....P]S...3z..N.........l..f.[/..(.Z-t..._.m..V.u..._~m . t.M...}...g".:.5...pi.19......j.......'PY]'..\<.3..G...^a...0..Y-...J.U..KI...s.v ...!x.....>.3...U.6[...........0..}...Y...../.)...v....B. t...Q.T.......%Bs...By.]x..jQ..O..;G....e.<z..S..a.......~.......Hi...........k.O.....r....h..w...!=4.s8..>..N.......`.........m?.C\L0^x.S........I..9.>.%.....G..F3e..u.c..s.RG/.z..U..W....A....FS.#......y0V.-i..j.....8.A.

<<< skipped >>>

GET /img/Tuburera/truste.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 11597

Connection: keep-alive

x-amz-id-2: rcSLP3REe5XT9x654FFYdgUcC6bXnpyaNMHCktuPFPrPShGYzm7E hC2DjLWG9Gl

x-amz-request-id: 738C9AA11BE74E77

x-amz-version-id: TsQX4cb1jyoGu5DXk3rpuvCf_fAlhQQa

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:27 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

ETag: "9d7db4bf8aea860f288e41d97c3687a1"

Accept-Ranges: bytes

.PNG........IHDR...A...U.............tEXtSoftware.Adobe ImageReadyq.e<..,.IDATx..|..].u....ez/*..D....f....)6.KlB......%....;.>..8..<.Nl.......l.hB.Q..F..4.....sOy..w.......;..w............(... ...;yx>l..`.M....m..i..[..v....V.R1.y...r9...p.<....ab...H$......D#(....#...X.j.......?pp..O<..H4ZX}...,?...s'..a..}..-9..s7.X.Bn.a..gm~...y.`[[...W\.`CSc..{...bU.J....B.U..|!.U4....>.n....`..3......!..............G|....._........c.....|.....m...?......q..&>..o~......g?........o....'?...[..G.6uv........;.../z..]....<'.U............,K}......p@ss3.../.P(.........PW..n..333....088(..v.Z|.c....c.....?._}.....k.L$.w..u..C...0~..q ......L&....n...m..7.!....;.....;#...7}.&\s.5....O~..z\....gPu.8...~(..m..........%.\...0s...8N.?..u.V?.H..]...7.w...r&.....n..|.z.0....].#.=....754......s.[........w.u...I...,..;.|...........y..3......f...?.>...0..g.y..[.lYy2^ ..7M....Z.Bx..#.w...b.....a1.....l....pTzS...*..(...:.jjj....w..e..w......k..... .........1:..>.."TU....6b....}.........../.....~..7..e.d.A...MZD.r&..._5..>..8...z.K.-..........oDSK3.mU84.A.6L.>.DV.....Yc~...Dkk........<.(...N.... ..........ax..%....BN.9k.F.XBgg'....q...s..5k.l=a#....A<.,...kF.....,.yd|.X.@X..l.7.p....ny.[.U........O....k"^....v|....e.g7HL............u0.&...S....0..P5....{/<.0..I.u.'....a0w..~..}.=.8..<......~....p..TJ~...!....<.~...v.Z&r..O?s.H...X.l......M.....r....u.]'........?;9.z.Y#..P.\\~..x..g.._?........[W.u.Y/1|L..'."..>/V..s.='.f..%..z.).?.....7......g...r.....g<..-....-Y.....%....E~2.......

<<< skipped >>>

GET /img/Tuburera/bar7.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 10604

Connection: keep-alive

x-amz-id-2: wbFwazL iC0qAk7necqLr49o6FK/ c2nT1qexmXwcKzqzOrJWUJ MHezkDmMfrJr

x-amz-request-id: 90667C4E88F69EBC

x-amz-version-id: N2ls4ElWemvYIzegu69FA58gpcXntv9c

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:06:52 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:45 GMT

ETag: "4fa9087a65898badf6d8955c16d73809"

Accept-Ranges: bytes

.PNG........IHDR...'...(......{< ....tEXtSoftware.Adobe ImageReadyq.e<..).IDATx..}.p....7..w...."H..xS.)J2.H.....Z. {.x..!Wy....T%....T6..U...........,i..:m..u..H..).........>f&..=3.yx....R.Y.............Gy.....PRlX.k P..W..._.}..W.t=h.,..T*Yo.......r.m[.r..U.9..8....o:.,..../p.......,Uu..Tl=...[Z....h.TT.R...R..g..%.........^o*..O.Q...U.'....o.P.......tP..e.....B......L.m.......w.)..FQ.,..b......,qLq...9....vt...._...Wi.Y._.}..W.t=?.k.vc....bY.4M.X.4......<P.y.wK."..... .......`...B..B..?^x.%.w.}...K.>..NU......>....:..{...k5. ...s*n.r..~`9.UoT`...4..n....9...FL.OE.[.O........_...n.O....;.....D.A.......\....R....,...chp.c.....(.....466bI{ ../ESC.j1..]...4...`T.....f.....$n....#S(ZA....n~."..I.......d9....%.Y....H......s..\...V...uJ...MU.g....894)....[...\...iy..f...]..7...w..y.<.we9..s.b9..........?w ....~....t.....9s...i.$T......q...<uB.?.4.f...F.w\...5k....G$E..3..\.............PB......]w..;....A...MON.....?}./.."r.ql\..[..v....D../v"...T...U.|..........6...5.[y.n3......m]....H\.. XL..T.8.}....k.N.W..J..7.9.......b...Q.\...A..8..S.T......:Q..\'?...f.......8t`?..f.....W.v.:t45..*Y.)IX......f........w....n.~...c..u.q....y.GC.Q.~....P.f........X..d....8.O...~\.t.`NK..&...2m.(.T....$f.\b....c...R.1...T....C(.I...d.N..3.....ww.EhjM...7.....$.....Y....s....<.W...}...ip..E))X.c6..d...a.f...)...P......\*............o}...vC/.QH.appPR8..*.$.........k.....x?>.?...z..<..>....nk.,G...}>...W.....]Q...;SU...R..S.:/W4z..7.W.....p......dO..^........2....-..?s....\0b....~p.c...eY.....G..

<<< skipped >>>

GET /img/Rewudaw/BG.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/jpeg

Content-Length: 102878

Connection: keep-alive

x-amz-id-2: tXUK9vSETJVjcpDr4vxSGPhkfuSPqLofpqhb9uRVUq/PD4o0Y7QFXbcttDaSBA39t2RbnCRhaKw=

x-amz-request-id: BFB3B107C082E179

x-amz-version-id: sCJ._v0SQy.IKyc6FrWiaRIAYL2XAV4H

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 19:47:01 GMT

Last-Modified: Thu, 31 Dec 2015 19:47:27 GMT

ETag: "d4337f9e3cdbb54bd455a9b749954a87"

Accept-Ranges: bytes

......JFIF.....`.`.....fExif..MM.*.................>...........F.(...........1.........N.......`.......`....paint.net 4.0.5....C....................................................................C.........................................................................0.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..5.u.... .z'.|.........z...G$....1..[K..=.........^..g.....-.O..}.....6:....r[!gw.....{.[..[.....c\$Q......:M..6.^....9............6x.x...w...J.q..x.`..S.UO..._.q._....J..n..JJ.m.I%.r.w...s. .NTd.\..T............Zm....|v...9...P.4.P.d:m......B.D.[.|3...o..y.s=..R.].._L.x.C....:R\H.....Zy..2.<....O...4...u85.kO.[./...E../..u... ....h...Ju..8O....;v.._....R...4m.2.w.3.G...ZT.Zo.SI...Ke.E.3.8...I7.........}.O....4x-..<j.$..Y..._....>.......C.Dg...G.........(...........Xh.^..h....M.}.U.5..M..O:...=Jy.,......*.'.Ic...<....#k.,.r..~.S.......D..e.Y..Y..L...HO..TO..".... ./j.p...5...Z.O.J...}.\9Z...m..c..%R.....2..........'.g...).....4.^O....].....}.j.....X.C.o.n.d...s..qx...Y...f&..N..n|Is.C.K...~x...d.....*l.|~...~...>".7...........mk..|<.6....E.^.~ ....o$..H.67.[..]....(..F....t...c

<<< skipped >>>

GET /img/FF_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 6157

Connection: keep-alive

x-amz-id-2: lWGCR7sUJtZ SNEO61HWdZuDs0L9Jt3NLu2M9NaEcbyE1oPWI6bLEkzl/7Lygbas

x-amz-request-id: 5BA1F1A50FAB4932

x-amz-version-id: wLXM_trCFKsgiAKj58s6fy6EyOPJSUfV

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "177a897550166829af6f7d037d86a2d6"

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E6EBD962C8A311E48FF2C56440BD2A7D" xmpMM:InstanceID="xmp.iid:E6EBD961C8A311E48FF2C56440BD2A7D" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....IDATx..Zil\.y=o.}...CR.6...}..6...v....l(..h."......E...Q4M..1P.-..N....$.lk."k.,..HQ.Dr8..g.~{...,...&..R.......r....> B....../..(.TU...m7..q.....S...W...H_..................)..,T.........h....H....!...]1#...........l'lx0....g.pZ..Z..k!lW....'9..T..T.................g.....u=.!OU.S..]FWb$.......r....VSQ7..u........C9.o.....;.......y..y.8.x..v@a.......=..9|......C.do2.M%.}.Y..T..l..../.M..e....~.....s......W<G...3l9.1...g......D...F&...}..{'{...SF:.C<l .V...Bw6.......DmT..t!...x:....{...c..O.y.Q.|..l.....f.\.&._.i..v`9...CS......H....9..............Gx>.5........\..MO...,...

<<< skipped >>>

GET /img/Cazurazihiz/Cazurazihiz.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 5983

Connection: keep-alive

x-amz-id-2: ccv9kduy9eFKJMIUUKSYh5eewT796F2bYHLmLUOvlAPC7yrA17LdAytDQYKDm d2a1YdpA3M6w4=

x-amz-request-id: DC47B400D218DC6B

x-amz-version-id: wyC6mtJU.8C8djRcSmCE4rVxqum5xvWX

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 17:53:51 GMT

Last-Modified: Thu, 31 Dec 2015 17:54:18 GMT

ETag: "a22c3d2918d1834d285dae064d3cee86"

Accept-Ranges: bytes

.PNG........IHDR.......'......i:.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtAuthor.Nir SaharZb].... tEXtCreationTime.2015:06:24 17:02:12a .A....tEXtSoftware.paint.net 4.0.6..c.....IDATx^.[y\Tu.F....a.a`.....4mQ.7..Y...Yo.........[...........H.............;....sirf..L.T?.x..{.s.\.<.9.9.........j..-....lA.....q.4.'.EN..........Z?-...h[..O....F._.>.......)~J$i.X..IP!Q..d./R...9.l..1.....}.. .\C..q..0..A..PlT."..5...E.-...Z...O......B6!.>.Cs'Z.P.....u.X...9N.....8. .fW).:t@Ix.}..u.....@.).~1.[.=.@b.....>r.PLD..I..mA ;....t........l..T....G...'...G$..iE.9........-.)....To?\Y.C.`r--...lp%a...T.f..be.. .p.w.b.8...hk.;.H...p...8jk.#...u..j.s'. r.9.,[&.=..9...)v........<....t..........{..;..D.{.v......8. ....{:.b...Q..].q.I...".rp.v....J.9:...#r.mq..=K..2Y..L..w..~"k1..........U..t.............q..A...Q.....0.....!Jk..>Dd.Id; ".eC)...1R.lg'....U....w....b_..... 0$...V...QH..`.L..bVIJ..r').fS.>b...R.|.?CjwXd..r9.rO.e._`C8s..>..S.....|.A=...{......#Gb..U8}.4.Z.\...C......1L.>....>S..8.c...]..7...K..[o..y.....{..h.....@.......q..I.........^M.....PRR./................k.k*...Z?d...4...ze8..'.VdC........Y.....@E.j..s.?q*.CC..;.....e.. ..4..>.".....:u.VgWJ...$.f.rC.....<.).^G{,..B...o.%..........#::...-Z..s.b..ax..7.../ **..7?W(]..v....&&....a..-..e......}||p....Y..5l....>..p..........4...g....C....{....a..a.....?...{..?..rrr......7...VXX..V......c..Z...0.....H ...8...M)........T.....vm...2..~.. .c.{}.;..C.........z..u.....=?G........%b.{b..............JFd....0....7.9?"...&g

<<< skipped >>>

GET /img/Fividof/FS_BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 20910

Connection: keep-alive

x-amz-id-2: HQ1LxsBTvqZqYDrh6M/zoVyC0z7rDH98mZskcq4oav6EBVIpuw SWGw/0PJ/OdVAsAdJYzLF8W0=

x-amz-request-id: 60CEAC10DEF0656B

Last-Modified: Thu, 25 Aug 2016 16:15:53 GMT

ETag: "20838f981ab877adebe8cc27d8fd8e8a"

x-amz-version-id: NGHte6ooz0o7QShucGRMfn4HeyGT11cm

Accept-Ranges: bytes

.PNG........IHDR..............u......tEXtSoftware.Adobe ImageReadyq.e<..QPIDATx....p\.u.......9..s..pr.&..fd..%.A............^...z..d....gK.% Z..H..C.sN ..r...}.sn7.. ..`...Pw.h4...=..~... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ....&.`aq..v-i..RV...<gV..4...V..kId....-.....A...n...}W ..[...t ..^....."..y.V...P[...Xm.j.....1.L.....<"gR..A.X..=..M.l..@..l....V)..Q.*3)..j(W?...=...6...j3....~.4...l:....\._.. ......C..)=-.;..J]. .Cm....W...>.V........6{Ndmj3...t....:z.. ....S...K./... .. ....x....d.f......kR.T.(.t..N!.r.f.u(G..Z.^.)'.......yC5...E/.9.]....x8....7...5.t..._M.;(.. .|..m....vS@.hYVG.:m...O.....). T.U\r.p.\..N...dB"....gq........<....v^m/.mg....m.I.X..A.....N.;..4d.z.:5..T.J|26u...I`i..B...v....bF*.........HGS..w:1....U]...R.Km.... ...v..~.d....f*..].Mk.u.(.........6....}.....dV.7.......w.#..\K|..j.P.Q.......]..M.?.A....Y.G..H."kS..P.'...b...?.....;JM&miV..4v.ZQ..TBKn..;."..w.C.Jx.....G{1.5..6.|-.M_TO... Nf.._..ZZ.i.. ......A..D....^u7mT..e;.w.:.b.4o........M......f2l...7M./.m..8.\.a... ...4.d.....3j.G...u..K./.... ...D.....h.d3.Y=KM&...T.D.Hm.0.c....`),L.b.._.Y...V...6...gV._.@&......7K.`.Z......Sh....`0.F..[.....3j.K.j.qQ9...L...J.W.... ..}$.....,...PIb....%.E..j.j...,.q...='.N..............7.y........2vTYd.X..D..;[q..yt.u#.I.Ix.|d...gCv5XL.8...J<.W.._......*.F.~........C...^..?Y...D6nW....Dk.6.O....RbS.../.01..n..V.Hv..(7.%.(.)....C..Z8.....I..{/8.af...d..`..'/...6t.w.....zYJ......_..f..`.Y.k6..v.W.S..

<<< skipped >>>

GET /img/CH_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 4849

Connection: keep-alive

x-amz-id-2: hRwhydxNImwzzPR/2b9GjK6XfgeNkPblqSsAJ8faKBdoQeqQFYeB30OX3JU1oxYp

x-amz-request-id: 40553C13EE53B317

x-amz-version-id: omxwqkFcs1tUW940Ss4VTxiINXau15QT

x-amz-meta-cb-modifiedtime: Wed, 18 Mar 2015 10:35:00 GMT

Last-Modified: Wed, 18 Mar 2015 10:35:12 GMT

ETag: "ba264606ca1d89ed519c9b8b3515f163"

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:B8B544DFCD4F11E4BC7FA5DADF6159A3" xmpMM:DocumentID="xmp.did:B8B544E0CD4F11E4BC7FA5DADF6159A3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B8B544DDCD4F11E4BC7FA5DADF6159A3" stRef:documentID="xmp.did:B8B544DECD4F11E4BC7FA5DADF6159A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..<....eIDATx..Zyl..y..9...\rEQ.%J.M...I.U...4E*..].A[.h...:hQ.)P .Z.@.(..H]4..*.R7Q.D.m].bK.%X.uQ$%...s.cvf...f.,W.%..x....y...}......!.Y;.c.YQ.=S.....gOv...6f.~.=9W.g.........:b4..d..8.m....o=...;]`......I..'.......3..u1:...\......No..p..\...... .h-..QF X@C.....*..#..........?..|.4>.........4...Ohl.^....Q............?..B2.^...!8.)4h..Me...$/8...}}.8.v..{9.cc....T..).p..{U.......8.'....o...Z.....fw!..OBD...PiIE..\uFT. m....z..w.`...p...p....d27h.C.)N...*.<9.]o...-(.. .Y.T2.P8.x...d!..!...S......(.........5D..t...S.,]....\;......H_8V..c...t9I......d.6.E..*.'..]O..1.!-!c.\7........N:.

<<< skipped >>>

GET /img/Fividof/BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 27707

Connection: keep-alive

x-amz-id-2: g605q2NKKixxbJLPZIN1bsjOUGJ0l/wdIrUW5dHtTAKje0wL61ynadgsK/8az9LRa98L96O0K3A=

x-amz-request-id: 783049A002A7BE3A

Last-Modified: Mon, 08 Aug 2016 08:08:18 GMT

ETag: "024f03602a6f7fe69592f9472cb01d4f"

x-amz-meta-cb-modifiedtime: Sun, 07 Aug 2016 14:10:06 GMT

x-amz-version-id: X3Cs5_ZFW8itsyxo6oqulRxPSOcm3fMR

Accept-Ranges: bytes

.PNG........IHDR...0.........6..I....tEXtSoftware.Adobe ImageReadyq.e<..k.IDATx....t..u.x.Wt7.... ..../.I..IY.#[.$/...I~.3.bYV...s&/.3o9y......Ifb.yq.o.%[.%."...wp.Ap.Bb_..Fw.....F........'.......j.~u.w.%.....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ..f.4Y.....n.B..[w.>..H..B".H#.\'.j.v....../............a..].Rw..4= .w.:.."..2.Q...P.;O=.W...$......W.[.....>\.ey...>........;.w...#.......k......|$...k^.,..t.J5..@..jE<........k.T.......6x]...R.3.a......5.c... .P..u......e...aM..F"'.;.m...g.....:.G.j-..".I.S.....M...r..B .x^T.O./....Z....k.4..9..C .(\..3.......fE.....5->_.]...<.XL..CNM=R>< .1...H.G.5...fzma..p..S.\......<......=E{N.......e...]#....Kj{v4C9C..g.w.......5~A..[I...e.u.w^...fp.5..1......N...E`L...I^.xN}..>1..-....F.........[.iN*.i....E.k....5.....A.^P..\......w....d...th]M]...8...HC%9h...v.I....?\...Y..O..b.,1....i.....i....z6...........o.....c.I..4....e...A.}|.]......"\x..w o ..9..u..5.:E_..|.L9.4.y@P.4....!.Ns.o..........z.......Z....V...$.W..y.5..........e..K.pn.y.....p.o..........|.t..-..9.;.....u...5...6..4\.X....g.......8/...........q{".k;^.tn.>.M.. ).v.o.<..I...=.k..M.5.L.K.6.A[.q.c;b.k.X....-A.8..9W4 ..I.......%].'....D.h.....x...U.. ..x......8f.....E..t..5:...j..B......y... ]....T.;.....n.6x,......V.0..>{.f..m.6..............0..?GC..dC.l....?.;......x7.......G8.0....qs.....c..>.o...{.M..x.8....1.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:25:58 GMT

Server: Apache

Last-Modified: Sun, 11 Dec 2016 22:45:11 GMT

Expires: Thu, 15 Dec 2016 22:45:11 GMT

ETag: 8801994E2F8B53ECAB5430FEA9ECEB0829DD129C

Cache-Control: max-age=252552,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp33

Content-Length: 727

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0........~.=...<....8...22...20161211224511Z0s0q0I0... ........^..hl\.....W....r.=.....~.=...<....8...22... .n..u6l..n..|......20161211224511Z....20161215224511Z0...*.H.............;.....vfl6!..u.7...k.>W.7......}cNV....._..o.*...v..f..*....P/MJ{V.2..._l_ab\...E.p.s...h...r...nZ...zH..z"..b..)....."}...M..d..t...@d.#5..........]..D..1....\..aJ."o...rY..2..9.p.o...*...../...e6Q.b7fx..n..{.~........?......a..G..N..M.t........J......U.>/...H.[.}.S@.=S.....e.&o...@.....69EW@.{../..}F"6..}.Q. P..).5......,.Tc"d..l..#.HC..#.:).O.vO.e ....$K.....xk. w.q.o..%r..9/....f4..T.).!....`.(..E......S..h:q.... .a4B""..,,...S......o.UvA.74.k.i.Q......wH..........B..........}M..q"..U.$j...8.0..`.(.o`....

GET /ofr/Solululadul/osutils.cis HTTP/1.1

Range: bytes=0-4012

Accept: */*

Host: cdnus.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.0.10

Date: Tue, 13 Dec 2016 00:25:43 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: mIZpgm2rh5XAf9NquHia2m5qHfXQQUYKJLyWHhp5idRP7ymw7evUkyJHYln/zMC1KLl3S12Av/I=

x-amz-request-id: C9F1960A94F91A3C

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Content-Range: bytes 0-4012/4013

CIS................7...............P.......Vv/#..F D(.h]....TK..TK...#a .Kv.>y......U.:.i.......<.*._fq.~k...*......w.......@...GR..J......(......;.....c?..P....Rn..s..Sq..:.jF}..2.Io.^x.y.$.. ..Wc./..2...U....|.........a.'..z_S~..^v.6..L...Pj.5yMz`P.e.M.S........%K....3...`y-'....jB....cIL<...q.HS..Eh....&.X?tK>..n..?.y[d]...R......WD.\...&?..I......H..U.-gGq.../.6\..M`.j-5u...B.R..T.P_G.zLK.O3.c.O.}AD.dh.Q.."a..CCB..5K:(..2..'1./.....5......e).....v.G...N...?dBrh......5.3.y...Y0....J&.yQ..mpN[...7./....|.p.o...M>UB....., .z.....aT^9d..c...F*|.c(...;M"5...w-..H..|<...G.#.R.0.....#.5...~nZ...G..`...... ....lB..6..E%....=.....P....WY.!O)..VD.d.C..|.4..[a..>\..;...r6.../.G.<.P...D..J.*.;..}.a.8.b.....Z....Fad..j...O..1....%k.$.....v.6VL.u.......55....>.T..".QbOm3.....>.............V..}.".!..c%..K..cNhY...F.&...>.....].jI.07$Y..i8..S......HH ...0Z..y..7...y.R.,..h.k.[g}..{......0.\j..z.V.>.%.i1`7.t..7...u.O..T,.@LT...(k..A;$..~.....e.....k.w./.%.8.6.xn....P ";.i7.(@M..3.).P.&...\.g...H".su,........:m....6."../.8....c4.._.hBphnGq'....$...Z....,..]..R..yv)C.@...{..F...S.8..CY.s`...*..o..6m.......|q5..._.'C.....2....g..?511.8C.2..........qj.y..K.;8.....1^....}%F..... .5v?.CE....~d.%....&;_Q..9%.F.$ G.d......[.G.LU......6f.ne..........p.....s.......~...z..ap/.(...../.....QY..!...J;.................,Gv....r..p...Y.k..2..X..{....Q\........6..^....[.4..W...?@...*......?;v..hn`..~.7Q..D.F...'o.3...6...._...4. .B..r .../........c...Q....Sx..i.k......6b. iHoR.K..p...........n..*.......=..

<<< skipped >>>

POST /DobreProgramy.pl_High/?v=6.0&c=852899565&t=1312873 HTTP/1.1

Accept: */*

Host: os.bororeb.com

User-Agent: ICAS

Content-Length: 1392

Cache-Control: no-cache

.I..~...$$......xh....).}........@89?`...(.r..Uh...v.:..

.......y..^...8.L.3m....s....H..=....c...F. s....Dx.Akkd...o.|..K..z.pW.?...... m.Y..Y.f...a.&j}.R............S2.`....6.].......zn9...9..G...k.4.....^.....-....7xw..._.Q.,......'.j.}.T..qf.h1..=.L.}.~c.4...<.....i..4../..G...c...~.U.s..9...[.N..T1.Z.%. .....j.I..."....h:b.9.......v...Y.2.v.......D......KQ(a.wm.. h.'..-...t7.El:....\U.e.w..O...t.pmX.K....D..H..J4.2..E........z_Df....C<.Sv.!X..C-5.yWh8.<..................F9y{.nf0..<..5....`[..)....3C=.!..h...{.....>`...D.t0,f.e.......60Y....<.*.y.:....1.......(D..{.E..^Sm...$..{M\...r..t5.P._..:.........Tq..|..'......c....W.....q..*8.D.

j`.2..0l.>....k.=1..ri....?.....Qd.MSR. '..K4.../..w....k.E.......X.u.....t?t..ev.....0...3..w...}-./.M...-.WU).......9..;..!...z.....k..F.>.P......KE^Y..- =..y.".\....?4WV.M..

1f...,..7.....g.y0.......D.....I.TdZ8b..hE....d....W..ca......Y.a....D.yk>.O.........YT.:.......)?....$f)..T.`.._..Y.7I.<4gY3....oa..j....;...ep..e......-c.{G...p.-x.82.J...CPO..j....1..F>..V....t.`.*Q..{..4...b.........B.s.J.........e$...c.?...CX.... ..}..d62..6'.v..Y&..)..k.......Y......"......Q.Cm..2...`.I..*..=u..6....[.X..5p..J<..r..i.%...8.&....m^.R..BM....\*.....h..e...o..GJ..."......*.".U.e....n.Nta.......=..?..,W.>....f.xac....W........eh.V.s.V.v.Z=....a#......I%.^J-..

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Tue, 13 Dec 2016 00:25:38 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: currentSet20160925CSAIRS

X-ICSCT-IP: 194.242.96.218

X-ICSCT-SERVER-NAME: ads.slave-132-prod-eu-west-1b-c4c6c248

X-ICSCT-TIMESTAMP: 20161212192538197

X-ICSCT-VERSION: 1.3.2

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive

1ed0..q...ns..np;.5....U_........./K....'.k....:G..2 7rs..L3Wv.,.0.........i.*.......~p.E.."XW..?"......).........&......V}.K...xN..........(.F.c.6..$..I%. .<....C..m....f.iQ...8..-..M....s.....Q.a4... .f....n.p)...*....5...<..hn.?..m..X...&_..]....L{ 6J.............:.*..\P.....O...l1/....>I...mJ&..){d.t...'.....@.....X0?..Yp.K...^...;@......H..F0....o....3R...LZ...*.@.kjq.....\..T.'.-5..'.*.......E..iX..l-..7I..jF.)z..H.......,..?.@.\M]]..........LN<.B&......@JFD[h.-.../.e#.).p..N.$......t..~(.qHH......f2.O@..p.SN..k....-..^1N.gxdN.a.Q.1..........."...}.*T...}...bS..0o..Y.rh...L..w..4QP.C}Nam...=......\mJ;...!.r....Q........02..7?...~.".h.a........\....p..^.}.....N<.......c..4Q...0..F........e...O.2_........m../.g.;...F.. ....B......}T.WK................Y..x ....u......&..X..I-.......,...a....Y.O\....\Q.5...0....L....n4..e...u..a.d]J=..G?....#.6U$..\..-.=Z.T.J.,.7[......a=^.4P...0..D.S.g"N.Y...L2...= ..=..,....@..4).y....#..b...@.|4..@V1~..^..[&.[....3Id....@.......%..d<:..=.[..b...2.QI.eL..|5....H.]uG....n...-G%...3:...T...=.".tJm5 ...$..[.w.L...Z..1r..>.c......"........V....r. .W.F...b.p...rD.K...X.......-.I.Zp'...F....!. .l@...f..$..Kq......'....t.>..1O.J......5....^8./[.O......h.xU./....n.h......._..H..q.u.......I..I'.....TR*..L..]hF....\0.]..$....-...6.....XKP.....:....d...4.........t9=.D.-.YD&.Ii..n..]\mG.A..6..7........ CZ...)|. ..h......Qj...R.Ux[.....k..w.3..6u8...h.C[..PZ...6f..!...!Y..m@..X..fK.....R......-.'%l.3..N3.=...G.%`..du........i<..,...4.o.-.e.6. ...... .v..H#U...

<<< skipped >>>

GET /COMODORSACertificationAuthority.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:26:03 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d57767e944ceafdf9013082f81411b0681481588763; expires=Wed, 13-Dec-17 00:26:03 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Mon, 12 Dec 2016 19:59:09 GMT

ETag: W/"584f018d-30a"

X-CCACDN-Mirror-ID: rmdccacrl3

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Tue, 13 Dec 2016 04:26:03 GMT

Server: cloudflare-nginx

CF-RAY: 3105484b67764124-HAM

305..0...0.....0...*.H........0..1.0...U....GB1.0...U....Greater Manchester1.0...U....Salford1.0...U....COMODO CA Limited1 0)..U..."COMODO RSA Certification Authority..161212195909Z..161216195909Z.00.0...U.#..0.....~.=...<....8...22.0...U........0...*.H..............cu.....6H .....;.,e....m..;uC_O.h9SL..J...h....`L....C=.#:;......e.W3.i..D\..;^...a...#.g~.5...J.....J..Z60..6.O....T.U.%......l..Mo..$Tq?c.a.......h)...y.">.....z..\...).B_g.....2&....je-v.ZL.G$E.5IY&.f......:I.O.....I<L....q^.....%>..!(e..R..Bc/.qI........q...Z5..9.F#.4...........vL...(#X..Id...5.....8H.."......G.....yd>.....q..`.....}.*@3../H...|.e.c.T.F/.W..`....$.9c......'j.a...u.#.(.b... .".|..{..../Hu...'.|.wN...b.w..B9b..0p.D...X...%....o..MNyCIi..pqB.y. ....T}...M.:s.<x...q0..p.8..#..Vi....h........0..HTTP/1.1 200 OK..Date: Tue, 13 Dec 2016 00:26:03 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=d57767e944ceafdf9013082f81411b0681481588763; expires=Wed, 13-Dec-17 00:26:03 GMT; path=/; domain=.comodoca.com; HttpOnly..Last-Modified: Mon, 12 Dec 2016 19:59:09 GMT..ETag: W/"584f018d-30a"..X-CCACDN-Mirror-ID: rmdccacrl3..Cache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: Tue, 13 Dec 2016 04:26:03 GMT..Server: cloudflare-nginx..CF-RAY: 3105484b67764124-HAM..305..0...0.....0...*.H........0..1.0...U....GB1.0...U....Greater Manchester1.0...U....Salford1.0...U....COMODO CA Limited1 0)..U..."COMODO RSA Certification Authority..161212195909Z..161216

<<< skipped >>>

HEAD /ofr/Solululadul/osutils.cis HTTP/1.1

Accept: */*

Host: cdneu.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: RFxp/IeGoOV9VauHEovMYSOGghIv7TmBStAJ0YlNl2GoAPsPG4/4Qr0JHGlxnCpLevEyTZWZzwQ=

x-amz-request-id: 9E953689273B2B16

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Accept-Ranges: bytes

HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Tue, 13 Dec 2016 00:25:40 GMT..Content-Type: application/octet-stream..Content-Length: 4013..Connection: keep-alive..x-amz-id-2: RFxp/IeGoOV9VauHEovMYSOGghIv7TmBStAJ0YlNl2GoAPsPG4/4Qr0JHGlxnCpLevEyTZWZzwQ=..x-amz-request-id: 9E953689273B2B16..Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT..ETag: "569022425db355c9d82beba6efc44f22"..x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT..x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l..Accept-Ranges: bytes......

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=0-101028

Accept: */*

Host: cdneu.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:42 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: dQ5GZhJbm460bZAf9RDvuSrDFCZPaVITqQc/GHAzXf4kWT9F I6FTEyvA73/ulzp

x-amz-request-id: 7977B875E949F9AD

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Content-Range: bytes 0-101028/101029

CIS................?...............P..............M.U....$..q.X]....9u..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B>Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4..6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu....-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*..b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w..."......I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.ZI.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E..dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h

<<< skipped >>>

GET /pl1-sst-x.json HTTP/1.1

Accept: */*

Host: config.sensic.net

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1 200 OK

Content-Type: application/json; charset=utf-8

Content-Length: 274

Connection: keep-alive

Date: Thu, 22 Sep 2016 19:52:16 GMT

Last-Modified: Mon, 05 Sep 2016 10:24:21 GMT

ETag: "c5a9574673773c034c79a971904d6ad0"

Cache-Control: max-age=2592000

x-amz-version-id: bnmLALsHBmemZPs7BLapB6YixtqwNrwy

Accept-Ranges: bytes

Server: AmazonS3

Age: 1789407

X-Cache: Hit from cloudfront

Via: 1.1 ec27b2a550cb7db6ef54f74603010b29.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cEh4NqecaxvvOyZBPR-n0X-BQVraaH2Jm-9-irJQqM4DhzENA_uCnA==

{"version":"5","tech":"sst-x","enabled":false,"project":"pl1","projectVersion":"1.4","trackingUrl":"https:\/\/pl1-sst.sensic.net","dnt":false,"suiUrl":"https:\/\/sui-generator.sensic.net","systemParams":{"version":true,"useragent":true,"referer":true,"os":true,"lang":true}}HTTP/1.1 200 OK..Content-Type: application/json; charset=utf-8..Content-Length: 274..Connection: keep-alive..Date: Thu, 22 Sep 2016 19:52:16 GMT..Last-Modified: Mon, 05 Sep 2016 10:24:21 GMT..ETag: "c5a9574673773c034c79a971904d6ad0"..Cache-Control: max-age=2592000..x-amz-version-id: bnmLALsHBmemZPs7BLapB6YixtqwNrwy..Accept-Ranges: bytes..Server: AmazonS3..Age: 1789407..X-Cache: Hit from cloudfront..Via: 1.1 ec27b2a550cb7db6ef54f74603010b29.cloudfront.net (CloudFront)..X-Amz-Cf-Id: cEh4NqecaxvvOyZBPR-n0X-BQVraaH2Jm-9-irJQqM4DhzENA_uCnA==..{"version":"5","tech":"sst-x","enabled":false,"project":"pl1","projectVersion":"1.4","trackingUrl":"https:\/\/pl1-sst.sensic.net","dnt":false,"suiUrl":"https:\/\/sui-generator.sensic.net","systemParams":{"version":true,"useragent":true,"referer":true,"os":true,"lang":true}}..

<<< skipped >>>

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT

If-None-Match: "200da-5b6-4eb453c33260e"

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Date: Tue, 13 Dec 2016 00:26:38 GMT

Etag: "200da-c30-5430486bd6ad7"

Last-Modified: Tue, 06 Dec 2016 22:00:03 GMT

Server: ECS (arn/45CB)

X-Cache: HIT

Content-Length: 3120

0..,0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..161206213102Z..170303213102Z0..s0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...150603184605Z0....'k...150603185020Z0....'k...150603185058Z0....'k...150603185131Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173

<<< skipped >>>

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=0-101028

Accept: */*

Host: cdnus.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.0.10

Date: Tue, 13 Dec 2016 00:25:43 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: sVVw879Rw1z0U8R9/j v07WScKQK/sIYEvWMRFfijxkiF65X38cehO6jREX5W/K2cEtAjn70WeU=

x-amz-request-id: D36AFB311361DCAA

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

Content-Range: bytes 0-101028/101029

CIS................?...............P..............M.U....$..q.X]....9u..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B>Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4..6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu....-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*..b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w..."......I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.ZI.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E..dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h

<<< skipped >>>

POST /?v=2.0&pcrc=1858890704 HTTP/1.1

Accept: */*

Host: rp.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1936

Cache-Control: no-cache

...3E.Q)_l.y...K..a.hr...:%..

..q...pF=.>. ....$.XB..P.vB'....q.

#.&.C..Ud4.Z......8.....I.#.\a..1<.....,:P...v.Fu.g...Er.........Z...CJ..F..{....[%0,.M.F.=......A.. ..a... .......X.1.W..N.z#...I=JO....-..7.j $a......x..|9....n......}.....}y.cN.4!H..q...._......W

........nD|L.\. (x._..c..X....b<@..ye....*..Y7...H;.9...Tga6-..k.z.#..q..E.......U...gw..w..)i.b...yv......7W7l..

...X.ic.1..i.%....8Ib$."y.....r.q.}.H.t-.X..#......).......c.~...B.......`.-.. .....1s.*....7A$mp.........U.8.Yp......n..]{.....'.....8....s....a..A.....$..Y.bAR..._Yd.{.9.......m..D'4...u.........%......O...G...i.'C.B.{..nh.m*.....I.$,.;..#..f.LA..*J&_,....H3!..8.w..4C...*s2...'G,.P..h....(..hy..[.WHs].{L..Ozz..7..{.{......m;|C.......V ...>.O...M.N..hj.......

..J.UI.K..@...L.[.0....$-.......4 .c$K....@.H}....4.......B...kvC...~.

.....e...!.c.._..e...=.;[. .Y.....25.qg.}.@.X 4...U....s.c.-.&..&%.....hK|..K........D..9D..9.GQ.v...b8..:%...zDtK}..A..=...-.1q..NT,O`.....lC.<.0...r..=>w....'a.<(*{N)3._.d$y.Xz.K..v.*3}...Kv.~px-EW.={XPf.;z.....oNM....o ..,R...#.S. ].U.#..NP0AQ.uo;..t......

9.x../G..`...Uj.\...".O..H...`..^...k....x.]Y . .Kg`.^...b.>....

Guz...,.\2............k..{...Au..H 9F.>aRq...a.F...J.%..s.....eY.tFe&.&b.....u.^./...)@.\C.r|.....&{....j.gU<rX]..F....)}...9ch....L.}5....>T4.

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:36 GMT

Content-Length: 4

Connection: keep-alive

DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue, 13 Dec 2016 00:25:36 GMT..Content-Length: 4..Connection: keep-alive..DONE....

POST /?v=2.0&pcrc=775274733 HTTP/1.1

Accept: */*

Host: rp.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2352

Cache-Control: no-cache

...4.....>.K..~.w..J.i.6D%..5.. z)

J".]M...4...*....j.........J%n.4^....p.......e...}

$.f.K{......X....uX$.^.......H..G.d.T.R.5...f.=._(&..Qi.........t...T.N......b:.......y.Y.`.!]...=...e.'o.{...f...M.,......?..;?.F.;]...HK.....}..).hS..,2..p..Sme......\...U4...kl.$.R.........Z.T.B..... ..l....F......Y....?$.R.?..[O.$ .C.5..O.LtR.S.....??.Q.#......$c..

..S...5(gS=.c.Y..t...am|a...;f%....4...<.n.dg}\.........T0..u..W.y.-...'.AM0.......|@.....vA....D..G.:)%.~.q....NO..F.).1....B.. ..-.......N...Y&..<.....Lm....o.....D..cq.AO....R...s....J-..kK....F.Bkb.4..)0....<....v1%J..(AM...K.....8EX... ..Z..fd...0z.........$w..{:.A.......... .4...e&.`|J... sR.:......S~.....W....-.K"pBI......0..w\3.G.iU.5S|B...T.D....o..b.j.2r.(G!M..B......K.B..^.....s>.....c.!;=//o.....R).X.Y.6....Ox...y6'`."r$.pg.**.. ...>....s!.x.B....U.._...$.....5...V..L_../.&y.."....i....4..Zl]...........TR0.Y.z.v.%....j~]gT ..(N]..h.\.. .<.A........f&...g.v@..PmO..r^.b.q.. S..|-U......{....C:.6.s.(Y2........'%V.#mF.-<y|9n.(..s.:z.q~R7s...JV-/..5.b.t.i..}

...BD./...mG...W..I.....2K....x..".4y..m5.N...7.r....6........#7f~..q.PS.~.9z.......n..#C..............fd..8V!...`.

..\..C..4......J.3%^4.8/,F......Sy.n.E5.Xk.\.....T5Lw...Y)[..8..<..~_.!..b.3.`.tA;.X6.(...

..N.....6x:.TO....6....\...i.........`.Z..R.........:L...

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:38 GMT

Content-Length: 4

Connection: keep-alive

DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue, 13 Dec 2016 00:25:38 GMT..Content-Length: 4..Connection: keep-alive..DONE....

POST /?v=2.0&pcrc=1988936779 HTTP/1.1

Accept: */*

Host: rp.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1568

Cache-Control: no-cache

....V.....2$.....j'.`*\.8..,u.4#..y.....e<.........~.Q..h.c.!ob

.......k..C....o]...1.4.a.--Kg.Nf.......pd....\....i.......Pf...P....."... l...0O.Ur...4..m..C...>`.}7...{.yQ..V.....6.a.pU..../Z..{?.giI.........H.......fig...,.#..l..p.,0.F|7.S..c$a.c...........et...p.<M...w.N.r..:..".w.&.ejF!....I....:....{....../.a-(

...A/.....[.I>]M.........;..n1s..d.-....<..A.=-....W.MeU4......%..6s..t...}.*....U.....*.4`.!2......Z..3..A?|-.....5.U....E...K~.#.....`TS.......)..."..zq..).H..F.W}....`-.P`;.Ir.~.py..b..f..]..8!.@.L..1p$......zft...}.....3..t.. ...{a.=7...i;.....T.y2...F.M..2$..k.A7.<...t|.....Y.on.PW.U;.....=x.Zn<t]...`....>EN..IK..Dw.........9..c0....a.&..o.......g...u..X.={..x.....9o...E.~5b:..\..dn"1..........T..]/..R.</...q....Z.0.}........'.i....._.<...c..5M).G....1..H.Y..>.;..8..m>0]..!*U......xV? ...*......}....32-qcy.1T*....ud..g QU....s.(a...vI9....@.E...T..8.L..\....:...w...x.$..:A^.6..M7)2j...^.(r....d...^..W.2...M~n.......Z.....R.A.6..........}.#.....K....

....O......j.?...Qjj...l?E..%.l.g...r:..........uS.i..D9.$...G.m.pP......V.u..^....E..9....6(....Z...6..9.e9...5..%.^.r......T.d..BR.y.P..h-K.1....C._f..(.....kN.......y.....S.R6\..{. *6.z.D.......Jk......0..IP......}.v..8>.....O]n...B_......@.d.X.o..w9.........,.....5...\![...A47#i..]......D|..s.t...e

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:57 GMT

Content-Length: 4

Connection: keep-alive

DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue, 13 Dec 2016 00:25:57 GMT..Content-Length: 4..Connection: keep-alive..DONE..

GET /pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe HTTP/1.1

Range: bytes=15564800-30510919

Accept: */*

Host: download.videolan.org

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.11.6

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: application/octet-stream

Content-Length: 14946120

Connection: keep-alive

Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT

ETag: "56b5c1cb-1d18f48"

Content-Range: bytes 15564800-30510919/30510920

X-Clacks-Overhead: GNU Terry Pratchett

..S.]@....& d..A.......G.....X<p.^...y[.iy..35...`.....d.*).%.....%~%T...y....A...p.=C..J<|R...!...SG...|..!...'..R .c;.....Nd.......^z....[.\....X...i'yY...%....0.jjo=D.V..T5jv.?.^.d.....Qx.k.....*...N....N......d...x.....?.6.#.2.....sL..).....%8'.*.K...~]..%......|...].T@..b.j..EJ.Z..j.....0I.K.......g.O..."H.../{..T...u..N...;DR.Jezb.=hRI....,.6.Mz?..v.0..NM...v.7.....a.r.........Y.;..K.?&IB..6/.L}.u..........5...0...[....!S.....9.3{......."F<f.^NL..(..c....I..............j.~G'.(q..I...H.L...D...v......>`.bU:..q.?..9#.fC..i....m.(.e.....l.....R>W..p\./.g..q$..|: WS.j........:.......E...[.....Y......@Gd..\..h..PY........My.-W...@..s..]d..Ce"`8|...jT...`o.s........<..?|..4...F..m;a.f9...3n...Z.*o.g#.[..f.[.w,a.....@^....023z....;oP..........\....X...%..O...........d'6.w.J.@..............u.KX.I..K;E.............q......H......F..X...;.!G..>......u....[..'....e...... ;...kk.z.J...xI. ...'I...Q0.b.c...M....}..M......aw.V.N....u..$...G}.....F_..._..Y=u..\].$..P....b&..a.......P.....u..G..~]..b...\_...gp^....J..".jjZk..E..8.(..).I.....fF..;H... !....7.h..K..$q.N......xl1..'.8.8./H.i7....-.Er....k...Z.|J.6............uK$.=.....=...*o...!<....Ne@ ....}.%....g....m'.x...i.e4.-.....a..6.F...0.....4/^....Q|...I.\...^PMK..0..kb3.1.9...u....#......t5.r..`Et.".e...\..nH........v.F.... .3~.|%'......i.*..,......-...Z9...4...d.^........G......C..h.....$.99../........R..>...I.Z.8i...#....E.k..}...'F.?.Z.........RT@IK ePn.in.T..*.....Y.../..^........r.>e.....@.i...G5Z.....1..#.*.....8....fY..6....*.

<<< skipped >>>

HEAD /ofr/Solululadul/asgnd.cis HTTP/1.1

Accept: */*

Host: cdneu.dobreprogramyplcdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: dQ5GZhJbm460bZAf9RDvuSrDFCZPaVITqQc/GHAzXf4kWT9F I6FTEyvA73/ulzp

x-amz-request-id: 7977B875E949F9AD

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Accept-Ranges: bytes

HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Tue, 13 Dec 2016 00:25:40 GMT..Content-Type: application/octet-stream..Content-Length: 101029..Connection: keep-alive..x-amz-id-2: dQ5GZhJbm460bZAf9RDvuSrDFCZPaVITqQc/GHAzXf4kWT9F I6FTEyvA73/ulzp..x-amz-request-id: 7977B875E949F9AD..x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3..x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT..Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT..ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"..Accept-Ranges: bytes..

GET /?f=json HTTP/1.1

Accept: */*

Host: sui-generator.sensic.net

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Cache-Control: public, max-age=126144000

Content-Type: application/json; charset=UTF-8

Date: Tue, 13 Dec 2016 00:25:37 GMT

Expires: Sat, 12 Dec 2020 00:25:37 GMT

Server: Apache

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

X-Maker: DomiX

X-V-API: 1.6.2

X-XSS-Protection: 1; mode=block

Content-Length: 79

Connection: keep-alive

{"id":"2279428cc7ff9feadfcc05bb2dcad8b9|68444","cd":1481588737,"lt":1607732737}HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Cache-Control: public, max-age=126144000..Content-Type: application/json; charset=UTF-8..Date: Tue, 13 Dec 2016 00:25:37 GMT..Expires: Sat, 12 Dec 2020 00:25:37 GMT..Server: Apache..Timing-Allow-Origin: *..X-Content-Type-Options: nosniff..X-Maker: DomiX..X-V-API: 1.6.2..X-XSS-Protection: 1; mode=block..Content-Length: 79..Connection: keep-alive..{"id":"2279428cc7ff9feadfcc05bb2dcad8b9|68444","cd":1481588737,"lt":1607732737}..

POST /?v=1.03&c=8b3a4081&at=740357246&cntr=0 HTTP/1.1

Accept: */*

Host: info.bororeb.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JnebO9zNClW1HChgRzJAaHN0Ws7tGqBG0g4IpRF2Y2WJBa4s7wtRV9e/xw6zG/PtKOcd/jCSpNUEb9Len6j36LuQO 6ffOkV9C QeWysc5LISC4soJFcNlZXA RgdfnOzhnMjnIphWFG7nZHvzFRPSQ=

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 13 Dec 2016 00:25:37 GMT

Content-Length: 704

Connection: keep-alive

URtj3NkzNBN4mJ0gp0we790pt9ctigwSyTlvze9FbjkGoIlUlj3RCGW5AWTsfr0raHpOobNtGkrjG21dglxX3p/0bSzeWifgsGEOtalbbnbvaL/UwWBHtAmHyivWL8QJmUUBEKke3D6I0PKSbLnMB8VgtyWyF3ciM1lRmOBXrEBfDVSiYLjelEa1Lp9cV8U7dp5MavbUcGDNJqUvgN7S pmLGFu04/Eh9SmlkuZdZ0w6LfBlFhPaBoucz4m4H3/hc/3mgqvncyEzmPaRjoaLnnk0vJz/AWYOyWKzgBj/3oGFoJ6g/LVSzULM3AZoHwWGeekzz178fNpGzHjAiKn1u3Wr4S4w8Cb4vfb0bmi3izLK971DG174ggPs4SeZz8f04OhVabiXA4aflfXpxEZ3aUd efM2gq8w8DCbQ zNrVJBsy VJfTNX7d9cXfyPJSPncSAfAolxRR OYGXPu0IYjd AlWDX167X38CJ75APYHM62JaD2SslhUTX/8 p8E07dhwtmuxxfXcUisZUvcJFo5UHlEqm9qrHEUl8NJxh r xOdtpB9E k2HhubMra/EfcNLlNu B6/ELI2sCNBjhW77XHgvGKT1zWrDE7s43GN5iWc4lQN2CjYBq0RB YUexmW/maEJoYuY6UjNoEy azihBlAWuql/QefiWtB56nzbk8nwyJG8Y0uSIr0cqWLKHTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 13 Dec 2016 00:25:37 GMT..Content-Length: 704..Connection: keep-alive..URtj3NkzNBN4mJ0gp0we790pt9ctigwSyTlvze9FbjkGoIlUlj3RCGW5AWTsfr0raHpOobNtGkrjG21dglxX3p/0bSzeWifgsGEOtalbbnbvaL/UwWBHtAmHyivWL8QJmUUBEKke3D6I0PKSbLnMB8VgtyWyF3ciM1lRmOBXrEBfDVSiYLjelEa1Lp9cV8U7dp5MavbUcGDNJqUvgN7S pmLGFu04/Eh9SmlkuZdZ0w6LfBlFhPaBoucz4m4H3/hc/3mgqvncyEzmPaRjoaLnnk0vJz/AWYOyWKzgBj/3oGFoJ6g/LVSzULM3AZoHwWGeekzz178fNpGzHjAiKn1u3Wr4S4w8Cb4vfb0bmi3izLK971DG174ggPs4SeZz8f04OhVabiXA4aflfXpxEZ3aUd efM2gq8w8DCbQ zNrVJBsy VJfTNX7d9cXfyPJSPncSAfAolxRR OYGXPu0IYjd AlWDX167X38CJ75APYHM62JaD2SslhUTX/8 p8E07dhwtmuxxfXcUisZUvcJFo5UHlEqm9qrHEUl8NJxh r xOdtpB9E k2HhubMra/EfcNLlNu B6/ELI2sCNBjhW77XHgvGKT1zWrDE7s43GN5iWc4lQN2CjYBq0RB YUexmW/maEJoYuY6UjNoEy azihBlAWuql/QefiWtB56nzbk8nwyJG8Y0uSIr0cq

<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQCdZZ9r88cafMgPHXnOMOGm HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:26:11 GMT

Server: Apache

Last-Modified: Mon, 12 Dec 2016 21:03:34 GMT

Expires: Fri, 16 Dec 2016 21:03:34 GMT

ETag: 749E739399D22393DA8DD7E8A4945B1BCD655D58

Cache-Control: max-age=332842,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp25

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0........j:.Z.....Vs.C.:(....20161212210334Z0t0r0J0... ........z.>...*,.(....F.@.......j:.Z.....Vs.C.:(......e.k...|...y.0......20161212210334Z....20161216210334Z0...*.H...............D.N...pD.{$Eb2..`>.[.. l..d.......G".[..$>.K-........:.a#Xu......jIA}.. .F..j...\...|U*...~... .*0.......;...s....^...2...)....(..........o.oJ...:.0...8.I$..b.rJ...Q@.h....6F6.}...n..........@../....}...m...V.xR....v....y..%.-...S........E..=.#.7.......!..

HEAD /pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe HTTP/1.1

Accept: */*

Host: download.videolan.org

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.11.6

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT

ETag: "56b5c1cb-1d18f48"

Accept-Ranges: bytes

X-Clacks-Overhead: GNU Terry Pratchett

HTTP/1.1 200 OK..Server: nginx/1.11.6..Date: Tue, 13 Dec 2016 00:25:40 GMT..Content-Type: application/octet-stream..Content-Length: 30510920..Connection: keep-alive..Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT..ETag: "56b5c1cb-1d18f48"..Accept-Ranges: bytes..X-Clacks-Overhead: GNU Terry Pratchett......

GET /pub/videolan/vlc/2.2.2/win32/vlc-2.2.2-win32.exe HTTP/1.1

Range: bytes=0-30510919

Accept: */*

Host: download.videolan.org

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.11.6

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Last-Modified: Sat, 06 Feb 2016 09:50:03 GMT

ETag: "56b5c1cb-1d18f48"

Content-Range: bytes 0-30510919/30510920

X-Clacks-Overhead: GNU Terry Pratchett

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..V............................]C............@..................................t........ ......................................p..Pk...........q...............................................................................................text............................... .0`.data...............................@.`..rdata...i.......j..................@.`@.bss......... ........................`..idata..............................@.0..ndata..............................@.`..rsrc...Pk...p...l..................@.0.................................................................................................................................................................................................................................................................................................................................................................................U..WVS.......U..E....t...F..........B..H...H.......E..5 .B..D$..E...$....B.SS...E..E......D$..E...$....B..E.WW.E......E..}.9}........E.)..E..FT.........FP.....E.....}.........FT.......FP..E.....}.......FT..........FP........E.....}..........E..M...$..`.B.R...E...D$..E...$.D$.....B.....<$..h.B..E..Q.H....~X........F4..$..d.B...W..........$.E......E......D$.......x.B.RR.FX..$.D$...|.B.QQ.5p.B...$.|$....E.R.E.R..$.D$. ....D$..D$......D$...B.....B..U......$.T$...QQ.<$..h.B.S.E..D$..E...$....B.PP1....D$..E

<<< skipped >>>

GET /img/Malaromoro/bg1.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/jpeg

Content-Length: 190754

Connection: keep-alive

x-amz-id-2: Xm5lXmLP2cUl2h qsCCcipUNqtJpSKI73ydSseaplmaDEaSDB/zdYhr /X M03gK

x-amz-request-id: 0C7DBCA71A368EB7

x-amz-version-id: EqXw9hQ1szW0X1KVab90EKpMdqK_JEeL

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

ETag: "04007b142892c379ac83bd75ac617cf6"

Accept-Ranges: bytes

......Exif..II*.................Ducky.......d.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236" xmpMM:DocumentID="xmp.did:0699FCAEAA0111E389E68AC7CC963200" xmpMM:InstanceID="xmp.iid:0699FCADAA0111E389E68AC7CC963200" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:069AD74DE0A9E311B383BEF54B638275" stRef:documentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................0...................................................................................................!.1".A..Q2#.aq$..B3%...4.....R..Ue&........................!.1..A"Qa.q.2#....B....R...br3...$.CScs.4.T%....Dt.U&............?..../*z..E].c..H..S..^g*...B....a.<.Q.....A ...$..M.>..M..........i6l{..p..rMdu..A1$...........r5W..S.......mmk......}u.......=#<...Dh...;.V.....N.r#;Q~...us..EO.

<<< skipped >>>

GET /img/Tuburera/logo_b.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:40 GMT

Content-Type: image/png

Content-Length: 11762

Connection: keep-alive

x-amz-id-2: H3uBwzKM1BCL4 SQoFrUXTe byulszniMUXp0E7iZXMnRoTShOGexE7xccEJWUsA

x-amz-request-id: A12753E650C026CC

x-amz-version-id: akDXJVqWGXlhXhhZ8YepY7NAR4.yDN8P

x-amz-meta-s3fox-modifiedtime: 1392281588994

x-amz-meta-s3fox-filesize: 11762

Last-Modified: Thu, 13 Feb 2014 09:38:37 GMT

ETag: "cc4bec630c2ec102cb6159e463ede5cc"

Accept-Ranges: bytes

.PNG........IHDR.......-.......;.....pHYs..........o.d...OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /img/Rewudaw/BG_FS.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/jpeg

Content-Length: 72475

Connection: keep-alive

x-amz-id-2: gT5ACYuYz0TmukbUeTSna4RXN8mPlRWJgvk twwTZM ltxHhFZ76HloYWMbSJimfLwJPn6KzZyw=

x-amz-request-id: 69BDBE6F970D29A1

x-amz-version-id: Nz7N2MAKlOO7oSd4nN3DlfFquV7Kpg4k

x-amz-meta-cb-modifiedtime: Wed, 06 Jan 2016 14:31:32 GMT

Last-Modified: Wed, 06 Jan 2016 14:31:44 GMT

ETag: "9146e3b2964074e188543372a5757a2f"

Accept-Ranges: bytes

......JFIF.....`.`.....fExif..MM.*.................>...........F.(...........1.........N.......`.......`....paint.net 4.0.6....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..^.;.O.|:.#....j.}...i..zu.Y]....x.T.....kI....&)6...Uj.5...7.-...'..-.'......E..Z.....6........@.J....`.p..Y...&...Y.....%......7v...p.K.c......#..#..K..,.Z=..$W.i.|......g.;..H.....7.....UtTe.[.M.J-.....J.Zz........E.HA..[.R.v.../....|W..u]S_...g.Vyg..!......h.....1....\.Z....}ona...<J..I...m......U.!._.6....8....$Pq#g.!.:...$......gut.[j...........(...'..m.7V.l......{.....>.P....S...p.R.[.E.k ].....mo..QN..\.4...t.......>4.n.w..G..............(5.3..]...x..ebnd.Hp..&X.............5.W....o... ...kAo...v.j0]E5..........E.Y.D.......GZ.P.,...k....F......x`72..f.WF..J..8.IB...N..d/..%.....c.WA.?.O.......y..>../..}.Z../N./. {....`...:..[G.....^./.,>..iZ..*r..S.jta)...\]Y(BZ... Y......^......q.%.J..j....e...]hwz..$.a..c.!q...5.S`..U1m.\.vF.!.q..k.<3.xj.L>...z..g....MI .x.HY.V...O

<<< skipped >>>

GET /img/IE_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 5921

Connection: keep-alive

x-amz-id-2: B8btCOVZ17R0ljuFrv/sB2mXcSnGaatPVRrWU6EWCjthMT1MJmQzVL LjbXe4cNw

x-amz-request-id: 8EB4CE7B0C022CF0

x-amz-version-id: JCaAVEF0XYSznIkNb1ccJeiC74z2Hy2T

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "d86b9d354a5cdd126ae5250c162630d3"

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:10B50654C8A411E4A871F63F79D4AE1E" xmpMM:InstanceID="xmp.iid:10B50653C8A411E4A871F63F79D4AE1E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.. Y....IDATx..Z{.......].==...a....A....Z.$$.=..s.G...M6.Y_..l.&.$..yxt..W.9.....b|F.. 1.A..F`...GwOwuW....W.3A..`..{..........{...a!.}T_.L..4.t..\...a.?......C.....kPL*.S...........}..k.w}..8.5C...E...?.$..?^......N......Iz...3TKW.B.)....).R.....E.C.........L.~..v.......%B'N..%..U.e]........!.~.:8O.ZG..Ie.1.).....h.X...d_...W.L..bi.6.ps....1x.....O.....Zx.,..W.F.r..[..<.L.?...XqZ..t...XEP...*RI\0.0)D...=.n.....|.(S(...O....We.k.8.X.........# ..........P....S...m.##...Vq..Rt.."."# ..........>..nA...1.... E.cE...h......$.1..JQ..!..o...;$..O.GA J.R.cV.Xp..f<.s}4<........7..A'..V.RX

<<< skipped >>>

GET /img/Nininininon/Nininininon.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.bororeb.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Tue, 13 Dec 2016 00:25:41 GMT

Content-Type: image/png

Content-Length: 415606

Connection: keep-alive

x-amz-id-2: /H9 4xozfQORxo7W4UWAgqPm1eXpuNaYuoFpZVnZrWIOAcqHThzifkF/u39ulPDtmvoz kYl/0=

x-amz-request-id: D175858B8AA34001

x-amz-version-id: s.HW.VrEMobnKgHFcVDtYUH1Ob1rUFLd

x-amz-meta-cb-modifiedtime: Wed, 09 Dec 2015 16:17:48 GMT

Last-Modified: Wed, 09 Dec 2015 16:18:51 GMT

ETag: "2cad81e24a9d1d2c55b26ee3c73b61e5"

Accept-Ranges: bytes

.PNG........IHDR...0.........A.>.....sRGB.........gAMA......a.....pHYs.......... ......IDATx^...LVi.........C..h,...q.............b..((U........DAE.......{.}ko.{..y...|W\.zm...c.u.k....e.7):...;.);....$...PQY@...T.>.......T;YP.f7a...u.6q[.R........w...5..Z...,......4...Q`bJEE(......@.-kj.-.s.....u...\.JYu.Ua^TW$..w......s.......G...hhh.2d.`Y..{.......w.8....9...csvq|...~.....g.v..;..{.&.........8..FN....s..QjcJ...J./Sl|.../.....P......r;...)..G.j]Zo<....1......._"..O....y;nPz....L.wp!..O.o....%.v.......G..'4&.S_.CMn.yw..u.Dmz.5NO(.t.5!....R/."N..~..E..}.9B..)....0.GcG...e..?....9*.r.n.....9..b..........K.._y~....'...6...-({v... ...R.....h*R_...%g.:R..A]..j._Q.PH}....]...=...hN..^....f...M..;.^}...-..|i.q..YS..JS.'Zs.i.k..yP..BkN..'\..s....T{..:.....4y.c.4x.4d...Z9X.Y.....T......M..D...alG..5....s...qn.w..{.d.7...g-.....C...x..2#}J..QpZ..kSj.....(7e..G8....M.....i6......S....N{x$..\.d.-E....!...........%<..g.i..e.zKUm<.n.....Z.....O...V.=.........$...t...X4D...?c..c.4x.....>.q..1~.`A....X.KWx...[#F.w.H....60.d.'.n....~.|.....).5..q.3N.^?....Qq..(F....T^<E...............ObF@(...4.?....N\...ek.~.@.g$.......<..r..w.... .-4...H...h..f..;.ZY.R.J....3..J..H.g..M&X.1q..f.........C.. .Mu...jR#..ap.Mu_............&V.......C0.Z..9.g..(h....$.9:b>z...7..~.. Q...x.. ...{.2.B......\.....=:z.,..e..sZ?........g...i....hOKg...L]..l..r^~f.......?... . .u.....4.k.5...ZE{b...Q...1..5&\..;#...?..........._nT...G.R...........d......'.m;....OSD...(.S../.j..3.~..~...~K.3...k..|.,&........0_|..M*<......C..

<<< skipped >>>

GET /imgc/ToolIcon/13060/g_-_32x32_-_s_13060x20130323113056_0.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: gallery.dpcdn.pl

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public,max-age=2592000

Content-Type: image/png

Last-Modified: Mon, 28 Nov 2016 16:37:59 GMT

Accept-Ranges: bytes

ETag: "6e93dcc79549d21:0"

Server: Microsoft-IIS/10.0

X-Powered-By: ASP.NET

Access-Control-Allow-Origin: *

Date: Tue, 13 Dec 2016 00:25:37 GMT

Content-Length: 1388

.PNG........IHDR... ... .....szz.....sRGB.........gAMA......a.....pHYs.................IDATXG.W]h\E........d.d7?m.&.ZHi..XP..>......h..DD..}..}Q.|R..T..v.DA..&.-B.$n.....M...g.....w.3sg7....7 ~0........3gf.V../.h....0..)F.904....M.7.......|.{.90VD..kXgw..ohiA...q....cE.,.|...b.\.3.].W.Z*.."..h.A.*..R7u.9.......p....-..XC..-7..........vz.....B`..../....`....C 01q ...l..q..2...!0-.O.4p....a..TaU`.."02...2..J..i.4...R.F .......7.y..t]....'..]..B ......;-...4..s.R..... S].......6....G.".5x......Ga|.3..pr.pK?..!5Q7..G....g...'uo.WpgV....0..s..[..I.k...........y...A..N.....*..\.u.0,..Y2.$.*.E.W.E.............0.........y......5J....6.".y.....k..S..;..bq......l..3..(.]Q.vW\.}...X.........Q....CG.QU...k..T|;R..Y.Y>{...O~..X.5.\?w.v..MF.."..........t:...y..M..v<...Z.K...<.r......|.......R....L&..q$...T........d.<x.....,.....Se...4..h(.R=>.W.r..J.iM...r.pv..al.;*QE..f..*........;R.... Z.`n.F.$........)..U!.y.[../R..4w.a...n..ulC!...../.J....{`.....po...8.....FJD....K.8....E*e."...x....B.l .....K......_......%y.Jr.I.<.]9.....K\.5.U!`...DY..3.4...%./.(FK....TT..~.1{5...........wk.<K/-Z.g....@L*.oe..3.....gU....c..C....T.]Z....4......oPJ4..*.U...... Y..c....&......|m.G.WC*=....kt..qJ"..zT......$..8...C...m...3 ......Mc..".D...N.0..Bk*..%.......#K;%.Hn.n.r...]&....L.T.K............w:..._...k......R.T. ..P.......,..0.....^..]%x..t..\.aQZ..3.....dX....$.N..%........u...W....IEND.B`...

<<< skipped >>>

GET /COMODORSADomainValidationSecureServerCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:26:02 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=db0813972783077165f70e987d2413f6f1481588762; expires=Wed, 13-Dec-17 00:26:02 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Mon, 12 Dec 2016 13:12:08 GMT

ETag: W/"584ea228-117cf0"

X-CCACDN-Mirror-ID: rmdccacrl7

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Tue, 13 Dec 2016 04:26:02 GMT

Server: cloudflare-nginx

CF-RAY: 3105484746ce4124-HAM

5c48..0...w0...^...0...*.H........0..1.0...U....GB1.0...U....Greater Manchester1.0...U....Salford1.0...U....COMODO CA Limited1604..U...-COMODO RSA Domain Validation Secure Server CA..161212131208Z..161216131208Z0...d0!....w`.h.**..$.R.\..140220191049Z0"....P{.... .]A....m..140404195800Z0!.......u,y".QU..A...140410154408Z0"........fU.%....}....140410172927Z0".....,.jc...Q..FV....140410185945Z0!...0...:.Km.~..V....140410214937Z0!..cE...2!D....,It...140410215014Z0!..W...!...Lf`...7...140410215026Z0"......*{u.....BZ.....140410223535Z0!.....(..7./.9..n....140410224524Z0!..].F.L.....|.O .,..140410224851Z0!..\...Y...N.........140410230501Z0"....P.#.~..>.U><.....140411065449Z0!...'.k.WJpt.?.......140411131823Z0!..b.B.F.. .&.D...X..140411131850Z0"....5......0.?.B!....140411131922Z0".....@.wb0}=..L{.....140411131938Z0!..2..r........G..F..140411131956Z0!..U......g._w.R./e..140411172311Z0!..4...Y/X..f...cb...140411174902Z0!........~4...LV..(..140411185644Z0".....uU_o....C.m.M]..140412001353Z0".......r.!......-p...140412001402Z0"......xW {d...rW?.P..140412021032Z0".......#.8...d.."L#..140412114042Z0"....x.{...!..........140412155740Z0!..L....7.-~.r.J*....140412163423Z0!..M..\_L.3..5}.).5..140412171532Z0"......b/.m.../.Z.Y...140412175728Z0!..0............T.3..140412183108Z0".....dIk......b..C...140412200345Z0".........._$.........140413022007Z0"............C..c.....140413104918Z0"......n...xS.Y.E..J..140413123759Z0!..p..J.)vO.'...x.]..140413143438Z0!..4...r..V..g.B.....140413190918Z0!..'..]...<.......t..140413193

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.usertrust.com

HTTP/1.1 200 OK

Date: Tue, 13 Dec 2016 00:25:55 GMT

Server: Apache

Last-Modified: Sun, 11 Dec 2016 22:45:11 GMT

Expires: Thu, 15 Dec 2016 22:45:11 GMT

ETag: A176BC46920F884D610EFF3F907B4F582FD001BB

Cache-Control: max-age=252555,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp28

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0.........z4.&...&T....$.T...20161211224511Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T...'f.V.I....p...."....20161211224511Z....20161215224511Z0...*.H................}.S....0.^6...!q)k.=.H/.l.n..t..xM.R.}.*%.o4..Kg..:W."..An.L.....v....S0vL....q..3.RV..yD((2.M...............P.A...:.....|..F..V....P*..|....;...KV..K.....z....bv......O...i.k..Y$p.Jw.C.3..L.U/?.1..q.Bf.....np..<D..H...vd..2..]...,.a............^.....p...

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.usertrust.com

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 Dec 2016 00:25:56 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 602

Last-Modified: Mon, 12 Dec 2016 19:59:09 GMT

Connection: close

ETag: "584f018d-25a"

X-CCACDN-Mirror-ID: rmdccacrl8

Cache-Control: max-age=3600

Accept-Ranges: bytes

0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..161212195909Z..161216195909Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H...............Jj.N.Bm.|...{. .Sc99p...3.e4.m.....&.*.{...._....V...1..........7K-.^,...k.Z..f2...y........bB...... . .b...........H.....|.F.=I?k.V...........n.u.T.4M|..e...B...?.&....P.'2lh......g...{./..$P..c.&.V......Z.......mIy.....<.XwJ6.. ...R....o. ..._.:.)..."...

Map

The Installer connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_3308:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

onwEB

shell32.dll

/SUPPRESSMSGBOXES

/PASSWORD=password

Specifies the password to use.

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.3)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

(Np{.Mp

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

true

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

4.5.4.0

%original file name%.exe_3308_rwx_01210000_00110000:

.idata

.edata

P.reloc

P.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

u%CNu

.Owner

>A(.kc'/_^w

4L.dp

73.aQ

2A.nOa

/-.vvvv

.HICv

g.Qo^p

\.DDyv

v&d.Bd

m72

d.tbyC

.CLn&dhO$bqr)

.Ozdq

,.QP[

QW.KU

.Yq$P

.WW>E

/.RRRR

:..tO$

pÃœp

.heOY

..Fd8

.LdJ$

.BF$.

c%uQtD

.P}%x

lUdP

T.aGd

d%4X{

Gf%C"

@g_.DW\c/

HCP(W%fW

9H.xbZ

g-.PL

}?Qx.jo.a

.yd;=\owl

@y.GfM

.oHhw\K

.xa#;

>U.vu

*M%d*u

.soy9

bx.BXf

"*o.om

y p.vc

.ISQ/r$rm8H=(%

e:\%-

L.MQLR/

.FE6;

/3ZAB%UXm

p}.dT

.EsY)$

&:i[.srK?

:..TN:

.DEIOe

:.rwA

~e5"%dZ8H

%fnZNwdI3l(

ÃºTbg

-bcJ}.X

P%Cq'v

.gLL?

Ly|.kN

Ãœ||vh

}.Ak1

Fk0d.lOq5TD5

_O9P%d

.QM_D

"g-.dM

k.jfz

b.ORP0a

.MB\\

Bzr/.Rt

g.hOQ

}DUFTP

j.aj*M1

dwJcrt

E:\Ev

z.XZmT

%u"95

|Y.ie

hv.sw3c

X.GU04

8Ã•%

cH.RA

@.SXC\

Iw2.YW{'b

nK%DL

3e.IQo

/.an.Mw

mi.UG

sQ.BoS

\?JLM%F

.Wun'^',

<..kz>

.pFSU>

]&B.CY96A

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

RegFlushKey

RegCreateKeyExA

GetWindowsDirectoryA

GetCPInfo

GenericLoader.dll

>!>%>)>->1>5>9>

0"0-030;0@0

7"7&7*7$8

9 9/93979;9?9

:":&:*:.:2:6:::

KWindows

.NSKF"oc

.fdYA

c.Ql*Qg?"

w Vy:.zr3[X@

a.Vh1j

!`.fy

8$%XY:K

.tUh#

{.VmgH

u7.gDD

U%uj2@Y

fr.Bu

.Ee_SF$

DVI.Qs

N.Xct

Of`.cu

.V.Es

0n%7X

crT:j

.YiCre

.ls:3

z.bH6

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

%original file name%.exe_3308_rwx_01420000_0009C000:

.rsrc

~H.Pp

kernel32.dllwGetLo

{_.SCK_LINES/

GI.vr

Keywor

%s[%d]d=

_%di#w

.FDiag

Lz.Ix}

%XV;P

Ha=.hnY`

"%cgk

E(AL("%s",4),"

4'.Yt

.Rx>U

.dD}ohD

#t%D@

hy[I%X

,keysK

P.csy

%XG?;

.Xx%P,

LPC#I%xI/

%F$wm

o[0%F

tLcibD.ZP

I.eeln

.ye/y`F

ToiZc.Xhj

I.cG/

.DZOLdyE

pu.Pt

jguZ$C%c

T,/.Om

%u3,]

T7\webqskv`T-Y

nz-X.EoT

s:.LG

/=xR%U

.ojxQ/

t

leQ_lgdljn-:Pr-30f?.Vf0WQ

ssav.Fp

.[FQ.nw

sLtMuYvT.wh

THttp8hbD

,M.DJ

x.NDhi

.SK@./(Lk

ic6.fA

RI.AT'

.VFEBfAR

oc/K-33?.}M:.jG

mw.ll

,.Ri"ko

%sg}ai

URLs1n/

A6;,.Jid

#gST.tI

.dhs!

.dlpO

.SJ}wF

lO3?:96=>?59:;.ZQ

6?0N2=.Lq

FW]E).rO

30Lk-oo7L

;768>1-80

-[4/>;84

0FQO%SGl

D['-L}

;7.Q,>N-Y,[ T,Tc.Uv`HzR

Tgm.mX

\S2..st

bnfoa.nvQP

]H.if7

Eoi]`^.OI

bh[muQ.PT

Tz.yOrs

.Lb/L}

.Xjc'

pk`a.ET

)hix.CB

hhFhy,.kle

TPipe.y

QWLHEM G.sO@KB4>c.

URNDT].Lw/OFL[^\\[@IAJH-B

wLJ_.gROUHUO

ym^rk.Um_

J B.BR6

nCff1w.jzW

b.vokV/i4

X.hxM

.FEG?'$

,%C;.'

.vri=

IWeb@

%D,33

%xpFRbtW0m#

|%xoDwu

'%s'R

I6E.Adv

o.nBx

.1..WAHO9[Z

1%X)w

-|~.US

cnyzgcEi.Tc0

?X A,]-` 4.dH

*.lJ,e

Zq.KJ

D.Xre

/@anldf.RW

(%.WwX

I.PP5%

cbie.eN

X(kbm N.qX

,E.gf

2

mjC.Oon1I

gZY*rf.aeW

?.YH2

.qB/hkk[lfqd.@

NPIPE_DATA

WHKz).jGNNL6.i-6

HL-N.PLNYCD_^.e`

HMVH9>.PERU

.CONTA

v=.vpF

}g`.NrWGiiq

Zz.tc

.fhEjmy|

.FnNFv

xEXE&0

>$.PG

Z-1,NaW.ezfc.bzG

u-f.wo[

]no^dun.Vx

Z.OO*YpC('

M@VNJPu.Ig~%

z`o1caig2,.hf5b"0cfh

jzp-Z.df4oZIOo4

&.rP,6

GUkszv.ra

hbbxl,.blrl

<.zr3>

.zx0&

;s1%c {a

&.Kb$

KO.az

~fT%s*

AV.mvd

N^.Oa

M%r.rm,

-p%X.SJ

o.th-

#.OR0

}%c.d

[x?.ML

@d.nL

"$ %),'8

1 0 .'7(2':

/*-( ,'.-!

*/.)*72-7)

,d2.PMDF

HP.re

KERNEL32.DLL

advapi32.dll

comctl32.dll

comdlg32.dll

gdi32.dll

mpr.dll

ole32.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

version.dll

HtmlUIInstallerSADLL.dll

%original file name%.exe_3308_rwx_014C1000_00161000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

Uh%fN

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordH

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys8`P

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown8;O

OnKeyPress

OnKeyUpD:O

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

,-\ T,/.Om

hcl.sf

webqskv`T-Y

oj-2,`ac

ak-2,`ob

Uh|%S

UhI%S

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Jmvgknm Q,2,,)27,.Pkbjhu-4-.,IV,,8)37,.Spejblx Q,2,,

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

Retrieved Filename from Url:

) is different than supported (

Urls stored in Chunks Map differ from the ones provided, ignoring the Chunks Map:

Chunks Map contains URLs, but the size is illegal:

New Source created, url:

, httpCode:

, url:

, Url:

, old Url:

, new Url:

Switching suspended Server back to use; Url:

, HttpCode:

TDownloadConnection.Destroy() was called from not authorized thread (

HttpCode:

Unsupported 3xx redirect response, code:

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

3?:96=>?59:;.ZQ

6?0N2=.Lq

;768>1-80

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

Unable to extract the file via CMD, gonna try regular write:

000000000000

Report is too long, data will be lost; RepCnt:

Report seems to be larger than recommended, can happen only on special ocasions; RepCnt:

;7.Q,>N-Y,[ T,Tc.Uv

Reporting failed on first attempt, second attempt is cancelled (finallizing)! HttpRes:

First report attempt failed, going for second! HttpRes:

The report failed! HttpRes:

Report sent, Url:

Y]H.if

d-3,tdcQqdc.Lb

TUninstallExecuter

)hix.CB

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

RootKey:

RegDelKey:

ExecuteCmd: key=

KillProcess: key=

: key=

Remaining uninstall instructions after exeution:

ExecuteCmd:

ExecuteCmd: ExitCode:

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

Starting default pipe server, PipeName:

isrPipe

Falied to start default pipe server, PipeName:

CJ[hx.Xu

_.Wo*BC-T5p7d.V-b,

Downloading Bundles data from adServer on url:

NAER_[URNDT].Lw

Report main param:

Report Url changed dynamically from:

Exclusive Execution mode is switched to:

Report param

Report param:

Package execution returned bad ExitCode:

Package execution failed, bad ErrorCode:

LJ_.ge

Download request queued, urls:

fxk S,Cym^rk.Um

Starting Report, status:

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserAppL

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTopX

OnWindowSetWidth

OnWindowSetHeight

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPathD

OnTranslateUrll

OnCommandExecx

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDown

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyUp

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

JS event callback execute start:

JS event callback execute end:

JS function sync-execution failed with message:

] execution failed with message:

MAPI32.DLL

LeftPopup

not supported

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

-0,cnyzgcEi.Tc

https

Log server Url is invalid:

Sf[.t,T*.lJ,e

Sending Log to the following Url:

Log Http request has failed, res:

Log Url changed to:

MSGALL

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

TExecArgs@

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

.html

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

LNYCD_^.eP

HMVH9>.PE

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

IE WebBrowser docRendMode:

IE WebBrowser docRendMode is not 7 (

THtmlUIExeAppU

Pipe [

HtmlUIExeApp

Pipe command unknown:

ung`.Nr

HtmlUiExeApp

gbo`dhfm.cV

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

An attempt to download bundle data was denied: adServer domain name must remain the same! Url:

zfc.bz

]no^dun.Vx

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

-0,ilCcbd.LG

)h-4,k.bR

Failed to execute the Watcher in mode

Watcher was successfuly executed in mode:

Ukszv.ra

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

?456789:;

!"#$%&'()* ,-./0123

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

&.Kb$

~fT%s:

.wIXS{;

AV.mvd

M%r.rm,

mQ%dG

-p%X.SJ

o.th-

#.OR0

}%c.d

[x?.ML

@d.nL

GetProcessHeap

GetCPInfo

RegQueryInfoKeyA

RegOpenKeyExA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

4? 3!0 3!6

&W!%D)*

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF

2222444424

.idata

.edata

P.reloc

P.rsrc

/*-( ,'.-!

*/.)*72-7)

,d2.PMDF

HP.re

Attempt to access registry key: "

supported by OS for "HKEY_CURRENT_USER\Software\"; access directly under "HKEY_CURRENT_USER\Software\Wow6432Node".

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Execution AdminMode ADM_DEGRADE is not supported; using ADM_AS_DESKTOP instead. File:

There is no source with range support for connection, picking one without.

None of our requests are passing in Proxy Mode - suspecting inability to download from current server, trying another HEAD request to make sure.

File size seems to be changed from the same source after HEAD request, suspecting rare case of lack of HEAD support - disabling it.

Only HEAD requests are passing in Proxy Mode - unable to work with this server (probably no Range support)

TDownloadAccelerator.Run() was ignored, since another download is currently in progress.

Urls:

Pause request ignored, servers without HTTP Range support will cause download restart.

The source dropped range support.

The source does not have range support - ignored range request.

UnregDLL executed: "

UnregAODLL executed: "

ExecuteCmd: Exe:

Stopping default pipe server

Waiting for all the ongoing reports to complete...

; main package already reported

InstallerName altered after at least one report already sent.

Changing Report URL request was denied due to lack of Privilege Mode.

Installer Report Url changed after at least one report already sent.

Installer Account Name altered after at least one report already sent.

SDT changed after at least one report already sent.

package already reported

Starting execute (NoExecute - skip), exe:

Starting execute, exe:

MSI package detected. switching to synchronous package execution

Execute request queued, exe:

errorUrl

\bin\SubWCRev.exe

Failed to launch htmlUI from the following url:

Log server Url is not provided.

Log Http request has timed out.

Remote mask loading is currently not supported. mask:

Registry entry removed: HtmlUI Browser object's IE7 fallback support is now enabled.

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_CURRENT_USER).

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_LOCAL_MACHINE).

Loading in stealth mode, url:

Read form default pipe timed out, can't determine if there's another instance running

Pipe server TIMED OUT , can't determine if there's another instance running. continuing..

CANNOT start default pipe server, possible reason is that another instance of this installer is stuck

Please login as administrator and try again.

Failed to remove the "Zone.Identifier" AltStream

Successfuly removed the "Zone.Identifier" AltStream

Failed to execute a Watcher process.

Watcher found a problem, but can't report - essential report data is missing.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Ancestor for '%s' not found

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation!Invalid variant operation ($%.8x)

Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps