Skip to main content

Installer.Win32.InnoSetup.2_da73fcc4da


Installer.Win32.InnoSetup.2.FD, Trojan.Win32.Sasfis.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Installer

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: da73fcc4daceb91fa6a470b3af11c108

SHA1: d5be92584d5b621b27d06c6899a7bcb11f9d7eda

SHA256: 3f950e56e3fca1eeb6f9c41abfc7dd5e1c57626886eb8a09e586558826bfad75

SSDeep: 24576:yvvtf69uGSPvmdhj69AHx4R8MOfY34RbZFA3c9vIkvolhM1hhYRYxNEugux2TrhG:ynN691SPvSjYAHkbvWyWwkgshhn3EvqK

Size: 1200264 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: BorlandDelphi30, UPolyXv05_v6

Company:

Created at: 1992-06-20 01:22:17

Analyzed on: Windows7 SP1 32-bit

Summary: Installer. An installation package.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):

%original file name%.exe:1388

The Installer injects its code into the following process(es):

%original file name%.exe:2748

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2748 makes changes in the file system.


The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\NL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\bootstrap_46496.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\logo_b[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\IT.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\FS_BG[1].png (1564 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\EL.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\IE_logo_new[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\Cazurazihiz[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\ProgressD.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\ProgressBarD.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\BG[1].png (1760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\RU.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\ie6_Dlm_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Grey_Button.png (341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000520E8.log (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\BGD.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\Nininininon[1].png (38801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\SV.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\DA.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bg2[1].jpg (7817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Grey_Button_Hover.png (255 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bg1[1].jpg (16833 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\5812767E_stp.CIS (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051FFE.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\FI.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Color_Button.png (341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\PT.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\JA.locale (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\DE.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\5812767E_stp\osutils.vbs (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\logo[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\ZH.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\BG[1].jpg (10684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\mainDlm.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\CS.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\CH_logo_new[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\PL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bar7[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FF_logo_new[1].png (1301 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\TR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\ES.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\0119C0E2_stp.EXE (80353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\BG_FS[1].jpg (4880 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\0119C0E2_stp.EXE.part (2130 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\NO.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Color_Button_Hover.png (255 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\ID.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\KO.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\5812767E_stp.CIS.part (723 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Icon_Generic.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\truste[1].png (200 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\bootstrap_46496.html (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000520E8.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051FFE.log (0 bytes)

Registry activity

The process %original file name%.exe:2748 makes changes in the system registry.


The Installer creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{E549E976-C5F2-4E77-819D-55BC9B7C25BC}"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadDecisionTime" = "70 3D 0A F2 D8 3A D2 01"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e0-73-f1]
"WpadDecision" = "0"
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e0-73-f1]
"WpadDecisionTime" = "40 F6 1E 5A 7C 28 D2 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadNetworkName" = "Network 2"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASMANCS]
"EnableConsoleTracing" = "0"

"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\da73fcc4daceb91fa6a470b3af11c108_RASMANCS]
"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e0-73-f1]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}\00-50-56-e0-73-f1]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
65133da829359a4e4079d965d05ba5bfc:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\0119C0E2_stp.EXE

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1388

  2. Delete the original Installer file.
  3. Delete or disinfect the following files created/modified by the Installer:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\NL.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\bootstrap_46496.html (156 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\logo_b[1].png (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\IT.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\FS_BG[1].png (1564 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\EL.locale (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\IE_logo_new[1].png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\Cazurazihiz[1].png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Quick_Specs.png (221 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\ProgressD.png (104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Close.png (207 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\ProgressBarD.png (812 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\BG[1].png (1760 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\FR.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\RU.locale (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\progress-bg.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\ie6_Dlm_main.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Grey_Button.png (341 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000520E8.log (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\BGD.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\Nininininon[1].png (38801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\SV.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\DA.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bg2[1].jpg (7817 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Grey_Button_Hover.png (255 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bg1[1].jpg (16833 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\5812767E_stp.CIS (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00051FFE.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\FI.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Color_Button.png (341 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\PT.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\JA.locale (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\DE.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\5812767E_stp\osutils.vbs (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Pause_Button.png (577 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\logo[1].png (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\browse.css (337 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\sponsored.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\ZH.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\BG[1].jpg (10684 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\mainDlm.css (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\form.bmp.Mask (244 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\CS.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\CH_logo_new[1].png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\button-bg.png (131 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\PL.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\csshover3.htc (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Resume_Button.png (718 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bar7[1].png (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FF_logo_new[1].png (1301 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\TR.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\progress-bg2.png (978 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Close_Hover.png (207 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\ES.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\0119C0E2_stp.EXE (80353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\progress-bar.css (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\BG_FS[1].jpg (4880 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\checkbox.css (190 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\css\sdk-ui\button.css (417 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\EN.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\0119C0E2_stp.EXE.part (2130 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\NO.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Color_Button_Hover.png (255 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Loader.gif (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\ID.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\locale\DLM\KO.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in0DF01217\5812767E_stp.CIS.part (723 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH3358704049\images\Icon_Generic.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\truste[1].png (200 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: Hotehu
Product Version: 5.3.4
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Hotehu Setup
Comments: This installation was built with Inno Setup.
Language: Language Neutral

Company Name: Product Name: Hotehu Product Version: 5.3.4 Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Hotehu Setup Comments: This installation was built with Inno Setup.Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
CODE409637732378884.5900715713a33c39f8f9cac7d0b049856f42b
DATA4505658810241.8986d5ea23d4ecf110fd2591314cbaa84278
BSS49152372000d41d8cd98f00b204e9800998ecf8427e
.idata53248238425603.07115bb5485bf968b970e5ea81292af2acdba
.tls57344800d41d8cd98f00b204e9800998ecf8427e
.rdata61440245120.141749ba824905bf9c7922b6fc87a38b74366
.reloc65536222800d41d8cd98f00b204e9800998ecf8427e
.rsrc6963211264112643.091251c16a4a2a4dac14d8248dea7d7c166d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 44
09de2fb5d6a376ab775890612256a6a1
dea00529acf13cedbf470ba6c78ce9c3
da14f54ae93e1581edee32c0178b300a
d84e04ba05eabba418388ab4af86e3fd
ce530b577b2ca67d3ac706a8aa4be75f
b128ccbcc5e2c30f071a728947af2015
8f1e5f4bab133718c692e2909af981b2
64f953a2e57a55a625877aa505e2be39
4dfc11dc45fd2ab9e597a9541463e128
5f1a4e77235354db173b4fcbbb1adb46
5c815d6d494e3988d3725779910522df
4e70cec5d38796dc37c9e164abc43be0
45c496b08a59980500edab626a41f1a4
431cedd3fa29990af5625f024d77144f
10838067ede6944f9a67f02e7a503c39
fd0a81a82a86677be938c4811d394f6a
b73cf97aa3f6d68bb7d37915873d93f9
62a71ede0a528492fbcb2682ce1a6f5c
285c8103cd122d70afce270988330ef0
f8d75dd567e004e4211ad0662d7a52c2
f65b7821d351a668c7a4c3b089267600
de7542012021d3364263912a6ab42f4c
b980e6407f0c2581cc1c895243be29d2
b92ddad6d1a21b491596a3f558d5d0d0
3ed199c2979e598e8371bc552e364908
368d41b9b112c88ffa51c04aaa6cf3a7

Network Activity

URLs

URL IP
hxxp://info.jajajapa.com/?lojaz=154.154.229.88
hxxp://cdn.bridgeaccesspoint.com/HD_Player_Setup.exe104.27.185.79
hxxp://os.jajajapa.com/PopaJar/54.229.133.176
hxxp://rp.jajajapa.com/52.49.115.83
hxxp://img.jajajapa.com/img/Malaromoro/bg1.jpg199.58.87.155
hxxp://img.jajajapa.com/img/Malaromoro/bg2.jpg199.58.87.155
hxxp://cdneu.jajajapa.com/ofr/Solululadul/osutils.cis95.211.184.67
hxxp://cdnus.jajajapa.com/ofr/Solululadul/osutils.cis199.58.87.151
hxxp://img.jajajapa.com/img/Tuburera/logo.png199.58.87.155
hxxp://img.jajajapa.com/img/Tuburera/truste.png199.58.87.155
hxxp://img.jajajapa.com/img/Tuburera/bar7.png199.58.87.155
hxxp://img.jajajapa.com/img/Tuburera/logo_b.png199.58.87.155
hxxp://img.jajajapa.com/img/Rewudaw/BG_FS.jpg199.58.87.155
hxxp://img.jajajapa.com/img/IE_logo_new.png199.58.87.155
hxxp://img.jajajapa.com/img/CH_logo_new.png199.58.87.155
hxxp://img.jajajapa.com/img/Cazurazihiz/Cazurazihiz.png199.58.87.155
hxxp://img.jajajapa.com/img/Nininininon/Nininininon.png199.58.87.155
hxxp://img.jajajapa.com/img/Fividof/BG.png199.58.87.155
hxxp://img.jajajapa.com/img/Fividof/FS_BG.png199.58.87.155
hxxp://img.jajajapa.com/img/Rewudaw/BG.jpg199.58.87.155
hxxp://img.jajajapa.com/img/FF_logo_new.png199.58.87.155
hxxp://cdneu.Jajajapa.com/ofr/Solululadul/osutils.cis
hxxp://cdnus.Jajajapa.com/ofr/Solululadul/osutils.cis
hxxp://info.Jajajapa.com/?lojaz=1
hxxp://rp.Jajajapa.com/
hxxp://os.Jajajapa.com/PopaJar/
time.windows.com
dns.msftncsi.com
cdn.installationsafe.net.s3.amazonaws.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST / HTTP/1.1

Accept: */*

Host: rp.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1568

Cache-Control: no-cache

....V.....2$....

.......78.....m32E...|...!v1lj.~.Z..p..I.....}0....nS....b.d.O....n...jp/L...a.r...>...D...;#.m.....9\^..x!.._X..g4...\Nk.p.......N.{M{m.....1..Q....c.eI..).!......W.L.d.0....-. $.......!_....Vi..Q..3hp..oV........$R..&..n...@.g.N.b..%u.u........O...].mA^.....D...0.z.P.............T.j........i..]......O......jHo...B~......1|.n...3....Q....m..KQ.a..F....(x......7S6

......6)zlb.:..."v

.......>.k..S.YI...!..(..H..x...i..W....U.....&..$)V,.&?9.....e..=..0...r.X.<.%....R..5/:b..".6........i.....gY...7?F^.<

.._..."..=..6...."t6|fl...F....lo....1'..@iN.gT...A............Jt..[F>.eyde.n....C...N......}.y..[1....^.....M9.. .E`.H..H....8.i......e....Y!K.'..E.9.u3.^... .m.B..".d....MI...,.g.)../...S.....8pM.nr{<...c...N.idy.a......5.2kD..=7]....wzhK..Q..[.SD...7.0......\.!|.az....D}.Z..5.......}\.O.... .......^...:.z.....61_?.d-.4..E

...OeB...S...Qb.....c2.....-Q.q.....Mr..... .kVT8..<......&.......d8..~C.>...-48....,..<@2iz..d6...2d....P.=.9..9.y5[r#C....0.Wk.,.FJ.....3..)........9..X|.-h.....vB...H.D...........E..Y.{..hL...G6y.."........=..:.q...a...zG;,.'.....` ..oF.<].x|....t.n..f#z.Y>Y....C.p...pZ..*..^#...k}......t.

...b.C.pY..|PnaRQX..#8b.w?...O.;........7.).8>....j..3..@0..p......zl...r....7.Q.p[....4....=W<

[..X......oE..v....c.7dt...4>g....r...j$. ;...Lhv|.v....."...

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Wed, 09 Nov 2016 22:30:46 GMT

Content-Length: 0

Connection: keep-alive

HTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Wed, 09 Nov 2016 22:30:46 GMT..Content-Length: 0..Connection: keep-alive..

POST / HTTP/1.1

Accept: */*

Host: rp.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1184

Cache-Control: no-cache

Connection: Keep-Alive

...3E.Q)_l.y...K.....Xh...g.mx.L..M....V/...P..H...l[..........4.[..x ........:...>.{....T.mY..j.7[.c.Mj.L...i..^....Yu.P..UI7.c.....=.z.._a.6. g Q..pU...dVq..'..Q W.e.a.3.:l!./3....#...5k..qk...U.N(.U../).....l.Q*..-z.L.P.E.]..54.r.k..Q.....1..............&...F.W..eY/,j.....zp.5....-d1..$..i.~E......5ik........%...s.C..B.

i..]..7..d.......6.-[...XI !........1..u...tP...q.`X|..sa.".(i.f........5....'4...pr..N' .....t..............D(.....h...4]..I..I........I..d....:R.Y..........k....gg.n.Y.1., ...L..z....-p..*.bU..Tdn....,

..U..%W....tWi.Os..m...}...c%....X..............T .....|.5N.Y...o....n...............d%.D..6D...a.....L.Q....,[..-......h...<...Yr...h..`..........2`.....4#..S....*.]]o....4.&_..?k....%]wt....Q5...#..l*fC.............G...uq"..0. ..wW.bS.....s.D......R... #...n........w.'CglT...=.I...kI]...roD........f_..?...2U.;|..p.Z.., .;z...Z.....a.....B....w..9k.......w.-.R3.(....u......g..... ..QI~.' ..s..%.C.c*L...8.........re..3/5T......7[ZH.'.c@..Ee........\...k........P..q.{.....z.3....so..F.C..}M.R.R.. Fa.J...;..hU%..BgC../....=Ck..*.@..2 ._

..b.\....p.RaH1.. I;t'.U...`....~-.h..U

;F..../.

..s. l..Tu......yp...._.

k..8

.........B...3....12839. failed, error: -90&tplStt_n2=12839.ed.eeb..XE...},{............var AS_MOD=function(){function n(){e=AS_GDO,typeof e.startImage

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Wed, 09 Nov 2016 22:30:49 GMT

Content-Length: 0

Connection: keep-alive

HTTP/1.1 400 BAD_REQUEST..Content-Length: 0..Connection: Close..

POST /?lojaz=1 HTTP/1.1

Accept: */*

Host: info.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 176

Cache-Control: no-cache

.^.S...N)Tw?.G{&v.....s.@....Q.y......G..a...l)T.U..'$.%. .c...(..".w%H..:......../.....V..d.."...i-VA0n..

.....dR.6J.....jb..k...Ov.8.*..8.f..

.......8/.U........ZX(._..6.

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 09 Nov 2016 22:30:37 GMT

Content-Length: 2284

Connection: keep-alive

5vqz3hSPJcx/TVXhPP7i0LPOrDeqcplcyW0zrFpNnCuLlLvAFL414Sa9EQaCj/fR7KHcNAYTO/Dqvf6NwWb rjIkXUzfvoW/nMweaPnVMW3LlfZO/ACGvAit2kAihCZOGxEAkwvQsjnLRb1nkWQ7lNqaSRhLcB8XeWyUATJtgkaUiIs8/1EMu B3dfF/s32vCR98p3WcTniIQDcbN6VUS3n CtnnWRKt17d2v3rS0JEbX0kBcIjwhngPMJbk3/chX6UffSOUEW3uaUF8sQpy5MgHTaVYUANJ8EyOqWzYDWeNSjsO7kThOwezFmaYvq1kv8qMuP4yOEYvJhz1lwkDc4tbGt5EZ1sDZSmX7X9TzEk1AH4MxRvysspr9JWOHw/AePR78Yzrtwc/j6wFKn/Ui7dYbL99cUPXXdhSu6aYtg94OVVaBZMhMhCop1BielzjmhvA/m0Xk226 YVe5oby6GfzF1u yg6XiMLdkIYEk 8AAu7n7QvSGSN2i6PNmEwe0eVJDhtJKm8nK VueyyIwRiQt72kPi3qbKKmD2 auv3FvWG69l2lEauIsICp31EjPnKrdyMUSE416FeXD7jeFrJ ed9vqrEjQ8cNRduQkZ mZsld6uUzv lhlwee5SXq5PWM7WOyzn6u6ILBfEWPpZ8ptQs77RYMheMUgQxwpgiMuR/dTwlwqs2lMFpMOBtRIzrzev0PirYoZaeJ4qUgnUXioQgNxyzGYK6lrYxzT gKfSda6bbNIDGwmRk7scEAVFrHXs4I5NSzxu9GGlKDHDMNLU9TwFKQKFkQVClelJnpy0uLNBSBprBfK9W561uwLNQxQ1VNtYYFPOeRZlvbhu7OqqQT/eDCD9lz8C6cuOom1duP4po1Mzm hQVz6zBIQgQs9NP1qrANrzebhWjqCbRveBdMeS3IMNFfJ0pEVc3FR7mR8AoTJ2AUYusG0X1QlKybquGUPzKxZYh1qWB/t0RHuog3DSezm3uvUZoAy7uKmfLU2Dw35i9c1oeDfiLU7BgfhatDFXCUlPHelxgTcVuPdW3RVWRHMzA/1YKY7PCXpfjgq/83/Bcc3mwxQghtNqo31i64NBctb6ukldRbV5kEGO WrR7 Nyie8nsVnNe/VF9vB4Dr8y2KrrIRbaQf1Ne5faFGnvNm ki1v4lQDcZHy iojUdgp8J9xZX74N3nArR36RhY8CbAK83AdPazZ0Sozoyi8cj iJwXAhK1H2xv3tiz Mj1kYWUDFlUZma8WsRHnSTMdzzWzUM14VNgwa9E2tZj1K5/bWmiWgsgzKXhVVhK6 rNRKTU93ou/8zLOw5WEzbdUFwCGQNFppBodu3h0fuvLdqF82dalqhnNrEV06Zs59wH/5aROmMxn5xyUy8OFc5sWNHZsvptBCKMb4R26Pb/MlBWCEhEmYFB/ERxvbfs29 w0Br8p0lS JeRgHChUPjc43G13Lq8gSVM 5PjNH6zqF9 FDNPdvKG8LScy359s6tX8FCXmeMeRvVUYwfp/RIWs8BN0yFSfRo

<<< skipped >>>

POST / HTTP/1.1

Accept: */*

Host: rp.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1584

Cache-Control: no-cache

.I..G.)E..,(D-...a........E....0..L.<y.4.]....|.a.Y....3u....g....)Y...6.q@.`P...8}..t9.....^.^[.....p..

..

..>/.....p\f.]hU!. ..5...ud.. O.#IY...6.7

C....p....H..j....>6..^WMr..bgZ.C..r.<s&F99.D.D9l..B...u......N..lU=B....i.m...J..S....._.i...6.UC..7....

..$....2......[...A..O.)GD.H...8k..(F9.U.em:.e[.-9.NQ....n..@l..f@.'.....b..hr.L.zs....#.*..F....Z..4.......#-..Z}\...}P*....;...&vlBV.C.QY....QU...=es..!..v...:.F.............'.!.]._...lA..I\.mZ.......t.u.....2.!r........!N`..r.ql)..~..Z

.4m.r..u.....t1%.s*z.-*.._H(.ov.O.j M`.....[.7>..{........i.na.......tyd}.^.8..../..6.O...z.x.(.Xe....&.Rh.|6...i.<}.:.-..>.M].C .....iY.g..(...Rp..._...#GL.S......RJm[|;...e.-)..R"^..t.}.....CY.^C........qx..j.e7&..]7...9>.V.b.X......r[...zB...D....(^4..j..KmV.../h.d...R.E............Z.....,}`w...:...2...j.._B4./...l...x.....t...^......."B{..[&.&...j...@B"o._...`5..:K.Tc.@.........S'......?Q!...?.0...4.....cZ&.f.,O..DjN.. .....iLG._.....0O..~..WF......<e.....w..%T..gH\m4..Yn...P.DV..!`..i.....<T..h...X?../;..L.....q..........*.......af...O'W6.5?...[H%[.W.. ......2........)m.....'.....:.t

MR.;y`.@.=S...a._.a..T.f[-Fi............T....Q..

.....Z...5..x$.Yh.J..f......1.n...*.r..|.....o....!.B.......`Re..jE... .?.w....K......-. ..].M.'!.< ...|.b.5...bt.9...A...d..=..(.Q..].O......i.q.....s..l

..$...=.

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Wed, 09 Nov 2016 22:30:46 GMT

Content-Length: 0

Connection: keep-alive

GET /ofr/Solululadul/osutils.cis HTTP/1.1

Range: bytes=0-4012

Accept: */*

Host: cdnus.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 15:54:37 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: ES2wXUkKofI54NHxMZUhSESjMm2eXJnPesE1KiGxCkF93IKxVbfwS1iVZWlRX/QKMyvHX4yfuCo=

x-amz-request-id: 799B4AF43C12CD1F

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Content-Range: bytes 0-4012/4013

CIS................7...............P.......Vv/#..F D(.h]....TK..TK...#a .Kv.>y......U.:.i.......<.*._fq.~k...*......w.......@...GR..J......(......;.....c?..P....Rn..s..Sq..:.jF}..2.Io.^x.y.$.. ..Wc./..2...U....|.........a.'..z_S~..^v.6..L...Pj.5yMz`P.e.M.S........%K....3...`y-'....jB....cIL<...q.HS..Eh....&.X?tK>..n..?.y[d]...R......WD.\...&?..I......H..U.-gGq.../.6\..M`.j-5u...B.R..T.P_G.zLK.O3.c.O.}AD.dh.Q.."a..CCB..5K:(..2..'1./.....5......e).....v.G...N...?dBrh......5.3.y...Y0....J&.yQ..mpN[...7./....|.p.o...M>UB....., .z.....aT^9d..c...F*|.c(...;M"5...w-..H..|<...G.#.R.0.....#.5...~nZ...G..`...... ....lB..6..E%....=.....P....WY.!O)..VD.d.C..|.4..[a..>\..;...r6.../.G.<.P...D..J.*.;..}.a.8.b.....Z....Fad..j...O..1....%k.$.....v.6VL.u.......55....>.T..".QbOm3.....>.............V..}.".!..c%..K..cNhY...F.&...>.....].jI.07$Y..i8..S......HH ...0Z..y..7...y.R.,..h.k.[g}..{......0.\j..z.V.>.%.i1`7.t..7...u.O..T,.@LT...(k..A;$..~.....e.....k.w./.%.8.6.xn....P ";.i7.(@M..3.).P.&...\.g...H".su,........:m....6."../.8....c4.._.hBphnGq'....$...Z....,..]..R..yv)C.@...{..F...S.8..CY.s`...*..o..6m.......|q5..._.'C.....2....g..?511.8C.2..........qj.y..K.;8.....1^....}%F..... .5v?.CE....~d.%....&;_Q..9%.F.$ G.d......[.G.LU......6f.ne..........p.....s.......~...z..ap/.(...../.....QY..!...J;.................,Gv....r..p...Y.k..2..X..{....Q\........6..^....[.4..W...?@...*......?;v..hn`..~.7Q..D.F...'o.3...6...._...4. .B..r .../........c...Q....Sx..i.k......6b. iHoR.K..p...........n..*.......=..

<<< skipped >>>

GET /img/Malaromoro/bg1.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:52 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: LXTrUXWdsTGdgsgcZDLknIkGv5XCtvhnXojWKKn2v/blW7wOrF9k9r0usbUlBhwXs4RHHg Cbk=

x-amz-request-id: A6E351EFDF3DCC02

x-amz-version-id: EqXw9hQ1szW0X1KVab90EKpMdqK_JEeL

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

ETag: "04007b142892c379ac83bd75ac617cf6"

Content-Length: 190754

Accept-Ranges: bytes

......Exif..II*.................Ducky.......d.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236" xmpMM:DocumentID="xmp.did:0699FCAEAA0111E389E68AC7CC963200" xmpMM:InstanceID="xmp.iid:0699FCADAA0111E389E68AC7CC963200" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:069AD74DE0A9E311B383BEF54B638275" stRef:documentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................0...................................................................................................!.1".A..Q2#.aq$..B3%...4.....R..Ue&........................!.1..A"Qa.q.2#....B....R...br3...$.CScs.4.T%....Dt.U&............?..../*z..E].c..H..S..^g*...B....a.<.Q.....A ...$..M.>..M..........i6l{..p..rMdu..A1$...........r5W..S.......mmk......}u.......=#<...Dh...;.V.....N.r#;Q~...us..EO.

<<< skipped >>>

GET /img/Tuburera/bar7.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: ybyiv4D8I33VSWN1QfCs94c7TwKqzFd0h1yXceCLhscm3j6lTZlf5yN6zFru0 ZwrK73SwCMjSE=

x-amz-request-id: 401C50DE132BE7D5

x-amz-version-id: N2ls4ElWemvYIzegu69FA58gpcXntv9c

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:06:52 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:45 GMT

ETag: "4fa9087a65898badf6d8955c16d73809"

Content-Length: 10604

Accept-Ranges: bytes

.PNG........IHDR...'...(......{< ....tEXtSoftware.Adobe ImageReadyq.e<..).IDATx..}.p....7..w...."H..xS.)J2.H.....Z. {.x..!Wy....T%....T6..U...........,i..:m..u..H..).........>f&..=3.yx....R.Y.............Gy.....PRlX.k P..W..._.}..W.t=h.,..T*Yo.......r.m[.r..U.9..8....o:.,..../p.......,Uu..Tl=...[Z....h.TT.R...R..g..%.........^o*..O.Q...U.'....o.P.......tP..e.....B......L.m.......w.)..FQ.,..b......,qLq...9....vt...._...Wi.Y._.}..W.t=?.k.vc....bY.4M.X.4......<P.y.wK."..... .......`...B..B..?^x.%.w.}...K.>..NU......>....:..{...k5. ...s*n.r..~`9.UoT`...4..n....9...FL.OE.[.O........_...n.O....;.....D.A.......\....R....,...chp.c.....(.....466bI{ ../ESC.j1..]...4...`T.....f.....$n....#S(ZA....n~."..I.......d9....%.Y....H......s..\...V...uJ...MU.g....894)....[...\...iy..f...]..7...w..y.<.we9..s.b9..........?w ....~....t.....9s...i.$T......q...<uB.?.4.f...F.w\...5k....G$E..3..\.............PB......]w..;....A...MON.....?}./.."r.ql\..[..v....D../v"...T...U.|..........6...5.[y.n3......m]....H\.. XL..T.8.}....k.N.W..J..7.9.......b...Q.\...A..8..S.T......:Q..\'?...f.......8t`?..f.....W.v.:t45..*Y.)IX......f........w....n.~...c..u.q....y.GC.Q.~....P.f........X..d....8.O...~\.t.`NK..&...2m.(.T....$f.\b....c...R.1...T....C(.I...d.N..3.....ww.EhjM...7.....$.....Y....s....<.W...}...ip..E))X.c6..d...a.f...)...P......\*............o}...vC/.QH.appPR8..*.$.........k.....x?>.?...z..<..>....nk.,G...}>...W.....]Q...;SU...R..S.:/W4z..7.W.....p......dO..^........2....-..?s....\0b....~p.c...eY.....G..

<<< skipped >>>

GET /img/Rewudaw/BG_FS.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: D7RHfW4IBNiafqLXgK1yMrsq1tRtNBDgLrd YXutCL5TDvVt6k0UkqKTJ/BV8o94pn2dgm0bSjk=

x-amz-request-id: 510C72AFC43D7CE2

x-amz-version-id: Nz7N2MAKlOO7oSd4nN3DlfFquV7Kpg4k

x-amz-meta-cb-modifiedtime: Wed, 06 Jan 2016 14:31:32 GMT

Last-Modified: Wed, 06 Jan 2016 14:31:44 GMT

ETag: "9146e3b2964074e188543372a5757a2f"

Content-Length: 72475

Accept-Ranges: bytes

......JFIF.....`.`.....fExif..MM.*.................>...........F.(...........1.........N.......`.......`....paint.net 4.0.6....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..^.;.O.|:.#....j.}...i..zu.Y]....x.T.....kI....&)6...Uj.5...7.-...'..-.'......E..Z.....6........@.J....`.p..Y...&...Y.....%......7v...p.K.c......#..#..K..,.Z=..$W.i.|......g.;..H.....7.....UtTe.[.M.J-.....J.Zz........E.HA..[.R.v.../....|W..u]S_...g.Vyg..!......h.....1....\.Z....}ona...<J..I...m......U.!._.6....8....$Pq#g.!.:...$......gut.[j...........(...'..m.7V.l......{.....>.P....S...p.R.[.E.k ].....mo..QN..\.4...t.......>4.n.w..G..............(5.3..]...x..ebnd.Hp..&X.............5.W....o... ...kAo...v.j0]E5..........E.Y.D.......GZ.P.,...k....F......x`72..f.WF..J..8.IB...N..d/..%.....c.WA.?.O.......y..>../..}.Z../N./. {....`...:..[G.....^./.,>..iZ..*r..S.jta)...\]Y(BZ... Y......^......q.%.J..j....e...]hwz..$.a..c.!q...5.S`..U1m.\.vF.!.q..k.<3.xj.L>...z..g....MI .x.HY.V...O

<<< skipped >>>

GET /img/Nininininon/Nininininon.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: VhHHvOsrsrxS02dFYRAXu xxyR eKCwRemmLCZvasaWZ/7ENwYbEr/OOnVnctEtfUjk7/07R41c=

x-amz-request-id: DF5D79732860733A

x-amz-version-id: s.HW.VrEMobnKgHFcVDtYUH1Ob1rUFLd

x-amz-meta-cb-modifiedtime: Wed, 09 Dec 2015 16:17:48 GMT

Last-Modified: Wed, 09 Dec 2015 16:18:51 GMT

ETag: "2cad81e24a9d1d2c55b26ee3c73b61e5"

Content-Length: 415606

Accept-Ranges: bytes

.PNG........IHDR...0.........A.>.....sRGB.........gAMA......a.....pHYs.......... ......IDATx^...LVi.........C..h,...q.............b..((U........DAE.......{.}ko.{..y...|W\.zm...c.u.k....e.7):...;.);....$...PQY@...T.>.......T;YP.f7a...u.6q[.R........w...5..Z...,......4...Q`bJEE(......@.-kj.-.s.....u...\.JYu.Ua^TW$..w......s.......G...hhh.2d.`Y..{.......w.8....9...csvq|...~.....g.v..;..{.&.........8..FN....s..QjcJ...J./Sl|.../.....P......r;...)..G.j]Zo<....1......._"..O....y;nPz....L.wp!..O.o....%.v.......G..'4&.S_.CMn.yw..u.Dmz.5NO(.t.5!....R/."N..~..E..}.9B..)....0.GcG...e..?....9*.r.n.....9..b..........K.._y~....'...6...-({v... ...R.....h*R_...%g.:R..A]..j._Q.PH}....]...=...hN..^....f...M..;.^}...-..|i.q..YS..JS.'Zs.i.k..yP..BkN..'\..s....T{..:.....4y.c.4x.4d...Z9X.Y.....T......M..D...alG..5....s...qn.w..{.d.7...g-.....C...x..2#}J..QpZ..kSj.....(7e..G8....M.....i6......S....N{x$..\.d.-E....!...........%<..g.i..e.zKUm<.n.....Z.....O...V.=.........$...t...X4D...?c..c.4x.....>.q..1~.`A....X.KWx...[#F.w.H....60.d.'.n....~.|.....).5..q.3N.^?....Qq..(F....T^<E...............ObF@(...4.?....N\...ek.~.@.g$.......<..r..w.... .-4...H...h..f..;.ZY.R.J....3..J..H.g..M&X.1q..f.........C.. .Mu...jR#..ap.Mu_............&V.......C0.Z..9.g..(h....$.9:b>z...7..~.. Q...x.. ...{.2.B......\.....=:z.,..e..sZ?........g...i....hOKg...L]..l..r^~f.......?... . .u.....4.k.5...ZE{b...Q...1..5&\..;#...?..........._nT...G.R...........d......'.m;....OSD...(.S../.j..3.~..~...~K.3...k..|.,&........0_|..M*<......C..

<<< skipped >>>

GET /img/FF_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:56 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: rm0UXuL1qa09l 22ZQnZZIjvJQMb3vnCdbfCkcrjWcqGA7KAncMdfKoXDZ97YY/1y7b4Ge387go=

x-amz-request-id: 8913501312C777B6

x-amz-version-id: wLXM_trCFKsgiAKj58s6fy6EyOPJSUfV

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "177a897550166829af6f7d037d86a2d6"

Content-Length: 6157

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E6EBD962C8A311E48FF2C56440BD2A7D" xmpMM:InstanceID="xmp.iid:E6EBD961C8A311E48FF2C56440BD2A7D" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....IDATx..Zil\.y=o.}...CR.6...}..6...v....l(..h."......E...Q4M..1P.-..N....$.lk."k.,..HQ.Dr8..g.~{...,...&..R.......r....> B....../..(.TU...m7..q.....S...W...H_..................)..,T.........h....H....!...]1#...........l'lx0....g.pZ..Z..k!lW....'9..T..T.................g.....u=.!OU.S..]FWb$.......r....VSQ7..u........C9.o.....;.......y..y.8.x..v@a.......=..9|......C.do2.M%.}.Y..T..l..../.M..e....~.....s......W<G...3l9.1...g......D...F&...}..{'{...SF:.C<l .V...Bw6.......DmT..t!...x:....{...c..O.y.Q.|..l.....f.\.&._.i..v`9...CS......H....9..............Gx>.5........\..MO...,...

<<< skipped >>>

POST /PopaJar/ HTTP/1.1

Accept: */*

Host: os.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1440

Cache-Control: no-cache

...4.....>.K..~.gN....#&".<...>=.c....4.P.c..zYI=........w..62.?.ec..j..G...=!{.......].....<........a.

.E.....ASz..|8R.....".(e1\..u....28..G.3....\M....4c..T..8.nE.......;Y.F.."/.GO..].)..........G.NL...J!E...e.f...Q.......'0.......!.....8....>..^g.%..|....1..fcC.U.s.V..h..T/..8..)w.3..w......s.......#T.W....A.nJh.J.ps....>y.X.

\;>`j.Y..$....I.|3x....].4..?qD....A....D..-...7..4.........h......^^ J.)...U...l.....gra.' ....Wp..f...~ ....#...$Q].4..Y}6.8.VJM............|S...4.V.t...]6N-H....Ll..)Z8ih..D7.....O... ...c.....E...K8...J...M.8.....?.-..w...3!q...N...RgD*}.4k*..Q\L...W..C..|.L..a........4..H$.y4....Y.N..B..S.5<..gt.......x..j..Jf..l|..5....:...b*9....

53.@X7.5.&..l..8.t[...rG..Ouf.U... .....&......TR...K.......wH..Z....a.&.&...6.&.....i4..).........@..;(u..."..l./_5....._^,R.c.k.s.T...........C.5..j.}.m ,q..1...H..W...f... .mˆ....._..j..;.."...Q..0.C.T..85.=lqr.Ra........N.v.....uU..6......G...R........$...P..2.... ...{RF.J...g......IE...N...D.W.-..P....>L......w ..`.4R......p?.b..O....M#o.(......i...I.3...Nr.~>.....0H...k$a.k...~Q..wR..C..I....|E...T5K..etj. ..N..u....!j...dr.y.o.z.!..Ul.\*G.v....~.6.~s......v*.....kJu>.J.D..E.[\aZ..9].tGgs.I....z......J=Aa.3..Hd;...x.u....o.?nC.......*2...(=....c......._._..%..a.!........>.x.K......Fgy......D....-.[h. _.n.=.n..-?...

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Wed, 09 Nov 2016 22:30:45 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: currentSet20160925CSAIRS

X-ICSCT-IP: 194.242.96.218

X-ICSCT-SERVER-NAME: ads.slave-132-prod-eu-west-1a-eff63562

X-ICSCT-TIMESTAMP: 20161109173045849

X-ICSCT-VERSION: 1.3.2

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive

1ed0..X...G...G..e.we.."..<........<.....|Bpa.(M.yVE.\[...eD...[.[".S...`.$.5A......0.Y`...U.<.}.I<.i.......\c=.8..cb.1sR=T....o.%...{..\..h.`os.....O...N.\.W.{U.j.....U.O..: ..S.....:z.......G.xk._...K..`.....Y^w.;]|.........5..........n...4=..i..s'RW.!).~...d...8.=M5A...;..q..8=b...D%.s..>.....M....M.......!...ih.....[.x[2Y..f?..t... .......s.1.j..E..hP~.%(n!;......iz..X.\......#IL.Z..&P.A.........s.3...F..."...-.^.{1?.h..L..[L....pu:.6...........%...M.d.s2~.!o3...Z-..X......Y..%.S....a.]......#a.uq..R..c. .l..z9;.B.;.:ZdcwF..N..%8..:.Fx`......z..Uo....A}...T.g.K$....gqp......'....8C.;/4.%H....J...YJwu..P/.9J)...;.........A[...\..e.W...A.........Z7....Y.u59.....<%..vr"...Jz%_x..c...-5.Ix?{*.L...fp.4..eo.b.qD.zD...P.t.-)..l'.w)..R....?. .q.uW.......0....2.l.K....\nI.<..M.....>....e............2;8.w..n7x..k...z'..'.. .GC3.L.z.\......!.p.,.....T.]|SWwuj.F.J..}......0.......Vw..;...[....zd.Ign.....Y...V..pV......Q .l.B..Uf.........7..... .F.m.)p.rQM0..9..>.r... ..O.0.rN...W.. V.,.uK......"..........p#.*.,-.5.G....0.s...Q7..?..,V.U..c..@.v7O.y..^..r...{.F...I....`.6...4.h.0.C=..u.[..~~y.j.r.aY.L.[3. ...3...t..kF.>.1YPq..1......... .....t...<....M..Pq..t.....Zf.....P..B:c...S.X..fvAp.......~.x....1..t.t..#4........3..`..."...L.~0k4#.A....9*.-.wz.uG.6.i....`F..V],.a.2/.;..w.:M2........b........]N.zm...p3..`...G.t6u...h.7]...{..0....Kj-...^...c}....f......h9.".0..a.0.5.^n..,A.S..../4.o<'.........n-..2.w. ........ .>.{.-....F*P...De.gD.V2..,.R............&..xYG.pp_..;F...].W.....

<<< skipped >>>

HEAD /ofr/Solululadul/osutils.cis HTTP/1.1

Accept: */*

Host: cdneu.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 09 Nov 2016 22:30:49 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: XV54zlsO6VXl yAGbpw36WfLNdkM6Q0VlOchHgWqCaCcN9nGiR9IcwN3jkgaYAWTMzyWwq2XmxE=

x-amz-request-id: B347CA23C6E90581

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Accept-Ranges: bytes

HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 09 Nov 2016 22:30:49 GMT..Content-Type: application/octet-stream..Content-Length: 4013..Connection: keep-alive..x-amz-id-2: XV54zlsO6VXl yAGbpw36WfLNdkM6Q0VlOchHgWqCaCcN9nGiR9IcwN3jkgaYAWTMzyWwq2XmxE=..x-amz-request-id: B347CA23C6E90581..Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT..ETag: "569022425db355c9d82beba6efc44f22"..x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT..x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l..Accept-Ranges: bytes..

POST / HTTP/1.1

Accept: */*

Host: rp.Jajajapa.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1520

Cache-Control: no-cache

.I..~...$$.......E..G~..\....\..v..R..*.G[..)c......>.....]E...........Nc...n.;...(....H...?....I@.XqO9Gm.m.......uZ.}....8....<..\...,.&.I=%x....~O.)....a.5_..N.......~8...k...S....^..........U...<..[.=~[.U.%..*..z....~.b.q:VS..Q.....tA........r.......v....\...

6.3..*....]..I.D....e.... l. 8.9U.......g......#....|.8.>....a.....zA..I....K....b...x...rK..s...R..)..2....g.....Xw.

.60I`(a...VC..)......yk...p.]R...xaX.c....f...t.Wg.....v(a\uP"P.~..7.J.s..>y. /Xl.@..... .....8.O..R.7k|.....GV#-.o...2f........b...i....|..6]....s..3...8.Z0..^..k6..Q.r Q\..a........#3`..$&dE.<..:.T.....m....Sj..b.54$.......<.......:..bW.ua...knu.x48-...=...;...<.>.%TMJ.....=.X.K-1.a...5GF..._4........O..#..4I.Box.......9..._.c.Z....O.2......].}y..^.%{3vG...!OS....e!.#._..;.I.x.4E...........]....p..p.NiDD.xR..\.....*.#.#`.. .t........ZL...V.....w......{.....i.7.2....~.C..x.ff.[g.Qm......P....8i.M.))G.X...r.3.R.n.a..u.e./<..!Y...3..3...D....J[......p.W.X,..`F..U.Z!..$._P.7.m:UX.......i.}....l..g.}........$I...kjc.K.....e.z5

.Y.K8.... .o...&.K.qJD7..M$...T.^..@9..`g.......9......zj......v...f...q.,..wM.L..f........*..{}JN.-3r..=...c..s..4ml'..{........X..}.&.u(@...X.$.p..

R,N.....5kZ.2...#.X.

.h.l'....vA.......,:..K...G..TV(.?k=.l`bu>O.O.O?]yE..p.Sj7....|......ZD71....Ns.../...L....q.ro.pf..vt

.(.05! ...?. ....3

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Wed, 09 Nov 2016 22:30:46 GMT

Content-Length: 0

Connection: keep-alive

GET /HD_Player_Setup.exe HTTP/1.1

Range: bytes=27033600-30510919

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Wed, 09 Nov 2016 22:30:54 GMT

Content-Type: application/octet-stream

Content-Length: 3477320

Connection: keep-alive

Set-Cookie: __cfduid=dab2990b498dcbe519512f4a0187799c31478730654; expires=Thu, 09-Nov-17 22:30:54 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Sat, 12 Nov 2016 22:30:54 GMT

Cache-Control: public, max-age=259200

Content-Range: bytes 27033600-30510919/30510920

Server: cloudflare-nginx

CF-RAY: 2ff4b64001002914-OTP

..#.\.a.ma...e..q.hZ.5.......D.?........F..d..t0...n<q.u...1...k..8....e>.O.gca`.....w\.t..[..O.A..A.:k!`ss......y^...7m4Z....3{....G.{....h;.!...(K.?..T..J.(.}ub.%F.C..6.."..._T.....B..'gJ..{....i..[......bV%.........<0.4B..S...1D.56....{....b........&.....g..Ue.7.%..v.....C.w0.}.F.k....-...b5.....%c...6.8...:.......eG.R..SJ>3^.......MM.h.P..,....-6....k. ...d.y .(.X...!^. ./.*.nw. .?a......`M{..H..B(...ly...9.d .-.1J..y.x........2.=- .[.d...,.@GG9... .Te....pJ...!....o!.>........|gH{U..RB...O..M...[k..Q....G.x6~.@..U.o.)k..v.......`h..i.\&}...........`\/..'QzSzC.B. ....*K.......C@plK...)....3.......bl.....2-F.X)........C.j1Qx..................1.!({T...0p.....D.i............P.P...@._...h...KO..#;W?./K*.,'.q.....OmP...F.|?..>...2n......9{r....w......kO..kkN.Pr.H.x.......i'..........Wp.e........2,J1.rP* RI.H....a..C............} .=...P../...............$.......J.4p.$O*.P.*......b....D.>.$B.b..w.<....../oO..6.......^..P?...)..L...(.W.`....R:.M.....|....J....1.=...`....&..{r.......^yY..xB....33.;u...%....?..,E..B...ML..Q[04.r.. h..ED.......i.9...GW.~.&......_.&......%..... #...........-@,h.7c..z..A......,x7.;]..cR...|......5.].n.x...N....eC...P.],/0.?5.......Q..Juw....%....fW....j.W..p ...J.J#....>....=].$.4\....N/.^.7.T....e..1r.F.k$...tS(..^......}...Hq]_..em...M.FH.#..V....8.....gs. |m$..6..{....Z......4.U..u...Is...Z.....,.s.....h&.34..............Y...)...JD.hL.0........K[.;.3.).J ...moz..,.K..NEU.=&......>W@..k\;.......T>...<e......Q.0.b...^EA.. WB..OS..s.....7,.L.s.......|

<<< skipped >>>

GET /HD_Player_Setup.exe HTTP/1.1

Range: bytes=16384000-30510919

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Connection: Keep-Alive

<<< skipped >>>

GET /img/Malaromoro/bg2.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:52 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: cp//ImbNVqNRMR0zy7x Z Vva4TFH6PXxlzvfYTerZF0we6H2xmJDwWaN0hQ/A5yTHBqZq SfO4=

x-amz-request-id: 9A5161562F9E8AD8

x-amz-version-id: JMXnkH_Q4w85o.RRxkVvr1HHBSYxTWbA

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

ETag: "3ca90bdb0184dba078b0e604eb239df0"

Content-Length: 59210

Accept-Ranges: bytes

......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:345E81DDDAA9E311B383BEF54B638275" xmpMM:DocumentID="xmp.did:118EE61EAA0211E3A8EABD135B592C02" xmpMM:InstanceID="xmp.iid:118EE61DAA0211E3A8EABD135B592C02" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:086B2D40FAA9E311A847ACF83C7EB2CA" stRef:documentID="xmp.did:345E81DDDAA9E311B383BEF54B638275"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................0.........................................................................................!.1.A".Qa2..q...B#3..Rb...C$45..r..cs%....S.DT....U..E&......................!1.A.Qa.q.."2......B..Rb.#..r.3...cs.$............?...@L...-..I....E.i..D2P.*..b.,...]H.Z7.|1.....v.4....M.....T.<.Q......z.....u9...\u.......M....r'.gW.hM.B...I.....I...0@.....I..:.....:.s.......:...L..._..#_.D..#~...4..~&

<<< skipped >>>

GET /img/Tuburera/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

<<< skipped >>>

GET /img/Tuburera/truste.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:53 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: 7l3E29F0D0C/wDQEUCU71eb91JLAXkzIJtTXslhsvw 6y0niLLrh/S1WYDrx3ll8hojHrWJmgxw=

x-amz-request-id: 293EF3E053241A2F

x-amz-version-id: TsQX4cb1jyoGu5DXk3rpuvCf_fAlhQQa

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:27 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

ETag: "9d7db4bf8aea860f288e41d97c3687a1"

Content-Length: 11597

Accept-Ranges: bytes

.PNG........IHDR...A...U.............tEXtSoftware.Adobe ImageReadyq.e<..,.IDATx..|..].u....ez/*..D....f....)6.KlB......%....;.>..8..<.Nl.......l.hB.Q..F..4.....sOy..w.......;..w............(... ...;yx>l..`.M....m..i..[..v....V.R1.y...r9...p.<....ab...H$......D#(....#...X.j.......?pp..O<..H4ZX}...,?...s'..a..}..-9..s7.X.Bn.a..gm~...y.`[[...W\.`CSc..{...bU.J....B.U..|!.U4....>.n....`..3......!..............G|....._........c.....|.....m...?......q..&>..o~......g?........o....'?...[..G.6uv........;.../z..]....<'.U............,K}......p@ss3.../.P(.........PW..n..333....088(..v.Z|.c....c.....?._}.....k.L$.w..u..C...0~..q ......L&....n...m..7.!....;.....;#...7}.&\s.5....O~..z\....gPu.8...~(..m..........%.\...0s...8N.?..u.V?.H..]...7.w...r&.....n..|.z.0....].#.=....754......s.[........w.u...I...,..;.|...........y..3......f...?.>...0..g.y..[.lYy2^ ..7M....Z.Bx..#.w...b.....a1.....l....pTzS...*..(...:.jjj....w..e..w......k..... .........1:..>.."TU....6b....}.........../.....~..7..e.d.A...MZD.r&..._5..>..8...z.K.-..........oDSK3.mU84.A.6L.>.DV.....Yc~...Dkk........<.(...N.... ..........ax..%....BN.9k.F.XBgg'....q...s..5k.l=a#....A<.,...kF.....,.yd|.X.@X..l.7.p....ny.[.U........O....k"^....v|....e.g7HL............u0.&...S....0..P5....{/<.0..I.u.'....a0w..~..}.=.8..<......~....p..TJ~...!....<.~...v.Z&r..O?s.H...X.l......M.....r....u.]'........?;9.z.Y#..P.\\~..x..g.._?........[W.u.Y/1|L..'."..>/V..s.='.f..%..z.).?.....7......g...r.....g<..-....-Y.....%....E~2.......

<<< skipped >>>

GET /img/Tuburera/logo_b.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: Uh5C6kYbeEqMpeswtUySrfz8rZXD0z1DxO8GFBRHVf4 wxs 1tc8tej 7xMR7fhyFheiT//QN28=

x-amz-request-id: D0127800804591F9

x-amz-version-id: akDXJVqWGXlhXhhZ8YepY7NAR4.yDN8P

x-amz-meta-s3fox-modifiedtime: 1392281588994

x-amz-meta-s3fox-filesize: 11762

Last-Modified: Thu, 13 Feb 2014 09:38:37 GMT

ETag: "cc4bec630c2ec102cb6159e463ede5cc"

Content-Length: 11762

Accept-Ranges: bytes

.PNG........IHDR.......-.......;.....pHYs..........o.d...OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /img/IE_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: F beCNsnxybNkjFz97epsGEkpt2m0MFeiBD6iauSOtWDRf52cD/o2r0ftOrXvMq0mm4ONoyQzgU=

x-amz-request-id: 42AF2AB59210A6CB

x-amz-version-id: JCaAVEF0XYSznIkNb1ccJeiC74z2Hy2T

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "d86b9d354a5cdd126ae5250c162630d3"

Content-Length: 5921

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:10B50654C8A411E4A871F63F79D4AE1E" xmpMM:InstanceID="xmp.iid:10B50653C8A411E4A871F63F79D4AE1E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.. Y....IDATx..Z{.......].==...a....A....Z.$$.=..s.G...M6.Y_..l.&.$..yxt..W.9.....b|F.. 1.A..F`...GwOwuW....W.3A..`..{..........{...a!.}T_.L..4.t..\...a.?......C.....kPL*.S...........}..k.w}..8.5C...E...?.$..?^......N......Iz...3TKW.B.)....).R.....E.C.........L.~..v.......%B'N..%..U.e]........!.~.:8O.ZG..Ie.1.).....h.X...d_...W.L..bi.6.ps....1x.....O.....Zx.,..W.F.r..[..<.L.?...XqZ..t...XEP...*RI\0.0)D...=.n.....|.(S(...O....We.k.8.X.........# ..........P....S...m.##...Vq..Rt.."."# ..........>..nA...1.... E.cE...h......$.1..JQ..!..o...;$..O.GA J.R.cV.Xp..f<.s}4<........7..A'..V.RX

<<< skipped >>>

GET /img/CH_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: hIbI4uowjv4LrP3Rl B3Rxzj6R3 hgarwOZ91v2Kw xPLs1s7nGeCwg0ZsP45BECiOItZ/eobD8=

x-amz-request-id: 18227B7996D6E96F

x-amz-version-id: omxwqkFcs1tUW940Ss4VTxiINXau15QT

x-amz-meta-cb-modifiedtime: Wed, 18 Mar 2015 10:35:00 GMT

Last-Modified: Wed, 18 Mar 2015 10:35:12 GMT

ETag: "ba264606ca1d89ed519c9b8b3515f163"

Content-Length: 4849

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:B8B544DFCD4F11E4BC7FA5DADF6159A3" xmpMM:DocumentID="xmp.did:B8B544E0CD4F11E4BC7FA5DADF6159A3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B8B544DDCD4F11E4BC7FA5DADF6159A3" stRef:documentID="xmp.did:B8B544DECD4F11E4BC7FA5DADF6159A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..<....eIDATx..Zyl..y..9...\rEQ.%J.M...I.U...4E*..].A[.h...:hQ.)P .Z.@.(..H]4..*.R7Q.D.m].bK.%X.uQ$%...s.cvf...f.,W.%..x....y...}......!.Y;.c.YQ.=S.....gOv...6f.~.=9W.g.........:b4..d..8.m....o=...;]`......I..'.......3..u1:...\......No..p..\...... .h-..QF X@C.....*..#..........?..|.4>.........4...Ohl.^....Q............?..B2.^...!8.)4h..Me...$/8...}}.8.v..{9.cc....T..).p..{U.......8.'....o...Z.....fw!..OBD...PiIE..\uFT. m....z..w.`...p...p....d27h.C.)N...*.<9.]o...-(.. .Y.T2.P8.x...d!..!...S......(.........5D..t...S.,]....\;......H_8V..c...t9I......d.6.E..*.'..]O..1.!-!c.\7........N:.

<<< skipped >>>

GET /img/Cazurazihiz/Cazurazihiz.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: dtZbUcrSsKhxgUrPb/mDKn8 YL/S4Ku 03NpQ1qbkovBFejAX8cXmwJSvh2h8gPK6oiYhukuX0k=

x-amz-request-id: 055E8F3F38FA708F

x-amz-version-id: wyC6mtJU.8C8djRcSmCE4rVxqum5xvWX

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 17:53:51 GMT

Last-Modified: Thu, 31 Dec 2015 17:54:18 GMT

ETag: "a22c3d2918d1834d285dae064d3cee86"

Content-Length: 5983

Accept-Ranges: bytes

.PNG........IHDR.......'......i:.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtAuthor.Nir SaharZb].... tEXtCreationTime.2015:06:24 17:02:12a .A....tEXtSoftware.paint.net 4.0.6..c.....IDATx^.[y\Tu.F....a.a`.....4mQ.7..Y...Yo.........[...........H.............;....sirf..L.T?.x..{.s.\.<.9.9.........j..-....lA.....q.4.'.EN..........Z?-...h[..O....F._.>.......)~J$i.X..IP!Q..d./R...9.l..1.....}.. .\C..q..0..A..PlT."..5...E.-...Z...O......B6!.>.Cs'Z.P.....u.X...9N.....8. .fW).:t@Ix.}..u.....@.).~1.[.=.@b.....>r.PLD..I..mA ;....t........l..T....G...'...G$..iE.9........-.)....To?\Y.C.`r--...lp%a...T.f..be.. .p.w.b.8...hk.;.H...p...8jk.#...u..j.s'. r.9.,[&.=..9...)v........<....t..........{..;..D.{.v......8. ....{:.b...Q..].q.I...".rp.v....J.9:...#r.mq..=K..2Y..L..w..~"k1..........U..t.............q..A...Q.....0.....!Jk..>Dd.Id; ".eC)...1R.lg'....U....w....b_..... 0$...V...QH..`.L..bVIJ..r').fS.>b...R.|.?CjwXd..r9.rO.e._`C8s..>..S.....|.A=...{......#Gb..U8}.4.Z.\...C......1L.>....>S..8.c...]..7...K..[o..y.....{..h.....@.......q..I.........^M.....PRR./................k.k*...Z?d...4...ze8..'.VdC........Y.....@E.j..s.?q*.CC..;.....e.. ..4..>.".....:u.VgWJ...$.f.rC.....<.).^G{,..B...o.%..........#::...-Z..s.b..ax..7.../ **..7?W(]..v....&&....a..-..e......}||p....Y..5l....>..p..........4...g....C....{....a..a.....?...{..?..rrr......7...VXX..V......c..Z...0.....H ...8...M)........T.....vm...2..~.. .c.{}.;..C.........z..u.....=?G........%b.{b..............JFd....0....7.9?"...&g

<<< skipped >>>

GET /img/Fividof/BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: IfWAAWNwipBBeZtu0eV3xssTdFgMQwNPUjsqcLkVZswWn6rlwBCtC7GsU7vTqbOz DBcaER3NL8=

x-amz-request-id: 2DD93D2F2E476257

Last-Modified: Mon, 08 Aug 2016 08:08:18 GMT

ETag: "024f03602a6f7fe69592f9472cb01d4f"

x-amz-meta-cb-modifiedtime: Sun, 07 Aug 2016 14:10:06 GMT

x-amz-version-id: X3Cs5_ZFW8itsyxo6oqulRxPSOcm3fMR

Content-Length: 27707

Accept-Ranges: bytes

.PNG........IHDR...0.........6..I....tEXtSoftware.Adobe ImageReadyq.e<..k.IDATx....t..u.x.Wt7.... ..../.I..IY.#[.$/...I~.3.bYV...s&/.3o9y......Ifb.yq.o.%[.%."...wp.Ap.Bb_..Fw.....F........'.......j.~u.w.%.....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ..f.4Y.....n.B..[w.>..H..B".H#.\'.j.v....../............a..].Rw..4= .w.:.."..2.Q...P.;O=.W...$......W.[.....>\.ey...>........;.w...#.......k......|$...k^.,..t.J5..@..jE<........k.T.......6x]...R.3.a......5.c... .P..u......e...aM..F"'.;.m...g.....:.G.j-..".I.S.....M...r..B .x^T.O./....Z....k.4..9..C .(\..3.......fE.....5->_.]...<.XL..CNM=R>< .1...H.G.5...fzma..p..S.\......<......=E{N.......e...]#....Kj{v4C9C..g.w.......5~A..[I...e.u.w^...fp.5..1......N...E`L...I^.xN}..>1..-....F.........[.iN*.i....E.k....5.....A.^P..\......w....d...th]M]...8...HC%9h...v.I....?\...Y..O..b.,1....i.....i....z6...........o.....c.I..4....e...A.}|.]......"\x..w o ..9..u..5.:E_..|.L9.4.y@P.4....!.Ns.o..........z.......Z....V...$.W..y.5..........e..K.pn.y.....p.o..........|.t..-..9.;.....u...5...6..4\.X....g.......8/...........q{".k;^.tn.>.M.. ).v.o.<..I...=.k..M.5.L.K.6.A[.q.c;b.k.X....-A.8..9W4 ..I.......%].'....D.h.....x...U.. ..x......8f.....E..t..5:...j..B......y... ]....T.;.....n.6x,......V.0..>{.f..m.6..............0..?GC..dC.l....?.;......x7.......G8.0....qs.....c..>.o...{.M..x.8....1.

<<< skipped >>>

GET /img/Fividof/FS_BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:54 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: LA0yxvZQrBRQSQpQp/O7DkMM 4HqSdChunFSrpvpyqelmhtT4vwcue 5 htkY/4vGq/O/ZOz3y0=

x-amz-request-id: B707E369E2824181

Last-Modified: Thu, 25 Aug 2016 16:15:53 GMT

ETag: "20838f981ab877adebe8cc27d8fd8e8a"

x-amz-version-id: NGHte6ooz0o7QShucGRMfn4HeyGT11cm

Content-Length: 20910

Accept-Ranges: bytes

.PNG........IHDR..............u......tEXtSoftware.Adobe ImageReadyq.e<..QPIDATx....p\.u.......9..s..pr.&..fd..%.A............^...z..d....gK.% Z..H..C.sN ..r...}.sn7.. ..`...Pw.h4...=..~... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ....&.`aq..v-i..RV...<gV..4...V..kId....-.....A...n...}W ..[...t ..^....."..y.V...P[...Xm.j.....1.L.....<"gR..A.X..=..M.l..@..l....V)..Q.*3)..j(W?...=...6...j3....~.4...l:....\._.. ......C..)=-.;..J]. .Cm....W...>.V........6{Ndmj3...t....:z.. ....S...K./... .. ....x....d.f......kR.T.(.t..N!.r.f.u(G..Z.^.)'.......yC5...E/.9.]....x8....7...5.t..._M.;(.. .|..m....vS@.hYVG.:m...O.....). T.U\r.p.\..N...dB"....gq........<....v^m/.mg....m.I.X..A.....N.;..4d.z.:5..T.J|26u...I`i..B...v....bF*.........HGS..w:1....U]...R.Km.... ...v..~.d....f*..].Mk.u.(.........6....}.....dV.7.......w.#..\K|..j.P.Q.......]..M.?.A....Y.G..H."kS..P.'...b...?.....;JM&miV..4v.ZQ..TBKn..;."..w.C.Jx.....G{1.5..6.|-.M_TO... Nf.._..ZZ.i.. ......A..D....^u7mT..e;.w.:.b.4o........M......f2l...7M./.m..8.\.a... ...4.d.....3j.G...u..K./.... ...D.....h.d3.Y=KM&...T.D.Hm.0.c....`),L.b.._.Y...V...6...gV._.@&......7K.`.Z......Sh....`0.F..[.....3j.K.j.qQ9...L...J.W.... ..}$.....,...PIb....%.E..j.j...,.q...='.N..............7.y........2vTYd.X..D..;[q..yt.u#.I.Ix.|d...gCv5XL.8...J<.W.._......*.F.~........C...^..?Y...D6nW....Dk.6.O....RbS.../.01..n..V.Hv..(7.%.(.)....C..Z8.....I..{/8.af...d..`..'/...6t.w.....zYJ......_..f..`.Y.k6..v.W.S..

<<< skipped >>>

GET /img/Rewudaw/BG.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.jajajapa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Wed, 09 Nov 2016 22:52:55 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: Ga/cghau9lXLL67Ti8BXGY0K7fpRZcv29ErPxPobdHevbrbU4KJUQMU0j1yNRr4gZd8lVoA5cko=

x-amz-request-id: 26A2C380F00C15A1

x-amz-version-id: sCJ._v0SQy.IKyc6FrWiaRIAYL2XAV4H

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 19:47:01 GMT

Last-Modified: Thu, 31 Dec 2015 19:47:27 GMT

ETag: "d4337f9e3cdbb54bd455a9b749954a87"

Content-Length: 102878

Accept-Ranges: bytes

......JFIF.....`.`.....fExif..MM.*.................>...........F.(...........1.........N.......`.......`....paint.net 4.0.5....C....................................................................C.........................................................................0.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..5.u.... .z'.|.........z...G$....1..[K..=.........^..g.....-.O..}.....6:....r[!gw.....{.[..[.....c\$Q......:M..6.^....9............6x.x...w...J.q..x.`..S.UO..._.q._....J..n..JJ.m.I%.r.w...s. .NTd.\..T............Zm....|v...9...P.4.P.d:m......B.D.[.|3...o..y.s=..R.].._L.x.C....:R\H.....Zy..2.<....O...4...u85.kO.[./...E../..u... ....h...Ju..8O....;v.._....R...4m.2.w.3.G...ZT.Zo.SI...Ke.E.3.8...I7.........}.O....4x-..<j.$..Y..._....>.......C.Dg...G.........(...........Xh.^..h....M.}.U.5..M..O:...=Jy.,......*.'.Ic...<....#k.,.r..~.S.......D..e.Y..Y..L...HO..TO..".... ./j.p...5...Z.O.J...}.\9Z...m..c..%R.....2..........'.g...).....4.^O....].....}.j.....X.C.o.n.d...s..qx...Y...f&..N..n|Is.C.K...~x...d.....*l.|~...~...>".7...........mk..|<.6....E.^.~ ....o$..H.67.[..]....(..F....t...c

<<< skipped >>>

GET /HD_Player_Setup.exe HTTP/1.1

Range: bytes=29491200-30510919

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Wed, 09 Nov 2016 22:30:54 GMT

Content-Type: application/octet-stream

Content-Length: 1019720

Connection: keep-alive

Set-Cookie: __cfduid=d96dbde056fd2c8b5cc209a74e7e10be31478730654; expires=Thu, 09-Nov-17 22:30:54 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Sat, 12 Nov 2016 22:30:54 GMT

Cache-Control: public, max-age=259200

Content-Range: bytes 29491200-30510919/30510920

Server: cloudflare-nginx

CF-RAY: 2ff4b64161852902-OTP

......]k$_.E.s".l.......0E....\Kx34...8.j.i...?.....!..a.....j...)...YBL ..zk.]..@7.Z......\.....N&\X....T.?&...JE....7...O.~...5.$O2.`...<...2.....b..".wJ..(s.zw9.....-.G..t..8....l.lP...Sl.|.........9bQ..W?F2.B.H#......t.....)N.p....O.4.. ...#Y.....@.....t......9..n.....k.>...i...y.[K%...S..........Z....Q..N.qB.B.\&..@J.C|`M..;.....!s%^...p....e.\..`p[.....s.1... ....y..x.."......u..S.ra.m.v, 4....WG.E.C...{.O..D=(...W5...x{.g.S.|#......'.........F...n..Fws.#......T....r.H..7......Jh........>.........RJ.....~....5...icg.e..2..}#j.8a....9...;...._..5b..5j.....3.3..,.txl.>....nR.z...I....^..X......v..u.....K..U..nc......;.........E...3%w}M.V......!.F...S...L...`.....fx.....{c...r\.lLB@..]1......W.....U...*..T;..t....D........(.......4.....z... .Y,i....k`....qO...qL.v....T.'...%....m>.6Z^!......b.#..E.K...k }ny.^.......Z.^#.r.&.o....My...r.cI^).......:.....SE..j....E.T.wQ.$.......qA..K/....I....jf}D$....(.bX~...,...2..JL....1r..u..&w.n.].&.;...-....|.is.>.B.....K/.|...Y......p.:.$T.j......EZ.....Q......F.....|..CA.'b.B.X.qTC...1.9..nu6......O}......... 4r....q.G.T......A.r.q..IH....,z......)r......}....{.L.R.i..i..... .M....3....2..[.-../y.<.V.21.!._)|bM..E..F...S=.........*.[..rm...dk/.p!!!...Z0....~....%....._....R... .^>..*.....*.J...bj>&..d^....s.Y'..Z..F..ZP..........;.....aEj v|s~id.......k\$.....@......n....f...z....%(K.6.........P.VQ.5Q.........@.....%...y...$.N.....N.'..A:d....s_...JS....a.w.?}._..OE.Oaj........X.?)..J.A.%.9PJ.....b..Sw=..Rjl).. ..iD.;G.>......|....q.J..?..

<<< skipped >>>

HEAD /HD_Player_Setup.exe HTTP/1.1

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 09 Nov 2016 22:30:43 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Set-Cookie: __cfduid=dad8574c237a3f0305573704bfac93ac71478730643; expires=Thu, 09-Nov-17 22:30:43 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Sat, 12 Nov 2016 22:30:43 GMT

Cache-Control: public, max-age=259200

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 2ff4b5fc3724294a-OTP

....

GET /HD_Player_Setup.exe HTTP/1.1

Range: bytes=0-30510919

Accept: */*

Host: cdn.bridgeaccesspoint.com

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Wed, 09 Nov 2016 22:30:44 GMT

Content-Type: application/octet-stream

Content-Length: 30510920

Connection: keep-alive

Set-Cookie: __cfduid=de25fea9b5f1b19f1ac7c63ddd456ee3c1478730644; expires=Thu, 09-Nov-17 22:30:44 GMT; path=/; domain=.bridgeaccesspoint.com; HttpOnly

Last-Modified: Mon, 08 Feb 2016 15:35:58 GMT

ETag: "083f9678662d11:0"

X-Powered-By: ASP.NET

CF-Cache-Status: HIT

Expires: Sat, 12 Nov 2016 22:30:44 GMT

Cache-Control: public, max-age=259200

Content-Range: bytes 0-30510919/30510920

Server: cloudflare-nginx

CF-RAY: 2ff4b5fd876b294a-OTP

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..V............................]C............@..................................t........ ......................................p..Pk...........q...............................................................................................text............................... .0`.data...............................@.`..rdata...i.......j..................@.`@.bss......... ........................`..idata..............................@.0..ndata..............................@.`..rsrc...Pk...p...l..................@.0.................................................................................................................................................................................................................................................................................................................................................................................U..WVS.......U..E....t...F..........B..H...H.......E..5 .B..D$..E...$....B.SS...E..E......D$..E...$....B..E.WW.E......E..}.9}........E.)..E..FT.........FP.....E.....}.........FT.......FP..E.....}.......FT..........FP........E.....}..........E..M...$..`.B.R...E...D$..E...$.D$.....B.....<$..h.B..E..Q.H....~X........F4..$..d.B...W..........$.E......E......D$.......x.B.RR.FX..$.D$...|.B.QQ.5p.B...$.|$....E.R.E.R..$.D$. ....D$..D$......D$...B.....B..U......$.T$...QQ.<$..h.B.S.E..D$..E...$....B.PP1....D$..E

<<< skipped >>>

Map

The Installer connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2748:

.idata

.idata

.rdata

.rdata

P.reloc

P.reloc

P.rsrc

P.rsrc

kernel32.dll

kernel32.dll

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

File I/O error %d

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

lzmadecompsmall: %s

LzmaDecode failed (%d)

LzmaDecode failed (%d)

shell32.dll

shell32.dll

/SL5="$%x,%d,%d,

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.0)

Inno Setup Messages (5.5.0)

mu2.iu

mu2.iu

user32.dll

user32.dll

oleaut32.dll

oleaut32.dll

advapi32.dll

advapi32.dll

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

GetWindowsDirectoryA

GetWindowsDirectoryA

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

ExitWindowsEx

ExitWindowsEx

comctl32.dll

comctl32.dll

name="JR.Inno.Setup"

name="JR.Inno.Setup"

version="1.0.0.0"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

true

true

!'%s' is not a valid integer value('%s' is not a valid floating point value

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

I/O error %d

Integer overflow Invalid floating point operation

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

Invalid variant operation"Variant method calls not supported

External exception %x

External exception %x

5.3.4

5.3.4

%original file name%.exe_2748_rwx_012C0000_000CC000:

-i}]qg

-i}]qg

.ZNnR?

.ZNnR?

w.HoJ

w.HoJ

5@%s9Pf2u

5@%s9Pf2u

:A.QM"y

:A.QM"y

vQ&%s|V

vQ&%s|V

dw.nW=(

dw.nW=(

.QI6_

.QI6_

.BY3>

.BY3>

.TgF5

.TgF5

a35URlEN

a35URlEN

D9>%F

D9>%F

v%SW'

v%SW'

u%9Sb

u%9Sb

rxx.wC

rxx.wC

[*G.hF

[*G.hF

SY%8SB

SY%8SB

~P=m%U

~P=m%U

\%Fkul

\%Fkul

,.LN}

,.LN}

YWN.Ww-

YWN.Ww-

dE%sFy

dE%sFy

4u.MO

4u.MO

rzmE.iM

rzmE.iM

KW`s.HF7%>

KW`s.HF7%>

h~p%u

h~p%u

?..XQE

?..XQE

]n%CV

]n%CV

nY].AL

nY].AL

Fþ$X

Fþ$X

*%frW

*%frW

%c*[a

%c*[a

%6-zK}

%6-zK}

.DKCO]3

.DKCO]3

..Tz.?

..Tz.?

zZ$S%S

zZ$S%S

_@%FqG

_@%FqG

%XhPZ

%XhPZ

3m{.Lh

3m{.Lh

.Rx~\IA

.Rx~\IA

U 4.%C

U 4.%C

p!.lW

p!.lW

.kRp!

.kRp!

(OS%dt

(OS%dt

u2.IKo_

u2.IKo_

%0uY]

%0uY]

%uLYx

%uLYx

.KdnTa!

.KdnTa!

YW.Pg_

YW.Pg_

Y.xtg

Y.xtg

|7J.sw

|7J.sw

/=[.As

/=[.As

V6.Ji\

V6.Ji\

Bn{%x$

Bn{%x$

2d%C o&z{

2d%C o&z{

y4M.pA*

y4M.pA*

.HbFw]

.HbFw]

%xjtu

%xjtu

RL.NxG

RL.NxG

Y?).sg

Y?).sg

Xr.WB

Xr.WB

.qfRW

.qfRW

Q8%uWy.vsi(

Q8%uWy.vsi(

.hv#;

.hv#;

;T.NT|

;T.NT|

.zAy?`

.zAy?`

t.QC-

t.QC-

tR6%dw

tR6%dw

D`v6.LJ

D`v6.LJ

%original file name%.exe_2748_rwx_01390000_000CB000:

$.iIv

$.iIv

2%D#L

2%D#L

@\.GoTk

@\.GoTk

<.gs9z>

<.gs9z>

7N.vC2

7N.vC2

-4uDP

-4uDP

Y%C?e

Y%C?e

#.WuY

#.WuY

g|.Wp

g|.Wp

F.BLt

F.BLt

'4.zlD

'4.zlD

t{V>8%utQ

t{V>8%utQ

.XNAj

.XNAj

%fJ@

%fJ@

FR%sv

FR%sv

|-.pF

|-.pF

r2.Ylj

r2.Ylj

Gv.Sq

Gv.Sq

A%uug=y

A%uug=y

t.LAq&

t.LAq&

%xH3-

%xH3-

%uVS$

%uVS$

%x?`"MG

%x?`"MG

0.jVrA^

0.jVrA^

%x9Ge

%x9Ge

R#.FO@T

R#.FO@T

û~r

û~r

89.Tie

89.Tie

n#.SU5

n#.SU5

%Uc#f

%Uc#f

4.PJ^

4.PJ^

7 \MZ|%d

7 \MZ|%d

/`E%c

/`E%c

.zJ^%

.zJ^%

-E3}\

-E3}\

w.WaA

w.WaA

(.Rm]

(.Rm]

,81%d

,81%d

^%uZn7

^%uZn7

k64.OM

k64.OM

g%3XI

g%3XI

.XRNB

.XRNB

%Àc

%Àc

%dmKl

%dmKl

1EUh%c

1EUh%c

|Å’>

|Å’>

sSh53$

sSh53$

WEB4&

WEB4&

!rË

!rË

6p2.iXEr

6p2.iXEr

,'u%S7U

,'u%S7U

.XQmE[}

.XQmE[}

fs%C(

fs%C(

3%xB$

3%xB$

5pC-c}:

5pC-c}:

X.%xY

X.%xY

..EtEh

..EtEh

{4j%d

{4j%d

k%CP_

k%CP_

n@.EV

n@.EV

\.TKC

\.TKC

?4j-zY}}

?4j-zY}}

@%c@@@Y=

@%c@@@Y=

.Yy{k`B

.Yy{k`B

:.Rak'

:.Rak'

6..mN

6..mN

E.Kw&

E.Kw&

.IB/][

.IB/][

M.rQ2[

M.rQ2[

Ils[%xu

Ils[%xu

E;%u6

E;%u6

/vO%U

/vO%U

| X.AJ

| X.AJ

vz.WI|_D

vz.WI|_D

%original file name%.exe_2748_rwx_01640000_000C0000:

S#.RW(x

S#.RW(x

1.cUp@.

1.cUp@.

%u ]}a

%u ]}a

q) .Nb

q) .Nb

.rNf4

.rNf4

}h.GZ1{

}h.GZ1{

NN%dj

NN%dj

huQ.%x

huQ.%x

.AIvm

.AIvm

|T%FOw

|T%FOw

2?* |3^6?

2?* |3^6?

O r.mj

O r.mj

*B%u4

*B%u4

5P.if0

5P.if0

_.lImn;

_.lImn;

.qR)_D

.qR)_D

DB.kO

DB.kO

.ZUZ

.ZUZ

]ÃŽy

]ÃŽy

.xOU5

.xOU5

r%StP

r%StP

1n.tf

1n.tf

F@.1%C

F@.1%C

@"J.BZ

@"J.BZ

%SOt

%SOt

U=V%2X;

U=V%2X;

.uxQD

.uxQD

j%.Ek

j%.Ek

"H.YdC

"H.YdC

ITcp

ITcp

fy%st,1%

fy%st,1%

|A'!

|A'!

.wW`8

.wW`8

^>.Hd

^>.Hd

.Pq-\

.Pq-\

m;:%s

m;:%s

K-7w}

K-7w}

.zgLÊ*

.zgLÊ*

7ÝW(_

7ÝW(_

vP%sH.''

vP%sH.''

;.DhHut

;.DhHut

6.jw_W|

6.jw_W|

-iP}=

-iP}=

.TIi9

.TIi9

O>.IR;

O>.IR;

I\.iRP6

I\.iRP6

.SY1W

.SY1W

w5%F]Uc

w5%F]Uc

.wA1-[vA

.wA1-[vA

qe:%S

qe:%S

mi.fU

mi.fU

J.Jyw8

J.Jyw8

GÜ[

GÜ[

@/]e%D

@/]e%D

>.IYx2

>.IYx2

2 .Ty

2 .Ty

wE%ds

wE%ds

%djIZ'4

%djIZ'4

%c'7O

%c'7O

/7.GY

/7.GY

C&.ytHz

C&.ytHz

x2.dzQqYw

x2.dzQqYw

*!s.fy

*!s.fy

2I,.oR

2I,.oR

)~x%X

)~x%X

-k}j|

-k}j|

1uRLv

1uRLv

t].kZ

t].kZ

r%SY0a_

r%SY0a_

#%xLi

#%xLi

y%Ftu

y%Ftu

.Hqh>va

.Hqh>va

%original file name%.exe_2748_rwx_017D1000_0018A000:

kernel32.dll

kernel32.dll

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

u%CNu

u%CNu

%s[%d]

%s[%d]

%s_%d

%s_%d

.Owner

.Owner

EInvalidGraphicOperation

EInvalidGraphicOperation

USER32.DLL

USER32.DLL

comctl32.dll

comctl32.dll

UrlMon

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

JumpID("","%s")

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeywordD?~

HelpKeywordD?~

crSQLWait

crSQLWait

%s (%s)

%s (%s)

IMM32.DLL

IMM32.DLL

AutoHotkeys|

AutoHotkeys|

AutoHotkeys

AutoHotkeys

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreviewp

KeyPreviewp

WindowState

WindowState

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp,

OnKeyUp,

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

vcltest3.dll

User32.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

Portuguese

Portuguese

ZkkdDocjn^g-4,o.ye

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

\h-2,Jfal\`dgxj-4.DZ

,-\ T,/.Om

,-\ T,/.Om

hcl.sf

hcl.sf

-24,rqaxvdj*`x,.EQ Q,hep Q ,,BIDWUAT\XGOZUWRKX^Ralvvoxg],,1 R,`migr-2,*fh-1,oaubs R,t`ngs,.(JJKS]B[XPD@^]T]OP]]eduykpdR]mv8>13@efd,, TB-c

-24,rqaxvdj*`x,.EQ Q,hep Q ,,BIDWUAT\XGOZUWRKX^Ralvvoxg],,1 R,`migr-2,*fh-1,oaubs R,t`ngs,.(JJKS]B[XPD@^]T]OP]]eduykpdR]mv8>13@efd,, TB-c

webqskv`T-Y

webqskv`T-Y

oj-2,`ac

oj-2,`ac

ak-2,`ob

ak-2,`ob

Ufwm`j U,[x`f`saka-0,oqan` U,edmmiogve Q,yd-0 Q,mddmka(vgq`n-0,q(cklff,.lfhzliuka(ggw-0,u P-:.\

Ufwm`j U,[x`f`saka-0,oqan` U,edmmiogve Q,yd-0 Q,mddmka(vgq`n-0,q(cklff,.lfhzliuka(ggw-0,u P-:.\

A-4,gmqskaj W,CjinlCkcg,.ECOQ@BE\ECG,.mt R,`ks R-2,qwravsgj? W,w-2,mie,.ECOQET]JATIZKW R,gjtvkec,,,.Bnnk> W.],t

A-4,gmqskaj W,CjinlCkcg,.ECOQ@BE\ECG,.mt R,`ks R-2,qwravsgj? W,w-2,mie,.ECOQET]JATIZKW R,gjtvkec,,,.Bnnk> W.],t

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

1.2.3

P,=3/.sY

P,=3/.sY

Gx-21,\igh]ixyj-42,M.DJ

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Kf`, -1 W,hefc,.cxb`,,juoocbz,,.I,x

Kf`, -1 W,hefc,.cxb`,,juoocbz,,.I,x

Kn` R-1,/-2,`zfoiauk UU,/\`kjgsmk,.miajim/gv(aaq(kkcaaka^.s

Kn` R-1,/-2,`zfoiauk UU,/\`kjgsmk,.miajim/gv(aaq(kkcaaka^.s

Ecezcb-4 S,Tmeic6.fA

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

ebP-3,dLfnda`-4,`yj-4.PL

Hetoczb-3,ih W,cziu`m-1,webk W,ocbiioxncb-4- -,,kcnbk,,sc,,ofboik,,cbb,, T.BG

Hetoczb-3,ih W,cziu`m-1,webk W,ocbiioxncb-4- -,,kcnbk,,sc,,ofboik,,cbb,, T.BG

Lfak R,fi,.m-12-.,pl-30,gz-02 R,h-2,k R,yn-2,q`ai R,`a,.R-0,`v-0,)Bafl/ SR,zz-2,rllzkgh,.kgnlkefz-0,)-0,a R,m`yle`of)i-1,md/mw-02,kl-2,/-2,g-0,ykp U,/zppf`e)n`m-2,gkp)GKCM/-1,gxzkq-2,/zm)boil/-2,w-0,j P.j-G

Lfak R,fi,.m-12-.,pl-30,gz-02 R,h-2,k R,yn-2,q`ai R,`a,.R-0,`v-0,)Bafl/ SR,zz-2,rllzkgh,.kgnlkefz-0,)-0,a R,m`yle`of)i-1,md/mw-02,kl-2,/-2,g-0,ykp U,/zppf`e)n`m-2,gkp)GKCM/-1,gxzkq-2,/zm)boil/-2,w-0,j P.j-G

Xbzscbxdn W,Hhfb,.Rc-2,k;* N,z

Xbzscbxdn W,Hhfb,.Rc-2,k;* N,z

Lz,--1,`k`-1 U,zenq,.yg`,.kfik,-`k,.yg`,.-3,jwxh-2 U,fl-1 U,lhjk,.ngd`jja,.-3,fkmh/rk,-cd-2,y/q-1,dja,.y` U,jbxkbbna,.d-0- -.,_jvzl-2,qgch U,jbxkbbna,.laa,.dhka-4,fki,-ldmej, .x`

Lz,--1,`k`-1 U,zenq,.yg`,.kfik,-`k,.yg`,.-3,jwxh-2 U,fl-1 U,lhjk,.ngd`jja,.-3,fkmh/rk,-cd-2,y/q-1,dja,.y` U,jbxkbbna,.d-0- -.,_jvzl-2,qgch U,jbxkbbna,.laa,.dhka-4,fki,-ldmej, .x`

Qj-0,zb-21,gmh(zkj(km-0,a-1,f/latadabk( V,qj-0,zb-21-.,m`2,..cn

Qj-0,zb-21,gmh(zkj(km-0,a-1,f/latadabk( V,qj-0,zb-21-.,m`2,..cn

Sggwb/cwb/lj W,bmwb/qjr-2,a`t/adwn`ib/mc W,kmricmdcflb, /ddnckk`/vmb/fjpanjfk,,R.r

Sggwb/cwb/lj W,bmwb/qjr-2,a`t/adwn`ib/mc W,kmricmdcflb, /ddnckk`/vmb/fjpanjfk,,R.r

Naplfaff*ffq*hfkfkc,.*cfkd,.cm-2,`kmkj W,vb-1,bcn,.nq*-2,swie) W.e

Naplfaff*ffq*hfkfkc,.*cfkd,.cm-2,`kmkj W,vb-1,bcn,.nq*-2,swie) W.e

Ibav V,DHNB,,-4,jwyh-1,r-4--,nti,--4,g-43,fhk,-fh,,]-2,itt/Kcij VQ -,zhmocc,,y` V-0,b-2,m,,zfrd,--0,ne-3,/ui-4,yc-3-- W,v-3,bmgnav V,bb/Tmchc,,-3,zv-1,b-2,r U.xA

Ibav V,DHNB,,-4,jwyh-1,r-4--,nti,--4,g-43,fhk,-fh,,]-2,itt/Kcij VQ -,zhmocc,,y` V-0,b-2,m,,zfrd,--0,ne-3,/ui-4,yc-3-- W,v-3,bmgnav V,bb/Tmchc,,-3,zv-1,b-2,r U.xA

PHgyj`go`Mkma`m-1,exg-1,*^-2,`,, U,(ye-4,(gcbg-1,ah T .,wefma,,i`kx`kv,,lasbdaeh(gw,,k-0,v-3,m`p`q,.mb(-3,vco-1,a-40 P.c?

PHgyj`go`Mkma`m-1,exg-1,*^-2,`,, U,(ye-4,(gcbg-1,ah T .,wefma,,i`kx`kv,,lasbdaeh(gw,,k-0,v-3,m`p`q,.mb(-3,vco-1,a-40 P.c?

R -,/zyxf`l Q,nijha,.jg-0,ky Q-1,bnd-4 P.j K

R -,/zyxf`l Q,nijha,.jg-0,ky Q-1,bnd-4 P.j K

,.)pz-1,dbc,.vb-2-.,ula,.mb-1,id* P.^ N

,.)pz-1,dbc,.vb-2-.,ula,.mb-1,id* P.^ N

Qe-0,ud T-1,cpqkuu T,gaok-1,ce(,.ktwz V,ca,.oo T,Jivjbi``,.kn`k(nA

Qe-0,ud T-1,cpqkuu T,gaok-1,ce(,.ktwz V,ca,.oo T,Jivjbi``,.kn`k(nA

Yd-00,l U-1,mxpk-02 U,gogj-1,mm),.-0,lwxm-0,v,.-4,`qfg-1,q,.@]Q^([d`ol U-22,yuaz-2 U,yaei,.khp-2,m)aa-4,giaim U-1,mzqoz-2- C,Y

Yd-00,l U-1,mxpk-02 U,gogj-1,mm),.-0,lwxm-0,v,.-4,`qfg-1,q,.@]Q^([d`ol U-22,yuaz-2 U,yaei,.khp-2,m)aa-4,giaim U-1,mzqoz-2- C,Y

Mfvje-2 S,Io-3 S,haogaj PS,Pazbh,.mkq`ep>,.C.i

Mfvje-2 S,Io-3 S,haogaj PS,Pazbh,.mkq`ep>,.C.i

Q ,,On-3,iNgxbf\dvh5,-.xH

Q ,,On-3,iNgxbf\dvh5,-.xH

Blmiqkghd/zi S,Lfsmd-2 V,Nn-3 V,wgk V,efbc S,f-2 V,``cvojzcov,.blx`jlnjcg/ojqjobzn.n

Blmiqkghd/zi S,Lfsmd-2 V,Nn-3 V,wgk V,efbc S,f-2 V,``cvojzcov,.blx`jlnjcg/ojqjobzn.n

Bm-2,mirk-1,c`,.hohk`gik,.oj,.Mnq`eu T,Cov>,..i,F

Bm-2,mirk-1,c`,.hohk`gik,.oj,.Mnq`eu T,Cov>,..i,F

U.Ie

U.Ie

Cnr S,M`dmkl-3,jaa*Qoamf,.xkp,.-1,ow,.-0,e S,:.y

Cnr S,M`dmkl-3,jaa*Qoamf,.xkp,.-1,ow,.-0,e S,:.y

_yexofebk,.Hc-0,``cmji-3-,,k-33,c-1-,,ocji,,j-1,ca6,..Gg

_yexofebk,.Hc-0,``cmji-3-,,k-33,c-1-,,ocji,,j-1,ca6,..Gg

Iip/Tcr-2,di W,luif-0,bh, /r-3,k5 W.rB

Iip/Tcr-2,di W,luif-0,bh, /r-3,k5 W.rB

Lc` W-1,g`n-1,ggs,.lqjlgv=,.t,.

Lc` W-1,g`n-1,ggs,.lqjlgv=,.t,.

\zh-0,lehah,-rz-12,dakhe/\hsyj-4 Q,mnnj/-0,b Q,z-1,h.lZ

\zh-0,lehah,-rz-12,dakhe/\hsyj-4 Q,mnnj/-0,b Q,z-1,h.lZ

T .-0,b-21,kh2,..Sc

T .-0,b-21,kh2,..Sc

E``aclzfia,..yq

E``aclzfia,..yq

W ,,oc-1,bgcjhnh1,,.FF

W ,,oc-1,bgcjhnh1,,.FF

S .,gx-03,Lckk5,,.Jj

S .,gx-03,Lckk5,,.Jj

]fm,,-0,kyyl-21,im,.zmgim,,h`l,,y-1,gz`jmh)afi)jajokz,, Q.Cd

]fm,,-0,kyyl-21,im,.zmgim,,h`l,,y-1,gz`jmh)afi)jajokz,, Q.Cd

AcfhTcph W-4,dh-4,zonson,-dbkc`o V -,hfn,-qkfxb0*.U-\

AcfhTcph W-4,dh-4,zonson,-dbkc`o V -,hfn,-qkfxb0*.U-\

Scbtvhdxci W-3,c-3,bx V,ba,,reb,,`dki V-3,nvc QW,each-3,ci

Scbtvhdxci W-3,c-3,bx V,ba,,reb,,`dki V-3,nvc QW,each-3,ci

Rok,,uh-03,eb,.hth-31,cc,.-3,giii V,t-01,vh-1,x(.I,v

Rok,,uh-03,eb,.hth-31,cc,.-3,giii V,t-01,vh-1,x(.I,v

Kc`bmozegb,.e-0-,,ay-1-,,aj(akag-3,w,, P,o-03,zi`x2,,.IC

Kc`bmozegb,.e-0-,,ay-1-,,aj(akag-3,w,, P,o-03,zi`x2,,.IC

Aasliaef U,oga`bapdzkp U,feq U,lagk,.bp`k`,, T.`

Aasliaef U,oga`bapdzkp U,feq U,lagk,.bp`k`,, T.`

]DKizHi-4,exc-1,Hc`hk-3.GI

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

L_LCUNTF, KHC.op

0.0.0.0

0.0.0.0

3?:96=>?59:;.ZQ

3?:96=>?59:;.ZQ

6?0N2=.Lq

6?0N2=.Lq

;768>1-80

;768>1-80

cabinet.dll

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

]bmmdi,,-0,g,,iw-13,ml-1-,,xgm,,jfdi,,yam,,LEH P,/ocbai,,x-2,q,,-3,joy`nz,,-02,axi5(.wC

]bmmdi,,-0,g,,iw-13,ml-1-,,xgm,,jfdi,,yam,,LEH P,/ocbai,,x-2,q,,-3,joy`nz,,-02,axi5(.wC

000000000000

000000000000

;7.Q,>N-Y,[ T,Tc.Uv

;7.Q,>N-Y,[ T,Tc.Uv

Piwapxn`e,,aok`bj R,ci,.deu-2,v,,fzvij-3,v PW-2,goh`f,,fzvij-3,v,,n-2 R,of`aikbgh WV,deion`ntkb` WS ,,Ozv-1,Ukq6 W.b=

Piwapxn`e,,aok`bj R,ci,.deu-2,v,,fzvij-3,v PW-2,goh`f,,fzvij-3,v,,n-2 R,of`aikbgh WV,deion`ntkb` WS ,,Ozv-1,Ukq6 W.b=

Eb-1,tw, -1,bsd-1,s S,jzsff-3,s S,mononj, S,lanml,.aly,.tfhaig*,.Ow-43,Ufx4 W-3h

Eb-1,tw, -1,bsd-1,s S,jzsff-3,s S,mononj, S,lanml,.aly,.tfhaig*,.Ow-43,Ufx4 W-3h

Bpzpfkz R,Bz-1,mu2,.aff)v W,nawil,.qh-21,ab(hkkm4 R .-

Bpzpfkz R,Bz-1,mu2,.aff)v W,nawil,.qh-21,ab(hkkm4 R .-

JDT,,odki)dt,,-2,bh,,kd`,,obu,,@cJidbuu)h-4,x-0,ldx`bi,, Q,34

JDT,,odki)dt,,-2,bh,,kd`,,obu,,@cJidbuu)h-4,x-0,ldx`bi,, Q,34

Y]H.if

Y]H.if

d-3,tdcQqdc.Lb

d-3,tdcQqdc.Lb

)hix.CB

)hix.CB

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

,.Roj-0,a4nN

,.Roj-0,a4nN

W,Irgs,,\okyo4 W.eB

W,Irgs,,\okyo4 W.eB

ch_strtup_urls

ch_strtup_urls

R,Kvev,.Xmn-0,k6 R.I]

R,Kvev,.Xmn-0,k6 R.I]

ole32.dll

ole32.dll

olepro32.dll

olepro32.dll

IWebBrowser

IWebBrowser

IWebBrowserApp

IWebBrowserApp

IWebBrowser2

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetWidth

TEWBWindowSetHeight

TEWBWindowSetHeight

bstrUrlContext

bstrUrlContext

bstrUrl

bstrUrl

OnWindowSetResizablet

OnWindowSetResizablet

OnWindowSetLeft

OnWindowSetLeft

OnWindowSetTop

OnWindowSetTop

OnWindowSetWidth

OnWindowSetWidth

OnWindowSetHeight\

OnWindowSetHeight\

grfKeyState

grfKeyState

TComTargetExecEvent

TComTargetExecEvent

CmdGroup

CmdGroup

nCmdID

nCmdID

nCmdexecopt

nCmdexecopt

hhctrl.ocx

hhctrl.ocx

URLMON.DLL

URLMON.DLL

SHDOCLC.DLL

SHDOCLC.DLL

rcmDefault

rcmDefault

rcmDebug

rcmDebug

DontExecuteScripts

DontExecuteScripts

DontExecuteJava

DontExecuteJava

DontExecuteActiveX

DontExecuteActiveX

DisableUrlIfEncodingUTF8

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

lpMsg

PMsg

PMsg

pguidCmdGroup

pguidCmdGroup

TTranslateUrlEvent

TTranslateUrlEvent

pchURLIn

pchURLIn

ppchURLOut

ppchURLOut

CmdID

CmdID

pszUrl

pszUrl

pszUrlContext

pszUrlContext

szPassWord

szPassWord

ErrorUrl

ErrorUrl

OptionKeyPath

OptionKeyPath

OverrideOptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl

OnTranslateUrl

OnCommandExec

OnCommandExec

'%s' is not supported.

'%s' is not supported.

TMsgEvent

TMsgEvent

TKeyEventEx

TKeyEventEx

Port

Port

Password

Password

poPortrait

poPortrait

OnKeyDownX(

OnKeyDownX(

0.750000

0.750000

3333333

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

This object does not support this method (

Unsupported type for Parameter with Index %d

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXp://

hXXps://

hXXps://

Icbodfii*zw,.kiskx/N`y-0,fbfjuCkafio-2,).bu

Icbodfii*zw,.kiskx/N`y-0,fbfjuCkafio-2,).bu

Rfhzlif,.chs,.Hfoobbs,.qoskdc Q,zj W,ukwjh`dsd P ,).\,u

Rfhzlif,.chs,.Hfoobbs,.qoskdc Q,zj W,ukwjh`dsd P ,).\,u

CJ[hx.Xu

CJ[hx.Xu

,, S,/kdfcdkh/ymj/dk-10,licj-4- .Zp

,, S,/kdfcdkh/ymj/dk-10,licj-4- .Zp

Kaxmcangf`h S,M-0,agck-1 S,ko-0,b/h-2,lb,.ng\k-2,uj-1,/la,.zqc4/?.j

Kaxmcangf`h S,M-0,agck-1 S,ko-0,b/h-2,lb,.ng\k-2,uj-1,/la,.zqc4/?.j

NAER_[URNDT].Lw

NAER_[URNDT].Lw

Baxbjanho`h,,D-0,ahjk-1-,,bo-0,m V,o-0,xcc-4,x V,`` RV.Ja

Baxbjanho`h,,D-0,ahjk-1-,,bo-0,m V,o-0,xcc-4,x V,`` RV.Ja

Mimjihbc,.@ogatbp,.Omik Q-3,a-4,tiwz Q-0,e-2 Q,ha`hi`,.eya,.uc T,b`oo,.nj T,^sergmick Q,Akjd R,L N

Mimjihbc,.@ogatbp,.Omik Q-3,a-4,tiwz Q-0,e-2 Q,ha`hi`,.eya,.uc T,b`oo,.nj T,^sergmick Q,Akjd R,L N

ymighko,,h`xihhs,,-0,izc-0,xoh.ED

ymighko,,h`xihhs,,-0,izc-0,xoh.ED

LJ_.ge

LJ_.ge

fxk S,Cym^rk.Um

fxk S,Cym^rk.Um

eiOnKeyDown

eiOnKeyDown

eiOnKeyPress

eiOnKeyPress

eiOnKeyUp

eiOnKeyUp

OnKeyDown

OnKeyDown

OnKeyUp

OnKeyUp

Handler with EventID = %s already exists.

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

Source don't have connection point for [%s]

@jgico,.qi, k-2,ryofr, zmc, gklnmqod`) V,n-1,w

@jgico,.qi, k-2,ryofr, zmc, gklnmqod`) V,n-1,w

RZ-3,i-1,/ImznQ.Hy

RZ-3,i-1,/ImznQ.Hy

MAPI32.DLL

MAPI32.DLL

LeftPopup

LeftPopup

Nomfbz S,k-4,kb-1,h,.pkekg-2,akg(yopc,-gm(U^ S,G^,.tayf S-14,gdoh-1 S-1,t-3,f2,--8.h

Nomfbz S,k-4,kb-1,h,.pkekg-2,akg(yopc,-gm(U^ S,G^,.tayf S-14,gdoh-1 S-1,t-3,f2,--8.h

)bs-1,fu Q-1,hnrkm, Q,y`si,.dbr-2,h`d,.3 W.\,y

)bs-1,fu Q-1,hnrkm, Q,y`si,.dbr-2,h`d,.3 W.\,y

/h-24,`-4,/-4,nd-1,hk Q,/zfyg,-bh-13,njj,-5,-.ZZ

/h-24,`-4,/-4,nd-1,hk Q,/zfyg,-bh-13,njj,-5,-.ZZ

YR-0,xh]izn.cQ

YR-0,xh]izn.cQ

Ah-1,cif,.znykf W,ua0 W-c G

Ah-1,cif,.znykf W,ua0 W-c G

2.1.0.0

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

This exe was created with an old version of HtmlAppMaker.

[_FMTZG].mF

[_FMTZG].mF

WDM.DM

WDM.DM

uaixcbzaShz.CP

uaixcbzaShz.CP

z-1,o-2,Nl-3,f`a.uz

z-1,o-2,Nl-3,f`a.uz

Ekcffn*-3,l*fkvdib S,b-3,go_C*exeg S-3,bo S,lefoe-2,cmm*-4,qf0*-_X

Ekcffn*-3,l*fkvdib S,b-3,go_C*exeg S-3,bo S,lefoe-2,cmm*-4,qf0*-_X

-0,cnyzgcEi.Tc

-0,cnyzgcEi.Tc

R-2,ll`,.age-0,b R,n`ogdzlmi,.cphc U,ah`ck`,.ckkk, U.b

R-2,ll`,.age-0,b R,n`ogdzlmi,.cphc U,ah`ck`,.ckkk, U.b

V-2,h-3,g-2,d`a/ya V-1,h`b/yfc/aaa QSP.hq

V-2,h-3,g-2,d`a/ya V-1,h`b/yfc/aaa QSP.hq

https

https

Hal U,wkysa-1- ,Pvb, lw,.bkrogl`4, [._

Hal U,wkysa-1- ,Pvb, lw,.bkrogl`4, [._

Sf[.t,T*.lJ,e

Sf[.t,T*.lJ,e

Vco`lhf T,Iif T,qi Q,pmc Q,bjjmkrooc U,Ssh? V,Ae

Vco`lhf T,Iif T,qi Q,pmc Q,bjjmkrooc U,Ssh? V,Ae

Fad,,bop,,hkfb*-2,voikp-4,l-0,o`s,.pidz,-.>e

Fad,,bop,,hkfb*-2,voikp-4,l-0,o`s,.pidz,-.>e

D`zc R,km-2,v-2,gwgk2,.,-bigl P.cm

D`zc R,km-2,v-2,gwgk2,.,-bigl P.cm

MSGALL

MSGALL

irsoMsgDialog

irsoMsgDialog

irsoJoinPath

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoRegDeleteKey

irsoIsRegKeyExists

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoRegCopyKey

irsoGetRegKeyInfo

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetData

irsoHttpGetDataInThread

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecute

irsoExecuteDllInProcess

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoIsMutexExists

irsoCreatePipeServer

irsoCreatePipeServer

irsoStopPipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetCurExeCheckSum

irsoGetExeInjection

irsoGetExeInjection

iubnyybRolkanldf.RW

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

b-1,[-1,e.Hv

.html

.html

H-4,njBdi-2,o-4,r.vY

H-4,njBdi-2,o-4,r.vY

\-2,adn,.loy-1,aihzmn)cm-3,aal*, gzyf\mm@-2,IzyGfy-2,odflj*-].d

\-2,adn,.loy-1,aihzmn)cm-3,aal*, gzyf\mm@-2,IzyGfy-2,odflj*-].d

-4,fhxXahcxgw.rg

-4,fhxXahcxgw.rg

gghYcjrf.ae

gghYcjrf.ae

jehGbeags.qB

jehGbeags.qB

PIPE_DATA

PIPE_DATA

PIPE

PIPE

LNYCD_^.eP

LNYCD_^.eP

HMVH9>.PE

HMVH9>.PE

U`mgtqxw W,`dzu-1,*-1,bhexba0,.OqgbRL*Luj-22,bw*aeooms R,y,.N@=,.adfbedie W,v-43,wjxz W,ly,.ij-2-.,bkklk`n P.e,W

U`mgtqxw W,`dzu-1,*-1,bhexba0,.OqgbRL*Luj-22,bw*aeooms R,y,.N@=,.adfbedie W,v-43,wjxz W,ly,.ij-2-.,bkklk`n P.e,W

Nombmj T,zg,.`g-0,ofbm,.pfm,.LzebQG(Lva-42,a-1,(afdmmp)-0-.,MK?,.bodbfoke TS,(\aia-2,p-1,q,.s-1,aza,.nombmj*._c

Nombmj T,zg,.`g-0,ofbm,.pfm,.LzebQG(Lva-42,a-1,(afdmmp)-0-.,MK?,.bodbfoke TS,(\aia-2,p-1,q,.s-1,aza,.nombmj*._c

Fxed[E(J-1,c-40,k-3,(glfmkz, -0,(GI?(hmddlmkc,.mdzkmlq,.ha-0,ondmj R-=.I

Fxed[E(J-1,c-40,k-3,(glfmkz, -0,(GI?(hmddlmkc,.mdzkmlq,.ha-0,ondmj R-=.I

/,.ghlzvub-3 U,ajb`= S,u.^

/,.ghlzvub-3 U,ajb`= S,u.^

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

Hiaokl(wa(-0,bxm(wfm(aag-1,pzzis,.naok2(8-C

Hiaokl(wa(-0,bxm(wfm(aag-1,pzzis,.naok2(8-C

Gio`bhi T,mtai, jagjj,.tjrf>, Nk

Gio`bhi T,mtai, jagjj,.tjrf>, Nk

^ovh,.ei`cghi,.shf`iqc4 V.Q,n

^ovh,.ei`cghi,.shf`iqc4 V.Q,n

Pno-1,a Q,y,.ehezlcx,.mhyzehik T,t-4,`jodi( V-3,fmu*-3,viikwu*ymjf,.gje-2,a(.e,d

Pno-1,a Q,y,.ehezlcx,.mhyzehik T,t-4,`jodi( V-3,fmu*-3,viikwu*ymjf,.gje-2,a(.e,d

Fas US,MHKUGIPD,, W,fncjdoj W,csaj U,gguvu,.wwnmbvr RW,qigt U,q-1,hfd-2,t U,vgki Q,mhkugipd,.upo`nkfW.\

Fas US,MHKUGIPD,, W,fncjdoj W,csaj U,gguvu,.wwnmbvr RW,qigt U,q-1,hfd-2,t U,vgki Q,mhkugipd,.upo`nkfW.\

Oenwfns S,gerwoebf,.bo S,ZNSNGE@WK, rwold S,gx Q,`-0,ysf`-4,mz,.ytm`bod R ,bl`-4,hm-0,bod PU,1.9

Oenwfns S,gerwoebf,.bo S,ZNSNGE@WK, rwold S,gx Q,`-0,ysf`-4,mz,.ytm`bod R ,bl`-4,hm-0,bod PU,1.9

[d-3,k, -3,k-12,h-1-.,_DCKO,-A[_,- R .,hl`)-4--,jk-4,h-1,cbck,.bk,.zch-1,k,,-3-.,oebzfn-4-.,ge-3,zoenk,.yx``bci P ,na`-4,d`-0,bci PU.iV

[d-3,k, -3,k-12,h-1-.,_DCKO,-A[_,- R .,hl`)-4--,jk-4,h-1,cbck,.bk,.zch-1,k,,-3-.,oebzfn-4-.,ge-3,zoenk,.yx``bci P ,na`-4,d`-0,bci PU.iV

KMEBGX, -41,myx(hnjiygx(-1,b-1,m,,xizzn-3 T ,-0,c-04,bndi, -3,mmxcf,,b-4,(xcm-1-,,jbgxciz,,bb-0,xjbki, cn,,-4,da-4- ,ef-44,md`n-3,(ex,,-0,x-3,oc.FC

KMEBGX, -41,myx(hnjiygx(-1,b-1,m,,xizzn-3 T ,-0,c-04,bndi, -3,mmxcf,,b-4,(xcm-1-,,jbgxciz,,bb-0,xjbki, cn,,-4,da-4- ,ef-44,md`n-3,(ex,,-0,x-3,oc.FC

ung`.Nr

ung`.Nr

gbo`dhfm.cV

gbo`dhfm.cV

Slqz`-0,vOrHfchg8,.Rlaaom R-1,dzvos-2 RSQ,jm`u`l-0,d)uguam-0,u)c`n-2,jks)pkr-2,c-1,u)va Q,htahm R,bnfr P.]-F

Slqz`-0,vOrHfchg8,.Rlaaom R-1,dzvos-2 RSQ,jm`u`l-0,d)uguam-0,u)c`n-2,jks)pkr-2,c-1,u)va Q,htahm R,bnfr P.]-F

Tktzg-1,sOuOcco`=,.Tktzg-1,s,.u-0,dmckc RV,zuoh-2,aktgii V,mh`r-1,hb V,zh,.rfb,.hkp,.v-1,hmc-2,t,.g`c,.rkuco`fzo``,.rfn-2 V,aik(.ba

Tktzg-1,sOuOcco`=,.Tktzg-1,s,.u-0,dmckc RV,zuoh-2,aktgii V,mh`r-1,hb V,zh,.rfb,.hkp,.v-1,hmc-2,t,.g`c,.rkuco`fzo``,.rfn-2 V,aik(.ba

Xa-2,vkvzCyEjocj4 R,Legno`,.ve T-1,gypop-3 T,oq*ejocj,./*q-2,gx T,jkn T,`m-3 T,orzvato,.J

Xa-2,vkvzCyEjocj4 R,Legno`,.ve T-1,gypop-3 T,oq*ejocj,./*q-2,gx T,jkn T,`m-3 T,orzvato,.J

irsoExecutePackage

irsoExecutePackage

irsoReportPackageError

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageSuccess

irsoReportPackageInfo

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetChromeVer

irsoGetOperaVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoUninstallExecute

irsoReportStart

irsoReportStart

irsoReportInfo

irsoReportInfo

irsoSetExclusiveExec

irsoSetExclusiveExec

isroSetReportUrl

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

-11,jycmjaOaahDgvyc-11.Pg

Iakyhk-1,_goa,,@L/oloakaj/xk,.yiv-2,fcj4/.J_

Iakyhk-1,_goa,,@L/oloakaj/xk,.yiv-2,fcj4/.J_

zfc.bz

zfc.bz

]no^dun.Vx

]no^dun.Vx

D`khnzhbc,.oby,.gbx`e S.Lh

D`khnzhbc,.oby,.gbx`e S.Lh

Og`jeo,.czm-13,elk,,-1,i-1,ma-0-.,jedk,,hmzio-1,kh6(.I-A

Og`jeo,.czm-13,elk,,-1,i-1,ma-0-.,jedk,,hmzio-1,kh6(.I-A

Im`jce,.c-1,g-13,cfk,,zc-1,mgq,.jcnk,,-2,c-2-,,dmz,,lm-0,bn8,..I,*

Im`jce,.c-1,g-13,cfk,,zc-1,mgq,.jcnk,,-2,c-2-,,dmz,,lm-0,bn8,..I,*

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

\GCAPMA][.oj

TcUlue.PL

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

e-1,f.Cw

Kh`k-0,dbi/ydk/Zmzlei-1,/oe`n-4,u PQS.gZ

Kh`k-0,dbi/ydk/Zmzlei-1,/oe`n-4,u PQS.gZ

-0,ilCcbd.LG

-0,ilCcbd.LG

)h-4,k.bR

)h-4,k.bR

Poymok-4-.,po-3-.,t-0,nmb-23,hrbt,.bvhmrzhj W,gc,.jaik=,..hb

Poymok-4-.,po-3-.,t-0,nmb-23,hrbt,.bvhmrzhj W,gc,.jaik=,..hb

Ukszv.ra

Ukszv.ra

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

FbghLbtaYhe.AU

1.2.1

1.2.1

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

inflate 1.2.1 Copyright 1995-2003 Mark Adler

inflate 1.2.1 Copyright 1995-2003 Mark Adler

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

1iu2.iu

1iu2.iu

333333333333333333

333333333333333333

33333833

33333833

3333339

3333339

3333333333333338

3333333333333338

:*"*"$3338

:*"*"$3338

33333333

33333333

33333333333

33333333333

3333333333338

3333333333338

33338?383

33338?383

333333333333

333333333333

:*3:"$3338

:*3:"$3338

333333333333333

333333333333333

W?*.Ch

W?*.Ch

m_?Ø

m_?Ø

Key1A

Key1A

%x]W~

%x]W~

[?n%f

[?n%f

HQ.gs

HQ.gs

l_%sQH

l_%sQH

k(.OW

k(.OW

3vq~b.KoP|

3vq~b.KoP|

9P.iJ

9P.iJ

ftpX

ftpX

Ãlq

Ãlq

)%x?./

)%x?./

q.xo-

q.xo-

2%F(=

2%F(=

.Ai7WW:

.Ai7WW:

"1.ia,

"1.ia,

FF.lXixoC\w

FF.lXixoC\w

\/%xr

\/%xr

L.dxH

L.dxH

.Lp]}

.Lp]}

,e.OC

,e.OC

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

RegQueryInfoKeyA

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyExA

RegFlushKey

RegFlushKey

RegEnumKeyExA

RegEnumKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

SetViewportOrgEx

SetViewportOrgEx

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

MapVirtualKeyA

MapVirtualKeyA

LoadKeyboardLayoutA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyboardLayout

GetKeyState

GetKeyState

GetKeyNameTextA

GetKeyNameTextA

GetAsyncKeyState

GetAsyncKeyState

EnumWindows

EnumWindows

EnumThreadWindows

EnumThreadWindows

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

GetKeyboardType

GetKeyboardType

"$ %),'8

"$ %),'8

38000=344

38000=344

4? 3!0 3!6

4? 3!0 3!6

H.JXA

H.JXA

1 0 .'7(2':

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

&)"%&$&'&",,/- '

944(@32%2u8

944(@32%2u8

.PMDF

.PMDF

2222444424

2222444424

.idata

.idata

.edata

.edata

P.reloc

P.reloc

P.rsrc

P.rsrc

"?A1%X!

"?A1%X!

#-**(-#,

#-**(-#,

&",,/- '

&",,/- '

'#E.%f^

'#E.%f^

)|P.re

)|P.re

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

errorUrl

errorUrl

\bin\SubWCRev.exe

\bin\SubWCRev.exe

Please login as administrator and try again.

Please login as administrator and try again.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Clipboard does not support Icons/Menu '%s' is already being used by another form

Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Property %s does not exist

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Unsupported clipboard format

Invalid stream format$''%s'' is not a valid component name

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to get data for '%s'

Failed to set data for '%s'

Failed to set data for '%s'

Resource %s not found

Resource %s not found

Ancestor for '%s' not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot create file %s

Cannot open file %s

Cannot open file %s

External exception %x

External exception %x

Interface not supported

Interface not supported

%s (%s, line %d)

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

System Error. Code: %d.

Invalid pointer operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

'%s' is not a valid GUID value

I/O error %d

I/O error %d

Integer overflow Invalid floating point operation

Integer overflow Invalid floating point operation