Skip to main content

Installer.Win32.InnoSetup.2_ef050c89a3


Installer.Win32.InnoSetup.2.FD, Trojan.Win32.Sasfis.FD, WebToolbar.Win32.InstallCore.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Installer, WebToolbar

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: ef050c89a34f1879c618dd3eff5cf362

SHA1: f6b093fcf7c194b9dcf5fc70ec1cc8861cf28531

SHA256: b1d86e579077253dfe6e6bb5c601757fec49fb03ec58244e98f99c88750f1e4d

SSDeep: 24576:kuIU4/ er8wfL0pfKqf206PjobHACA2rq9x8NT2:kx3/ QfT0oqf206LSO9Sq

Size: 833506 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: BorlandDelphi30, UPolyXv05_v6

Company: no certificate found

Created at: 1992-06-20 01:22:17

Analyzed on: Windows7 SP1 32-bit

Summary: Installer. An installation package.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):

%original file name%.exe:3216

The Installer injects its code into the following process(es):

WerFault.exe:3364
%original file name%.exe:2240

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3216 makes changes in the file system.


The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-9GTP7.tmp\ef050c89a34f1879c618dd3eff5cf362.tmp (391 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-9GTP7.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-9GTP7.tmp\ef050c89a34f1879c618dd3eff5cf362.tmp (0 bytes)

The process %original file name%.exe:2240 makes changes in the file system.


The Installer creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\NO.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\RU.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\ZH.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\7EF34168_stp\asgnd.json (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Color_Button_Hover.png (846 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\7EF34168_stp.CIS (3982 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\FR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\isf_421080.flat (554 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\PT.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\5C6032B1_stp.DAT (63242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066B30.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\TR.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\ES.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Progress.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066C0B.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Cazurazihiz[1].png (845 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\bootstrap_57091.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Icon_Generic.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\IE_logo_new[1].png (845 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\ProgressBar.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\Nininininon[1].png (45007 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\1A47FD63_stp.CIS (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\DE.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\PL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068313.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\BG[1].png (1440 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\FI.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\main.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\7EF34168_stp.CIS.part (723 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\isf_421004.flat (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\logo_b[1].png (880 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\5C6032B1_stp.DAT.part (1440 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\logo[1].png (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Grey_Button_Hover.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\ie6_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000682D5.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG[1].jpg (6524 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068AA2.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\NL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\BG_FS[1].jpg (6537 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bg1[1].jpg (19380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\truste[1].png (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000682F4.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\BG.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068361.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\DA.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Grey_Button.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\KO.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\JA.locale (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bar7[1].png (420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0006865E.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\CH_logo_new[1].png (384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\SV.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\1A47FD63_stp.CIS.part (747 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bg2[1].jpg (8884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\1A47FD63_stp\osutils.vbs (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\CS.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\EL.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\ID.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\sdk\roinew.txt (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000679A1.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FS_BG[1].png (1024 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Color_Button.png (863 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\FF_logo_new[1].png (845 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\IT.locale (4 bytes)

The Installer deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\isf_421080.flat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000679A1.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0006865E.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068AA2.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068361.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066B30.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\isf_421004.flat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000682D5.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000682F4.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066C0B.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068313.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\bootstrap_57091.html (0 bytes)

Registry activity

The process WerFault.exe:3364 makes changes in the system registry.


The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 BA 16 99 75"

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

The process %original file name%.exe:2240 makes changes in the system registry.


The Installer creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{E549E976-C5F2-4E77-819D-55BC9B7C25BC}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadDecisionTime" = "50 79 A2 7C EA 2B D2 01"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e0-73-f1]
"WpadDecision" = "3"
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e0-73-f1]
"WpadDecisionTime" = "50 79 A2 7C EA 2B D2 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadNetworkName" = "Network 2"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 39 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0B 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E549E976-C5F2-4E77-819D-55BC9B7C25BC}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\ef050c89a34f1879c618dd3eff5cf362_RASAPI32]
"FileDirectory" = "%windir%\tracing"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
d7448bc1ce787218cbf0eab09affebd9c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\5C6032B1_stp.DAT

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:3216

  2. Delete the original Installer file.
  3. Delete or disinfect the following files created/modified by the Installer:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-9GTP7.tmp\ef050c89a34f1879c618dd3eff5cf362.tmp (391 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\NO.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\RU.locale (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\ZH.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\7EF34168_stp\asgnd.json (553 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Color_Button_Hover.png (846 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\7EF34168_stp.CIS (3982 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\FR.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\isf_421080.flat (554 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\PT.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\5C6032B1_stp.DAT (63242 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066B30.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\TR.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\ES.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Progress.png (104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066C0B.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Cazurazihiz[1].png (845 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\bootstrap_57091.html (156 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Icon_Generic.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\EN.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\IE_logo_new[1].png (845 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\ProgressBar.png (812 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Close_Hover.png (207 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\Nininininon[1].png (45007 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\1A47FD63_stp.CIS (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\DE.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\PL.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068313.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\BG[1].png (1440 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\FI.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\main.css (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\7EF34168_stp.CIS.part (723 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\isf_421004.flat (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\logo_b[1].png (880 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Pause_Button.png (577 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\5C6032B1_stp.DAT.part (1440 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\logo[1].png (960 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\progress-bg.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\csshover3.htc (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Grey_Button_Hover.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\ie6_main.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000682D5.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\BG[1].jpg (6524 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068AA2.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\NL.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\BG_FS[1].jpg (6537 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bg1[1].jpg (19380 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\sponsored.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\truste[1].png (719 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\button-bg.png (131 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000682F4.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\BG.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\button.css (417 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00068361.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\DA.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Grey_Button.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\KO.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\JA.locale (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\bar7[1].png (420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0006865E.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\images\progress-bg2.png (978 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\CH_logo_new[1].png (384 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\SV.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\form.bmp.Mask (244 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\checkbox.css (190 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\1A47FD63_stp.CIS.part (747 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bg2[1].jpg (8884 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is1488139799\1A47FD63_stp\osutils.vbs (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\CS.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Loader.gif (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\EL.locale (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Close.png (207 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\ID.locale (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\sdk\roinew.txt (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\progress-bar.css (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Quick_Specs.png (221 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000679A1.log (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\FS_BG[1].png (1024 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Color_Button.png (863 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\images\Resume_Button.png (718 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\css\sdk-ui\browse.css (337 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\FF_logo_new[1].png (845 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ish420656\locale\IT.locale (4 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Generic Web
Product Name: Generic Software
Product Version: 2.6
Legal Copyright: Internet
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 5.6.4.7
File Description: Generic Software Setup
Comments: This installation was built with Inno Setup.
Language: Language Neutral

Company Name: Generic Web Product Name: Generic Software Product Version: 2.6Legal Copyright: Internet Legal Trademarks: Original Filename: Internal Name: File Version: 5.6.4.7File Description: Generic Software Setup Comments: This installation was built with Inno Setup.Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
CODE409640240404484.681994e75362da564ed1946ea265a335d25e5
DATA4505659210241.907421ee71d84f1c77af85f1f5c278f880572
BSS49152372400d41d8cd98f00b204e9800998ecf8427e
.idata53248238425603.07115bb5485bf968b970e5ea81292af2acdba
.tls57344800d41d8cd98f00b204e9800998ecf8427e
.rdata61440245120.141749ba824905bf9c7922b6fc87a38b74366
.reloc65536224400d41d8cd98f00b204e9800998ecf8427e
.rsrc6963211264112643.1221682d8bfb066066d96ad5b88915f822890

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 2
3a50e69cabf66eac29ab45316f7668e9
462a875dec84d6260af43511c24e1d5a

Network Activity

URLs

URL IP
hxxp://rp.madihehife.com/?pcrc=764536170&v=2.052.51.40.46
hxxp://info.madihehife.com/?v=1.03&c=387944f9&at=584795107&cntr=054.154.229.88
hxxp://os.freelegendary.org/CM_Bing/?v=5.0&c=88776877552.49.170.39
hxxp://rp.madihehife.com/?pcrc=687845929&v=2.052.51.40.46
hxxp://geosrvlb-629133695.us-east-1.elb.amazonaws.com/details
hxxp://allmyapps.com/binary/653/213947/direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b54.243.119.141
hxxp://static.binaries.allmyapps.com/d7448bc1ce787218cbf0eab09affebd9_TeamViewer_Setup_fr.exe173.255.138.99
hxxp://img.madihehife.com/img/Malaromoro/bg2.jpg85.159.237.103
hxxp://img.madihehife.com/img/Malaromoro/bg1.jpg85.159.237.103
hxxp://img.madihehife.com/ofr/Solululadul/asgnd.cis85.159.237.103
hxxp://img.madihehife.com/ofr/Solululadul/osutils.cis85.159.237.103
hxxp://img.madihehife.com/img/Tuburera/logo.png85.159.237.103
hxxp://img.madihehife.com/img/Tuburera/truste.png85.159.237.103
hxxp://img.madihehife.com/img/Tuburera/bar7.png85.159.237.103
hxxp://cdnus.madihehife.com/ofr/Solululadul/asgnd.cis199.201.110.78
hxxp://img.madihehife.com/img/Tuburera/logo_b.png85.159.237.103
hxxp://img.madihehife.com/img/Rewudaw/BG.jpg85.159.237.103
hxxp://img.madihehife.com/img/Rewudaw/BG_FS.jpg85.159.237.103
hxxp://img.madihehife.com/img/IE_logo_new.png85.159.237.103
hxxp://img.madihehife.com/img/FF_logo_new.png85.159.237.103
hxxp://img.madihehife.com/img/CH_logo_new.png85.159.237.103
hxxp://img.madihehife.com/img/Nininininon/Nininininon.png85.159.237.103
hxxp://img.madihehife.com/img/Fividof/BG.png85.159.237.103
hxxp://img.madihehife.com/img/Cazurazihiz/Cazurazihiz.png85.159.237.103
hxxp://img.madihehife.com/img/Fividof/FS_BG.png85.159.237.103
hxxp://giserv.madihehife.com/details54.243.224.184
hxxp://cdneu.madihehife.com/ofr/Solululadul/asgnd.cis85.159.237.103
hxxp://cdneu.madihehife.com/ofr/Solululadul/osutils.cis85.159.237.103
hxxp://rp.freelegendary.org/?pcrc=687845929&v=2.052.49.115.83

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)


ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE DealPly Adware CnC Beacon


Traffic

GET /d7448bc1ce787218cbf0eab09affebd9_TeamViewer_Setup_fr.exe HTTP/1.1

Range: bytes=3276800-6266495

Accept: */*

Host: static.binaries.allmyapps.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.8.0

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: application/octet-stream

Content-Length: 2989696

Connection: keep-alive

x-amz-id-2: cyhTAo2Ybs8VoxC8v0rTT65gAYGd88Uk2F9OPQo/iqgNjXEJp6lsSVFiRcDZ2M40 iKCONC ZJ4=

x-amz-request-id: 81006D057BF08E17

Last-Modified: Tue, 23 Sep 2014 20:03:34 GMT

ETag: "d7448bc1ce787218cbf0eab09affebd9"

Content-Range: bytes 3276800-6266495/6266496

1.h...-....7. V.......cV.k.....F1'.`.&l.!.2.Flp.7...G<..J..\vO.*5a .\....JU.d..<...........Z.....n.b....&V.7.fY...X.L......(.e..U.7X]......V...~yD...\s.C.......1.w1..C._..F...f}'......u...M..rB.B.y,.u.1.y-..RW..L4:....7J.T*5...3^=...............hx.....<..r..W.....aO......-.EH..i..P{k.42..]...q..'...W...'.;..4;..&...7@0.....K....C....lp.T........!....j..w..._.....b..9....h.)..V....@x..KV.|G.o0.".(..}.X.F."....oJ...1[.^V...:..(J= ......`bn..3.....\[....[.w.........^[..z._....Kw..LH..W..At.n3g...@.E$.4".8.i..N.o1..K.fV#.Ry...c....q.=W..g....3L%A..0......D3......Rb..8.M...qq'....F..........3.5.c.J.l.ea..,G.6..q.:..&&.>....H.m..Z.......z....$....fJ.*._.u.3>.U.%...7.t.=$...~....2.7#.2q*.&...LI6.d..........@lAkc..........Y.`cS`....t...Ptz...._....}..\l...Z...=..../xO...[.YR2..Q"..^W...3..5.......1..6.HNh{H.. .v!zAx.R..c`...W....{T.s.*.P6..&-O.S%..].."....%.}......P...l..Y.a..!..]nb.....ln...xc.Qh. ....J..a.k...4.R....../.L........'7........{ .1Z......K`"g...'"..........$..~i....kV.wI....*y>......^w./CY...fR\&...A|.......A .Vs..Z....50.M.........cp.0....!...N...0....&...*.......2..6K.a..M.~....?.....x...J:4q....#....>..........cq,.G.(G.XmP.3.i.y.(}.L.&._...4...d..rK.M/%.b#..K-.....8G.e....y..4...x....,..C.....5..j.......&DJD.....*.....as..^u....l...u.U..f.5.0'z.p.:<.#.;,@i.,...Y...to.]..1.E..q....[....Z...z.].*t^.3.p`:..%..m.:U.I=...j.'6..o.Y>....o-..d..y..6..d....w..n.N....d>.s6.9.\|.#....R.Q..a..Y..WU5.,%.."s.qMP/...74;._k.....eM.....W..il...~R.W..~...s^....1..=.e4.[.vH..(..-.t2.oB..U...

<<< skipped >>>

HEAD /ofr/Solululadul/osutils.cis HTTP/1.1

Accept: */*

Host: cdneu.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: b0IH4iJpCel uQZI63RSW2cYDzkEzFhQlEMc3SN3Qcpqsv7eIGOQt79QcgMYDepDRDBSlxbFvIE=

x-amz-request-id: AAA45E25BD2FA425

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Accept-Ranges: bytes

HTTP/1.1 200 OK..Server: nginx/1.4.7..Date: Fri, 21 Oct 2016 22:28:47 GMT..Content-Type: application/octet-stream..Content-Length: 4013..Connection: keep-alive..x-amz-id-2: b0IH4iJpCel uQZI63RSW2cYDzkEzFhQlEMc3SN3Qcpqsv7eIGOQt79QcgMYDepDRDBSlxbFvIE=..x-amz-request-id: AAA45E25BD2FA425..Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT..ETag: "569022425db355c9d82beba6efc44f22"..x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT..x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l..Accept-Ranges: bytes......

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=0-101028

Accept: */*

Host: cdneu.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: qnboCh/nnDdf7u2WCHWJFCiznuoU/b/YeReGf/mYBDRv1xKw6Tb6Fq5TK2eBE38XIbZu6wSK7DU=

x-amz-request-id: 68A3C620BBBEABEB

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Content-Range: bytes 0-101028/101029

CIS................?...............P..............M.U....$..q.X]....9u..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B>Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4..6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu....-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*..b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w..."......I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.ZI.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E..dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h

<<< skipped >>>

HEAD /d7448bc1ce787218cbf0eab09affebd9_TeamViewer_Setup_fr.exe HTTP/1.1

Accept: */*

Host: static.binaries.allmyapps.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Fri, 21 Oct 2016 22:28:46 GMT

Content-Type: application/octet-stream

Content-Length: 6266496

Connection: keep-alive

x-amz-id-2: cyhTAo2Ybs8VoxC8v0rTT65gAYGd88Uk2F9OPQo/iqgNjXEJp6lsSVFiRcDZ2M40 iKCONC ZJ4=

x-amz-request-id: 81006D057BF08E17

Last-Modified: Tue, 23 Sep 2014 20:03:34 GMT

ETag: "d7448bc1ce787218cbf0eab09affebd9"

Accept-Ranges: bytes

HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Fri, 21 Oct 2016 22:28:46 GMT..Content-Type: application/octet-stream..Content-Length: 6266496..Connection: keep-alive..x-amz-id-2: cyhTAo2Ybs8VoxC8v0rTT65gAYGd88Uk2F9OPQo/iqgNjXEJp6lsSVFiRcDZ2M40 iKCONC ZJ4=..x-amz-request-id: 81006D057BF08E17..Last-Modified: Tue, 23 Sep 2014 20:03:34 GMT..ETag: "d7448bc1ce787218cbf0eab09affebd9"..Accept-Ranges: bytes......

GET /d7448bc1ce787218cbf0eab09affebd9_TeamViewer_Setup_fr.exe HTTP/1.1

Range: bytes=0-6266495

Accept: */*

Host: static.binaries.allmyapps.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.8.0

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: application/octet-stream

Content-Length: 6266496

Connection: keep-alive

x-amz-id-2: cyhTAo2Ybs8VoxC8v0rTT65gAYGd88Uk2F9OPQo/iqgNjXEJp6lsSVFiRcDZ2M40 iKCONC ZJ4=

x-amz-request-id: 81006D057BF08E17

Last-Modified: Tue, 23 Sep 2014 20:03:34 GMT

ETag: "d7448bc1ce787218cbf0eab09affebd9"

Content-Range: bytes 0-6266495/6266496

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@..........................@......}._...@.................................4...........`b..........@._.@.......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...`b.......d..................@..@.reloc..2....0......................@..B........................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....-G..H.P.u..u..u.....@..K...SV.5.-G.W.E.P.u.....@..e...E..E.P.u.....@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h..F.W....@..u.W...u....E.P.u.....@._^3.[.....L$...-G...i. @...T.....tUVW.q.3.;5.-G.sD..i. @...D..S.....t.G.....t...O..t .....u...3....3...F. @..;5.-G.r.[_^...U..QQ

<<< skipped >>>

GET /ofr/Solululadul/asgnd.cis HTTP/1.1

Range: bytes=0-101028

Accept: */*

Host: cdnus.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.8.0

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: 3aHJ3oXBJH/HLXF61tXp6BSAv4KSEU8OGKiq36lgzZli2KIVXiU5BsppSL6S5mWH94Q6ONlsmvI=

x-amz-request-id: 26A7769F73936611

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Content-Range: bytes 0-101028/101029

CIS................?...............P..............M.U....$..q.X]....9u..9u...#a!.s..2.....{8.u..i3.\...Q.....X..}.E..c.).........&`.......B>Zr..|...E....=..>.o.u..........=|....:._-@.6.d.b.......F'/.C^..t...e%.s^.3..4..&..o)Y....UrU.R@.........i.%?...lW.-..g.'..KC...'..0E.m.d.....x.#]...y..u...?.x.V[....o5.x..MQ\....nX.@.9r..iJ.8...L.E...c.4..6.x..@'..[..C(4.&.../A..i........e...`T..H. ........)....9(!.D..m...0..e.,...~..<. ..L.}...................../...sC..#..}.... .......9.9.....Ji..Xb.Yjk.../...6.@b...i..&....F....M..a....u..B..~_2....h.:nu....-..QiL.P|.LB.).....X..v5Z.$aP.".*...z.b5J..z....h.a>?n~h.$..;.V.'i...2......Y..q^Z4..\....=`....o.M....~.....:u..^.....A@......k..b...Z<.!..;......&y..!4...#..S.p;wb....@a...._.......At.5..pz........t.5H.. 8.-..7...{.P.a;..ia..@.Ac.1.....T...,dmoE's;....5...B.7.vQ$9......y{.j...F....|...9.u....M......1./.-t....dI#d..C9..Lg...../. .v.......1T..60.2........#..B..............8.....y#~5A...~t...K...{a.|.z....~.*..b*.49k.2....>..]s...W...B.n....zK.,..Vk.....h...........w..."......I..XW[..}W...y0f..k.~..O6.97#Gk8.5(....Y.W..k...Lz....6fz.....)|.}../h(8....0dzx.\........._..b...'..Y..w/*H..\.B...\.......1&..Vg..[..N(.ZI.......G..[.x....0:.eJ.J~..)o..,....T...i..Z.Q......P!.J......_...F.1er.8...#d...).......Z..im..F.i....%".o.....F.z.V..Q..K....R..W ./.".E..dR...y......'Tu....9U..$4."..wP...d9.....x$...W`....8....#u...1..\,.S.:.kdU..[...,.a"....". P....!.V.K.Q"M.G.e....w!C..../..... m9J1..&I..z&.2.I..-B.......{.=Ftm....6....A...3..=@t..67.-M.U.Z/..c..^W/Wo .h

<<< skipped >>>

HEAD /ofr/Solululadul/asgnd.cis HTTP/1.1

Accept: */*

Host: cdneu.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: application/octet-stream

Content-Length: 101029

Connection: keep-alive

x-amz-id-2: qnboCh/nnDdf7u2WCHWJFCiznuoU/b/YeReGf/mYBDRv1xKw6Tb6Fq5TK2eBE38XIbZu6wSK7DU=

x-amz-request-id: 68A3C620BBBEABEB

x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3

x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT

Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT

ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"

Accept-Ranges: bytes

HTTP/1.1 200 OK..Server: nginx/1.4.7..Date: Fri, 21 Oct 2016 22:28:47 GMT..Content-Type: application/octet-stream..Content-Length: 101029..Connection: keep-alive..x-amz-id-2: qnboCh/nnDdf7u2WCHWJFCiznuoU/b/YeReGf/mYBDRv1xKw6Tb6Fq5TK2eBE38XIbZu6wSK7DU=..x-amz-request-id: 68A3C620BBBEABEB..x-amz-version-id: ak82ScyXtEXeOWL8crBo3MgwwdwO6r.3..x-amz-meta-cb-modifiedtime: Wed, 20 Jan 2016 14:37:36 GMT..Last-Modified: Wed, 20 Jan 2016 14:38:52 GMT..ETag: "638ebcd93f900c3908f5dde6d8bc2d9f"..Accept-Ranges: bytes......

GET /ofr/Solululadul/osutils.cis HTTP/1.1

Range: bytes=0-4012

Accept: */*

Host: cdneu.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: application/octet-stream

Content-Length: 4013

Connection: keep-alive

x-amz-id-2: b0IH4iJpCel uQZI63RSW2cYDzkEzFhQlEMc3SN3Qcpqsv7eIGOQt79QcgMYDepDRDBSlxbFvIE=

x-amz-request-id: AAA45E25BD2FA425

Last-Modified: Mon, 11 Jul 2016 14:16:38 GMT

ETag: "569022425db355c9d82beba6efc44f22"

x-amz-meta-cb-modifiedtime: Mon, 11 Jul 2016 14:16:17 GMT

x-amz-version-id: E_VvN6fQk3XvRBW0r6sepHKXSxHLTQ4l

Content-Range: bytes 0-4012/4013

CIS................7...............P.......Vv/#..F D(.h]....TK..TK...#a .Kv.>y......U.:.i.......<.*._fq.~k...*......w.......@...GR..J......(......;.....c?..P....Rn..s..Sq..:.jF}..2.Io.^x.y.$.. ..Wc./..2...U....|.........a.'..z_S~..^v.6..L...Pj.5yMz`P.e.M.S........%K....3...`y-'....jB....cIL<...q.HS..Eh....&.X?tK>..n..?.y[d]...R......WD.\...&?..I......H..U.-gGq.../.6\..M`.j-5u...B.R..T.P_G.zLK.O3.c.O.}AD.dh.Q.."a..CCB..5K:(..2..'1./.....5......e).....v.G...N...?dBrh......5.3.y...Y0....J&.yQ..mpN[...7./....|.p.o...M>UB....., .z.....aT^9d..c...F*|.c(...;M"5...w-..H..|<...G.#.R.0.....#.5...~nZ...G..`...... ....lB..6..E%....=.....P....WY.!O)..VD.d.C..|.4..[a..>\..;...r6.../.G.<.P...D..J.*.;..}.a.8.b.....Z....Fad..j...O..1....%k.$.....v.6VL.u.......55....>.T..".QbOm3.....>.............V..}.".!..c%..K..cNhY...F.&...>.....].jI.07$Y..i8..S......HH ...0Z..y..7...y.R.,..h.k.[g}..{......0.\j..z.V.>.%.i1`7.t..7...u.O..T,.@LT...(k..A;$..~.....e.....k.w./.%.8.6.xn....P ";.i7.(@M..3.).P.&...\.g...H".su,........:m....6."../.8....c4.._.hBphnGq'....$...Z....,..]..R..yv)C.@...{..F...S.8..CY.s`...*..o..6m.......|q5..._.'C.....2....g..?511.8C.2..........qj.y..K.;8.....1^....}%F..... .5v?.CE....~d.%....&;_Q..9%.F.$ G.d......[.G.LU......6f.ne..........p.....s.......~...z..ap/.(...../.....QY..!...J;.................,Gv....r..p...Y.k..2..X..{....Q\........6..^....[.4..W...?@...*......?;v..hn`..~.7Q..D.F...'o.3...6...._...4. .B..r .../........c...Q....Sx..i.k......6b. iHoR.K..p...........n..*.......=..

<<< skipped >>>

POST /?pcrc=764536170&v=2.0 HTTP/1.1

Accept: */*

Host: rp.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 832

Cache-Control: no-cache

...3E.Q)_l.y...K.z|........|. ....>~.....b....s1j...x....0.br7...P.-. ...&.'.....@F.=..@.gy..bd.!q....z...S....\.!.5..hcP%..[,S.......V... ...._.XZ.:...O{.J..g..9.^..F(...........~

t.^b..N.{..&.6i.b... .W`77Wp.JE.o..Tfy...2..N9.u..z..... ... 6;<`.W.ja..XM@...,2..X.I.....Y......u.....{.C.... ..2..c....-.Kn...U.,....0.&..kdU..M.........l.j..g..X..0...}..W..j........K.Z&../.h 0.....5&..;.....|.Hf5w.z[.!.}/.8..\...oX.T.......]..M.....&............Kgs.B ..C.Y......R}W..{.1._-fO;-......t..' .........1.........&...c.Y..|.....or.....$rk..........0....1.lg..)%..i.........3.K,..y....`..`t....'.y...... .'....O.nY......?B..9.......'..].3.~.C....!A.g?6......|bi._.b...W5d....x.....n...G.

.hb...>...gn07..jt?...:kL...!...K.".........3.0...4.......WJ{x.. EI.Q...kt..5v.G*.v.!.i....'*..\...O#..S.B.PI..d.9..... 3y.n...~!...F..J..B

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Fri, 21 Oct 2016 22:28:44 GMT

Content-Length: 4

Connection: keep-alive

DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Fri, 21 Oct 2016 22:28:44 GMT..Content-Length: 4..Connection: keep-alive..DONE..

GET /img/Malaromoro/bg1.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/jpeg

Content-Length: 190754

Connection: keep-alive

x-amz-id-2: R7zutzE 4ciSy7j8k7KDz1iKkP99UJAAac bWXT8IU5lcqx/p2PWB0anymYZ7Sug

x-amz-request-id: 4F07CA815EE8BDA5

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

x-amz-version-id: EqXw9hQ1szW0X1KVab90EKpMdqK_JEeL

ETag: "04007b142892c379ac83bd75ac617cf6"

Accept-Ranges: bytes

......Exif..II*.................Ducky.......d.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236" xmpMM:DocumentID="xmp.did:0699FCAEAA0111E389E68AC7CC963200" xmpMM:InstanceID="xmp.iid:0699FCADAA0111E389E68AC7CC963200" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:069AD74DE0A9E311B383BEF54B638275" stRef:documentID="xmp.did:A49514ECFC9DE31187F4F8E0F4860236"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................0...................................................................................................!.1".A..Q2#.aq$..B3%...4.....R..Ue&........................!.1..A"Qa.q.2#....B....R...br3...$.CScs.4.T%....Dt.U&............?..../*z..E].c..H..S..^g*...B....a.<.Q.....A ...$..M.>..M..........i6l{..p..rMdu..A1$...........r5W..S.......mmk......}u.......=#<...Dh...;.V.....N.r#;Q~...us..EO.

<<< skipped >>>

GET /img/Tuburera/bar7.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/png

Content-Length: 10604

Connection: keep-alive

x-amz-id-2: 4ZP4h1BuL2Ya9oURpPjqpGYnmTw3AtV2cDLcZjAVIbcSHwKnvrOtx9qYuCuSVk b

x-amz-request-id: 04D8AF09B5A13155

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:06:52 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:45 GMT

x-amz-version-id: N2ls4ElWemvYIzegu69FA58gpcXntv9c

ETag: "4fa9087a65898badf6d8955c16d73809"

Accept-Ranges: bytes

.PNG........IHDR...'...(......{< ....tEXtSoftware.Adobe ImageReadyq.e<..).IDATx..}.p....7..w...."H..xS.)J2.H.....Z. {.x..!Wy....T%....T6..U...........,i..:m..u..H..).........>f&..=3.yx....R.Y.............Gy.....PRlX.k P..W..._.}..W.t=h.,..T*Yo.......r.m[.r..U.9..8....o:.,..../p.......,Uu..Tl=...[Z....h.TT.R...R..g..%.........^o*..O.Q...U.'....o.P.......tP..e.....B......L.m.......w.)..FQ.,..b......,qLq...9....vt...._...Wi.Y._.}..W.t=?.k.vc....bY.4M.X.4......<P.y.wK."..... .......`...B..B..?^x.%.w.}...K.>..NU......>....:..{...k5. ...s*n.r..~`9.UoT`...4..n....9...FL.OE.[.O........_...n.O....;.....D.A.......\....R....,...chp.c.....(.....466bI{ ../ESC.j1..]...4...`T.....f.....$n....#S(ZA....n~."..I.......d9....%.Y....H......s..\...V...uJ...MU.g....894)....[...\...iy..f...]..7...w..y.<.we9..s.b9..........?w ....~....t.....9s...i.$T......q...<uB.?.4.f...F.w\...5k....G$E..3..\.............PB......]w..;....A...MON.....?}./.."r.ql\..[..v....D../v"...T...U.|..........6...5.[y.n3......m]....H\.. XL..T.8.}....k.N.W..J..7.9.......b...Q.\...A..8..S.T......:Q..\'?...f.......8t`?..f.....W.v.:t45..*Y.)IX......f........w....n.~...c..u.q....y.GC.Q.~....P.f........X..d....8.O...~\.t.`NK..&...2m.(.T....$f.\b....c...R.1...T....C(.I...d.N..3.....ww.EhjM...7.....$.....Y....s....<.W...}...ip..E))X.c6..d...a.f...)...P......\*............o}...vC/.QH.appPR8..*.$.........k.....x?>.?...z..<..>....nk.,G...}>...W.....]Q...;SU...R..S.:/W4z..7.W.....p......dO..^........2....-..?s....\0b....~p.c...eY.....G..

<<< skipped >>>

GET /img/Rewudaw/BG.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/jpeg

Content-Length: 102878

Connection: keep-alive

x-amz-id-2: bcVxkCwrboPMAtqIgZL0NoU5// KNuGzDpwfozZpElnJJb/eSxwgINS4ch fGhIYIET3tR6rP0A=

x-amz-request-id: 0745F2E6E5BBB525

x-amz-version-id: sCJ._v0SQy.IKyc6FrWiaRIAYL2XAV4H

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 19:47:01 GMT

Last-Modified: Thu, 31 Dec 2015 19:47:27 GMT

ETag: "d4337f9e3cdbb54bd455a9b749954a87"

Accept-Ranges: bytes

......JFIF.....`.`.....fExif..MM.*.................>...........F.(...........1.........N.......`.......`....paint.net 4.0.5....C....................................................................C.........................................................................0.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..5.u.... .z'.|.........z...G$....1..[K..=.........^..g.....-.O..}.....6:....r[!gw.....{.[..[.....c\$Q......:M..6.^....9............6x.x...w...J.q..x.`..S.UO..._.q._....J..n..JJ.m.I%.r.w...s. .NTd.\..T............Zm....|v...9...P.4.P.d:m......B.D.[.|3...o..y.s=..R.].._L.x.C....:R\H.....Zy..2.<....O...4...u85.kO.[./...E../..u... ....h...Ju..8O....;v.._....R...4m.2.w.3.G...ZT.Zo.SI...Ke.E.3.8...I7.........}.O....4x-..<j.$..Y..._....>.......C.Dg...G.........(...........Xh.^..h....M.}.U.5..M..O:...=Jy.,......*.'.Ic...<....#k.,.r..~.S.......D..e.Y..Y..L...HO..TO..".... ./j.p...5...Z.O.J...}.\9Z...m..c..%R.....2..........'.g...).....4.^O....].....}.j.....X.C.o.n.d...s..qx...Y...f&..N..n|Is.C.K...~x...d.....*l.|~...~...>".7...........mk..|<.6....E.^.~ ....o$..H.67.[..]....(..F....t...c

<<< skipped >>>

GET /img/IE_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/png

Content-Length: 5921

Connection: keep-alive

x-amz-id-2: YzLC7v9t mU/uIeZN0XvKZGHdhekPg1BjkYCODuyM3KQJq/aCn IY8BVFK6qSJrJ

x-amz-request-id: C1905B8CEB771859

x-amz-version-id: JCaAVEF0XYSznIkNb1ccJeiC74z2Hy2T

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "d86b9d354a5cdd126ae5250c162630d3"

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:10B50654C8A411E4A871F63F79D4AE1E" xmpMM:InstanceID="xmp.iid:10B50653C8A411E4A871F63F79D4AE1E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.. Y....IDATx..Z{.......].==...a....A....Z.$$.=..s.G...M6.Y_..l.&.$..yxt..W.9.....b|F.. 1.A..F`...GwOwuW....W.3A..`..{..........{...a!.}T_.L..4.t..\...a.?......C.....kPL*.S...........}..k.w}..8.5C...E...?.$..?^......N......Iz...3TKW.B.)....).R.....E.C.........L.~..v.......%B'N..%..U.e]........!.~.:8O.ZG..Ie.1.).....h.X...d_...W.L..bi.6.ps....1x.....O.....Zx.,..W.F.r..[..<.L.?...XqZ..t...XEP...*RI\0.0)D...=.n.....|.(S(...O....We.k.8.X.........# ..........P....S...m.##...Vq..Rt.."."# ..........>..nA...1.... E.cE...h......$.1..JQ..!..o...;$..O.GA J.R.cV.Xp..f<.s}4<........7..A'..V.RX

<<< skipped >>>

GET /img/CH_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: image/png

Content-Length: 4849

Connection: keep-alive

x-amz-id-2: mONDDKJ3OSz6gavA/yjjPwJbjxi1NiZPcNVxpNdF 0iPUe5fqqzpb3DToKCdBWgs

x-amz-request-id: F82A34D0C21A35AA

x-amz-version-id: omxwqkFcs1tUW940Ss4VTxiINXau15QT

x-amz-meta-cb-modifiedtime: Wed, 18 Mar 2015 10:35:00 GMT

Last-Modified: Wed, 18 Mar 2015 10:35:12 GMT

ETag: "ba264606ca1d89ed519c9b8b3515f163"

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:B8B544DFCD4F11E4BC7FA5DADF6159A3" xmpMM:DocumentID="xmp.did:B8B544E0CD4F11E4BC7FA5DADF6159A3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B8B544DDCD4F11E4BC7FA5DADF6159A3" stRef:documentID="xmp.did:B8B544DECD4F11E4BC7FA5DADF6159A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..<....eIDATx..Zyl..y..9...\rEQ.%J.M...I.U...4E*..].A[.h...:hQ.)P .Z.@.(..H]4..*.R7Q.D.m].bK.%X.uQ$%...s.cvf...f.,W.%..x....y...}......!.Y;.c.YQ.=S.....gOv...6f.~.=9W.g.........:b4..d..8.m....o=...;]`......I..'.......3..u1:...\......No..p..\...... .h-..QF X@C.....*..#..........?..|.4>.........4...Ohl.^....Q............?..B2.^...!8.)4h..Me...$/8...}}.8.v..{9.cc....T..).p..{U.......8.'....o...Z.....fw!..OBD...PiIE..\uFT. m....z..w.`...p...p....d27h.C.)N...*.<9.]o...-(.. .Y.T2.P8.x...d!..!...S......(.........5D..t...S.,]....\;......H_8V..c...t9I......d.6.E..*.'..]O..1.!-!c.\7........N:.

<<< skipped >>>

GET /img/Fividof/BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: image/png

Content-Length: 27707

Connection: keep-alive

x-amz-id-2: Su QRTt2lqemRQCf1QFj2SPZeLA1M5ZYmTZhO8VMRrURou4bi2eGV Gpfqsp/gnGhC1CuMIip1Q=

x-amz-request-id: 5360DE61A26DCA0A

Last-Modified: Mon, 08 Aug 2016 08:08:18 GMT

ETag: "024f03602a6f7fe69592f9472cb01d4f"

x-amz-meta-cb-modifiedtime: Sun, 07 Aug 2016 14:10:06 GMT

x-amz-version-id: X3Cs5_ZFW8itsyxo6oqulRxPSOcm3fMR

Accept-Ranges: bytes

.PNG........IHDR...0.........6..I....tEXtSoftware.Adobe ImageReadyq.e<..k.IDATx....t..u.x.Wt7.... ..../.I..IY.#[.$/...I~.3.bYV...s&/.3o9y......Ifb.yq.o.%[.%."...wp.Ap.Bb_..Fw.....F........'.......j.~u.w.%.....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ..f.4Y.....n.B..[w.>..H..B".H#.\'.j.v....../............a..].Rw..4= .w.:.."..2.Q...P.;O=.W...$......W.[.....>\.ey...>........;.w...#.......k......|$...k^.,..t.J5..@..jE<........k.T.......6x]...R.3.a......5.c... .P..u......e...aM..F"'.;.m...g.....:.G.j-..".I.S.....M...r..B .x^T.O./....Z....k.4..9..C .(\..3.......fE.....5->_.]...<.XL..CNM=R>< .1...H.G.5...fzma..p..S.\......<......=E{N.......e...]#....Kj{v4C9C..g.w.......5~A..[I...e.u.w^...fp.5..1......N...E`L...I^.xN}..>1..-....F.........[.iN*.i....E.k....5.....A.^P..\......w....d...th]M]...8...HC%9h...v.I....?\...Y..O..b.,1....i.....i....z6...........o.....c.I..4....e...A.}|.]......"\x..w o ..9..u..5.:E_..|.L9.4.y@P.4....!.Ns.o..........z.......Z....V...$.W..y.5..........e..K.pn.y.....p.o..........|.t..-..9.;.....u...5...6..4\.X....g.......8/...........q{".k;^.tn.>.M.. ).v.o.<..I...=.k..M.5.L.K.6.A[.q.c;b.k.X....-A.8..9W4 ..I.......%].'....D.h.....x...U.. ..x......8f.....E..t..5:...j..B......y... ]....T.;.....n.6x,......V.0..>{.f..m.6..............0..?GC..dC.l....?.;......x7.......G8.0....qs.....c..>.o...{.M..x.8....1.

<<< skipped >>>

GET /img/Cazurazihiz/Cazurazihiz.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: image/png

Content-Length: 5983

Connection: keep-alive

x-amz-id-2: oDt7U5yIFVu6TfxbpSBTmDy3VV/fy p 5m95VP7LcX2JNu1pNLzoJTaQR3/o1 i2aV1Ynf5L7dw=

x-amz-request-id: CF1BBAEA6E0C2AA6

x-amz-version-id: wyC6mtJU.8C8djRcSmCE4rVxqum5xvWX

x-amz-meta-cb-modifiedtime: Thu, 31 Dec 2015 17:53:51 GMT

Last-Modified: Thu, 31 Dec 2015 17:54:18 GMT

ETag: "a22c3d2918d1834d285dae064d3cee86"

Accept-Ranges: bytes

.PNG........IHDR.......'......i:.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtAuthor.Nir SaharZb].... tEXtCreationTime.2015:06:24 17:02:12a .A....tEXtSoftware.paint.net 4.0.6..c.....IDATx^.[y\Tu.F....a.a`.....4mQ.7..Y...Yo.........[...........H.............;....sirf..L.T?.x..{.s.\.<.9.9.........j..-....lA.....q.4.'.EN..........Z?-...h[..O....F._.>.......)~J$i.X..IP!Q..d./R...9.l..1.....}.. .\C..q..0..A..PlT."..5...E.-...Z...O......B6!.>.Cs'Z.P.....u.X...9N.....8. .fW).:t@Ix.}..u.....@.).~1.[.=.@b.....>r.PLD..I..mA ;....t........l..T....G...'...G$..iE.9........-.)....To?\Y.C.`r--...lp%a...T.f..be.. .p.w.b.8...hk.;.H...p...8jk.#...u..j.s'. r.9.,[&.=..9...)v........<....t..........{..;..D.{.v......8. ....{:.b...Q..].q.I...".rp.v....J.9:...#r.mq..=K..2Y..L..w..~"k1..........U..t.............q..A...Q.....0.....!Jk..>Dd.Id; ".eC)...1R.lg'....U....w....b_..... 0$...V...QH..`.L..bVIJ..r').fS.>b...R.|.?CjwXd..r9.rO.e._`C8s..>..S.....|.A=...{......#Gb..U8}.4.Z.\...C......1L.>....>S..8.c...]..7...K..[o..y.....{..h.....@.......q..I.........^M.....PRR./................k.k*...Z?d...4...ze8..'.VdC........Y.....@E.j..s.?q*.CC..;.....e.. ..4..>.".....:u.VgWJ...$.f.rC.....<.).^G{,..B...o.%..........#::...-Z..s.b..ax..7.../ **..7?W(]..v....&&....a..-..e......}||p....Y..5l....>..p..........4...g....C....{....a..a.....?...{..?..rrr......7...VXX..V......c..Z...0.....H ...8...M)........T.....vm...2..~.. .c.{}.;..C.........z..u.....=?G........%b.{b..............JFd....0....7.9?"...&g

<<< skipped >>>

GET /img/Fividof/FS_BG.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: image/png

Content-Length: 20910

Connection: keep-alive

x-amz-id-2: YNUmvcINXKOPQZYaL2Vt1G0r5MmBbGJggY16vgu5pI2ND RAyuzS8N5HCDrM7vkKVnhXWvmvKRw=

x-amz-request-id: A303AAF71B43811B

Last-Modified: Thu, 25 Aug 2016 16:15:53 GMT

ETag: "20838f981ab877adebe8cc27d8fd8e8a"

x-amz-version-id: NGHte6ooz0o7QShucGRMfn4HeyGT11cm

Accept-Ranges: bytes

.PNG........IHDR..............u......tEXtSoftware.Adobe ImageReadyq.e<..QPIDATx....p\.u.......9..s..pr.&..fd..%.A............^...z..d....gK.% Z..H..C.sN ..r...}.sn7.. ..`...Pw.h4...=..~... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ....&.`aq..v-i..RV...<gV..4...V..kId....-.....A...n...}W ..[...t ..^....."..y.V...P[...Xm.j.....1.L.....<"gR..A.X..=..M.l..@..l....V)..Q.*3)..j(W?...=...6...j3....~.4...l:....\._.. ......C..)=-.;..J]. .Cm....W...>.V........6{Ndmj3...t....:z.. ....S...K./... .. ....x....d.f......kR.T.(.t..N!.r.f.u(G..Z.^.)'.......yC5...E/.9.]....x8....7...5.t..._M.;(.. .|..m....vS@.hYVG.:m...O.....). T.U\r.p.\..N...dB"....gq........<....v^m/.mg....m.I.X..A.....N.;..4d.z.:5..T.J|26u...I`i..B...v....bF*.........HGS..w:1....U]...R.Km.... ...v..~.d....f*..].Mk.u.(.........6....}.....dV.7.......w.#..\K|..j.P.Q.......]..M.?.A....Y.G..H."kS..P.'...b...?.....;JM&miV..4v.ZQ..TBKn..;."..w.C.Jx.....G{1.5..6.|-.M_TO... Nf.._..ZZ.i.. ......A..D....^u7mT..e;.w.:.b.4o........M......f2l...7M./.m..8.\.a... ...4.d.....3j.G...u..K./.... ...D.....h.d3.Y=KM&...T.D.Hm.0.c....`),L.b.._.Y...V...6...gV._.@&......7K.`.Z......Sh....`0.F..[.....3j.K.j.qQ9...L...J.W.... ..}$.....,...PIb....%.E..j.j...,.q...='.N..............7.y........2vTYd.X..D..;[q..yt.u#.I.Ix.|d...gCv5XL.8...J<.W.._......*.F.~........C...^..?Y...D6nW....Dk.6.O....RbS.../.01..n..V.Hv..(7.%.(.)....C..Z8.....I..{/8.af...d..`..'/...6t.w.....zYJ......_..f..`.Y.k6..v.W.S..

<<< skipped >>>

HEAD /binary/653/213947/direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b HTTP/1.1

Accept: */*

Host: allmyapps.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Content-Type: text/html; charset=UTF-8

Date: Fri, 21 Oct 2016 22:28:46 GMT

Expires: Thu, 19 Nov 1981 08:52:00 GMT

location: hXXp://static.binaries.allmyapps.com/d7448bc1ce787218cbf0eab09affebd9_TeamViewer_Setup_fr.exe

Pragma: no-cache

Server: nginx/1.6.1

Set-Cookie: AMASESSID=e3904d9f27a4bd54cc001d61ab75f62b; expires=Sat, 22-Oct-2016 06:28:46 GMT; Max-Age=28800; path=/; domain=.allmyapps.com

Set-Cookie: AMASESSID=e3904d9f27a4bd54cc001d61ab75f62b; expires=Sat, 22-Oct-2016 06:28:46 GMT; Max-Age=28800; path=/; domain=.allmyapps.com

Set-Cookie: ama_t=350efd5f-e1ec-40fe-a33d-dbcc629e3385; expires=Mon, 19-Oct-2026 22:28:46 GMT; Max-Age=315360000; path=/; domain=.allmyapps.com; httponly

X-Powered-By: PHP/5.5.17

X-Store: allmyapps

X-UA-Compatible: IE=Edge,chrome=1

X-WebHost: web1.allmyapps.com

Connection: keep-alive

HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Content-Type: text/html; charset=UTF-8..Date: Fri, 21 Oct 2016 22:28:46 GMT..Expires: Thu, 19 Nov 1981 08:52:00 GMT..location: hXXp://static.binaries.allmyapps.com/d7448bc1ce787218cbf0eab09affebd9_TeamViewer_Setup_fr.exe..Pragma: no-cache..Server: nginx/1.6.1..Set-Cookie: AMASESSID=e3904d9f27a4bd54cc001d61ab75f62b; expires=Sat, 22-Oct-2016 06:28:46 GMT; Max-Age=28800; path=/; domain=.allmyapps.com..Set-Cookie: AMASESSID=e3904d9f27a4bd54cc001d61ab75f62b; expires=Sat, 22-Oct-2016 06:28:46 GMT; Max-Age=28800; path=/; domain=.allmyapps.com..Set-Cookie: ama_t=350efd5f-e1ec-40fe-a33d-dbcc629e3385; expires=Mon, 19-Oct-2026 22:28:46 GMT; Max-Age=315360000; path=/; domain=.allmyapps.com; httponly..X-Powered-By: PHP/5.5.17..X-Store: allmyapps..X-UA-Compatible: IE=Edge,chrome=1..X-WebHost: web1.allmyapps.com..Connection: keep-alive..

<<< skipped >>>

POST /CM_Bing/?v=5.0&c=887768775 HTTP/1.1

Accept: */*

Host: os.freelegendary.org

User-Agent: ICAS

Content-Length: 1224

Cache-Control: no-cache

0A0Czu1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2ZtN0U0I0DzutDtDyDtDyDyCtA0B0A0E0A0C0FyB0E0DtN0W0VzuyCtFtCtN0W0S0PzutCtN0O0S0L1T1G1Nzu1P1GtN0E2V1P0C1M1J0S2Y1HzutCyEyDyBzytByCtBzyyEtN1L1B0A1Q1H1L1GzutCtN0T0KzuyEtByEtAtAzztN0U0I0DzutDtDyDtDyDyCtA0B0A0E0A0C0FyB0E0DtN0U0I0D0N1P2WzutDtDyDtDyDyCtA0B0A0E0A0C0FyB0E0DtN0M0G0U0I0Dzuzzzz1Q1R1QtAzyyDtG1StDyCtBtGyEyD1StAtG1TyC1R1QtGyBzy1OtAyB1RtD1P1S1TtDzztN0M0S0I0DzuyBtAtBzytBtAzzzzzytGtCtBzyyCzzyEyEtDtAyEtGtCtBtDzzyDzztCtDtDtCtN0S0I0D0U0I0DzutB0B0A0FzzyB0FtCyE0DyE0CyEyDtDtByEzztDzyyB0BzzzytCtD0FyD0FyB0E0DtN0M0A0C1V0LzutDtDyDtDyDyCtA0B0A0E0A0CtOtA0AtCzytBtFtCyCzztFtCtCtFtCtAtBtOtA0AyCtOtA0AtCtN0S0D0TzutBtDtCyCtCtDtBtBtDtCtBzzyEtAtDtDzztN0V0M0Czu0V0M0WtN1L1B0V0M0D1P1OzutCtN0P0E1V0M0O0D0Ezu0D0L0LtN1I1L2ZzutAzzzyzytDzztN1L1Q1B1RzutAtCtN0D0E0P1V0M0O0DzutBtN1L1B0A1Q1H1L1GzutCtN1L1B0U1T1R0O1GzutDtN1L1B0U1B1P1C0A1Q1H1L1GzutCtN0R0N1T1H1Pzu1RtOtA0AtOyD0C1P1OtDyDtD1Rzzzy1TtAyE1OtCzzyBzy1RyCtCzz1Q1QtA1P1O1OyD1R1OtAyCtBtF1P2V1PtN0O0S0L1T1G1Nzu1P1GtN0O0S0V1P1CzuyCtFtCtN0O0S0S0P0V1P1CzutCtN0O0S2VyCyEzutDtN0P0P0Nzu1B1T1G1Q1S1F2V1V1B2X1RtF1P2V1PtN0M1P1H0P1M0AzutCtDyByBtN0M1P1H0P1M0TzutCyDtAyDtN0M1P1H0V1L1C0AzutCzyzzyBtN0M1P1H0V1L1C0TzutBtDyEyBtN0P0R0O0D0U0C0T1V0T0I0T0L0Ezu2Z1P1T1H2X1L1P2W1P1C

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Fri, 21 Oct 2016 22:28:45 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: currentSet20160925

X-ICSCT-IP: 194.242.96.218

X-ICSCT-SERVER-NAME: ads.slave-132-prod-eu-west-1a-eff63562

X-ICSCT-TIMESTAMP: 20161021172845051

X-ICSCT-VERSION: 1.3.2

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive

ed1.....2...2.......kt.}..g..XA.4..5..U.....6..e...........u.i.'..F.(qW......:.<tD.....g{D.z......M..W?.%.M...U.....g.....|iO=.Z..p...b.G......AG.F9.]4k...:.-.......AW.g.tK..$;....dO..M: QX.9.|..C._}].......L$...Q.......p\H....LN.E..7lz.l....:..5G.......!.AQ`.fH&......*|~.0R......D....m.C..,.O.h.]0...uVe'f...G.....TiXz......vi...|..L...="`\.j./...Gc............x.<_.D..I..l.CYH~i.......G../.MR.Q....-.K.|RN.Nv..b}H.m.X.....pm../....hb......O.../.ey.n..<`.0.)...b...y.......>..J......-.)1.=.o.%*..JS..B..1.....m...Rf.......a......lO..F.........|@>%...t{..I].-..7"l.k...........AP..k....Ue..s..._....hr...X.....h..,.......Ts)?S l.E...O...p.\.d..._C@o#(-&^..}p0J.n......X....a...h5{.....K7..,.............M....W.....%.....J...?....s...#..Q...ML_.:.i.&..]...c.'.. ,....Z.o0.t...x.`...Bz.7....?.~%<....C<.N....~.AU...3...Q...(..-2.8........../.|.....#..s............ ...xP..h..v...r.Z7UC....._f&..uf...E...{8Q.n..N...,.....u....}...y...>t.|@..7#.#..x....\.x..a.....1.v..F...=..z.O.d..!tF..:.. . ..U.C.ss...n4U..,T...2.W..>.&.s.u....M........w..W.......o.../.yu.ln..Cx.y.Pn|.).^..Y.#.r.f......d@.K.j....d.o.@....)..2.D 0..x?..W..;./....M...4Wt.}.1N..V2....C[.SM,K.....&6.V[.G...@hO.?..F...K$|.Q.yB....A...D.w...&5............d.j*..#.....sj../.k.c.....p.[gns..J.Q..<..=.[..S.3..`.... ....i.z5.h...>L?Fe.(...M,$xk<"...........R..3..O....eA.0.._}../3.(.}....?ZU.^K.....<8.YZs.IL..q.Z.sB.C...h...B..W.hf8...y...x.L9...Y...0..\.O.Z z.w.i8.;...s..X4............>..p..>.B9r.W..z.5@...............N.3...

<<< skipped >>>

POST /?pcrc=687845929&v=2.0 HTTP/1.1

Accept: */*

Host: rp.freelegendary.org

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 1424

Cache-Control: no-cache

.I..~...$$......N.......K....BW.b*mw.Am..N........3.Lx...w.B.;.....7...7r-I1.hO&.....V@;r_.x.>..r..r..P........Z.......D..7.......a....V...O.2..F.Vp....'#./..It.R...nE.]..6\\,..=.........9k....Y.....;.!.(.....?...0....87.H.....m.d../...e{...v$Y].....s8.|@...?.4..W.!ow}.Qwc.B...q....=.g7 ......7.x...4W.D..fS.,G..f..nY.[. .;.Dk..Vk..I....*..b...,...-.M.^H. .u...((0%.. ..W.`.r....%a.?P#..N_.wR....e'..l...b.....6.SO-G.J'.....L|..g. .......M.i..._f) .....P.%....!..5.>..|.U~t.f...8)l(9..}.sQp.'.,

..6w.=<`.cPJ...*%B...[k....J..jA./e...&....{....%MD..%....?.c...9. 6z...R..V.v.P_.....W..S..

.w.Z...]...8...}........aJ.f.u...>.KZ....'?..%..._E...'.pg....Aa..(.w.v...j.).D...d.m......W........v.....\..G..m@..6.......jHM....K..3....^.....m...(.b..B.{..(hIA....t.[..P`=..)`...........p.i.....:."...h#X.I]((G.h....f/]oz.......;.....Q....1..)..C...f.8.L#\R..".~....wmq..c......!v........K... <.......4.[...0W.......9"...x...]...{..I.D7X..iO<.=.....5.m.Rm..].n>...m~.{~.U..

e.....2q.3.......3j>&....z.F...u.....!......B.._(;.R,af..r..&R..B..=.<f..j..M ...[SE..'2...7{.]...x..ntR.;..A...^s..V7K^J....D.uk.L..cm....o..9.B......._I..

.F%...M.G..>.#...j........m?..r@........p.q..nn.Vs..~E6nb.K.X..q.S<#.s.uyn..b..!].!.....,.......C.<MC@.....d.JG.2H.[.w._.A.....H..&'.w......,.N.0...Y..e|.#......;...x

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Fri, 21 Oct 2016 22:28:45 GMT

Content-Length: 4

Connection: keep-alive

DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Fri, 21 Oct 2016 22:28:45 GMT..Content-Length: 4..Connection: keep-alive..DONE..

GET /img/Malaromoro/bg2.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/jpeg

Content-Length: 59210

Connection: keep-alive

x-amz-id-2: EHMK1PwFiL H6XWucBjAgcfwjNNHn1pq8l/5mXBF6J5cIFvei H7mcZsYV/mcvYY

x-amz-request-id: 403ECE47CD61D5E4

x-amz-meta-cb-modifiedtime: Sun, 16 Mar 2014 10:17:54 GMT

Last-Modified: Sun, 16 Mar 2014 10:45:33 GMT

x-amz-version-id: JMXnkH_Q4w85o.RRxkVvr1HHBSYxTWbA

ETag: "3ca90bdb0184dba078b0e604eb239df0"

Accept-Ranges: bytes

......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:345E81DDDAA9E311B383BEF54B638275" xmpMM:DocumentID="xmp.did:118EE61EAA0211E3A8EABD135B592C02" xmpMM:InstanceID="xmp.iid:118EE61DAA0211E3A8EABD135B592C02" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:086B2D40FAA9E311A847ACF83C7EB2CA" stRef:documentID="xmp.did:345E81DDDAA9E311B383BEF54B638275"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................0.........................................................................................!.1.A".Qa2..q...B#3..Rb...C$45..r..cs%....S.DT....U..E&......................!1.A.Qa.q.."2......B..Rb.#..r.3...cs.$............?...@L...-..I....E.i..D2P.*..b.,...]H.Z7.|1.....v.4....M.....T.<.Q......z.....u9...\u.......M....r'.gW.hM.B...I.....I...0@.....I..:.....:.s.......:...L..._..%nh6._........b)

<<< skipped >>>

GET /img/Tuburera/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/png

Content-Length: 8970

Connection: keep-alive

x-amz-id-2: fOiTjpQzE ecK WzQ1 b8QpG2JbrdESj5YLpuaWXFamJ5LAjD1RrEDn8Xvttj3e/

x-amz-request-id: 03B3608BEE4C976D

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:02 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

x-amz-version-id: CbercSsLGa07nAy9AshJRzsQW0lz1UK5

ETag: "b084c85324dcb4d88f500ebaf8ab37ce"

Accept-Ranges: bytes

.PNG........IHDR.......5.....Ap^.....tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..]......^.. l.w..... XP....%..X.1.D.$DM."".. ....J.E.u.]v....{....3.... .j....D........s.{.....D %H..B..zB...n...K.^,.Z.*..[[.K.[.._.GD|.....x/.V.g..L..Y.....44 .<U.=N..yY..B.R.....[_ ...@c.....C..._...f$...%{....1y.b.U...Oxy...YG..a..E....PRZC..?..|......e.Q.E..{./~..<.X...i.( 9..[....Dx.-N|<ZhO...F.......P.&V.?.U.l..1qLW..z.?Ld........m...B.0..8.../~....B....[..../......M..4...Dnh.....&11.......|..6DD.`......a............J..}.";E.i..._......r.......Gr.p....i{sp2.....(......8.g."...:.Db..Ix....=..^...r...}.'4.......P.0.....~../..L......EUX......1..mX.l7..*......Lf.d.........^..&....Z..W.hl.......e.R.B..z..=~.......}E..Ã¥...W.........l.]Lr...............kD.....:8.N\<.#..m.......%CZ-x...../g.............s6`..L....!..L.8....y......2..^||<..... ..G...........#._e.........[...#..x..Fl.QL......W!1!..=9....J_..z...~..._~yN.q.3..,........EBB.4.].aG[................8.......E|....Bw.../~..@.H...9..... m.......>1...\F....C..xy...-(..W....[......_......&Q.p<...=....8...p...........X?6*...I.....P]S...3z..N.........l..f.[/..(.Z-t..._.m..V.u..._~m . t.M...}...g".:.5...pi.19......j.......'PY]'..\<.3..G...^a...0..Y-...J.U..KI...s.v ...!x.....>.3...U.6[...........0..}...Y...../.)...v....B. t...Q.T.......%Bs...By.]x..jQ..O..;G....e.<z..S..a.......~.......Hi...........k.O.....r....h..w...!=4.s8..>..N.......`.........m?.C\L0^x.S........I..9.>.%.....G..F3e..u.c..s.RG/.z..U..W....A....FS.#......y0V.-i..j.....8.A.

<<< skipped >>>

GET /img/Tuburera/truste.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/png

Content-Length: 11597

Connection: keep-alive

x-amz-id-2: rxOhnNzn2D9fGoSiNk3R9iFXmXd5sUgvY7Fg5xi0z8nZbWMT9vcD7aj/37qCEgcr

x-amz-request-id: EF24F8B5D977F2AA

x-amz-meta-cb-modifiedtime: Tue, 19 Nov 2013 13:07:27 GMT

Last-Modified: Tue, 19 Nov 2013 13:08:49 GMT

x-amz-version-id: TsQX4cb1jyoGu5DXk3rpuvCf_fAlhQQa

ETag: "9d7db4bf8aea860f288e41d97c3687a1"

Accept-Ranges: bytes

.PNG........IHDR...A...U.............tEXtSoftware.Adobe ImageReadyq.e<..,.IDATx..|..].u....ez/*..D....f....)6.KlB......%....;.>..8..<.Nl.......l.hB.Q..F..4.....sOy..w.......;..w............(... ...;yx>l..`.M....m..i..[..v....V.R1.y...r9...p.<....ab...H$......D#(....#...X.j.......?pp..O<..H4ZX}...,?...s'..a..}..-9..s7.X.Bn.a..gm~...y.`[[...W\.`CSc..{...bU.J....B.U..|!.U4....>.n....`..3......!..............G|....._........c.....|.....m...?......q..&>..o~......g?........o....'?...[..G.6uv........;.../z..]....<'.U............,K}......p@ss3.../.P(.........PW..n..333....088(..v.Z|.c....c.....?._}.....k.L$.w..u..C...0~..q ......L&....n...m..7.!....;.....;#...7}.&\s.5....O~..z\....gPu.8...~(..m..........%.\...0s...8N.?..u.V?.H..]...7.w...r&.....n..|.z.0....].#.=....754......s.[........w.u...I...,..;.|...........y..3......f...?.>...0..g.y..[.lYy2^ ..7M....Z.Bx..#.w...b.....a1.....l....pTzS...*..(...:.jjj....w..e..w......k..... .........1:..>.."TU....6b....}.........../.....~..7..e.d.A...MZD.r&..._5..>..8...z.K.-..........oDSK3.mU84.A.6L.>.DV.....Yc~...Dkk........<.(...N.... ..........ax..%....BN.9k.F.XBgg'....q...s..5k.l=a#....A<.,...kF.....,.yd|.X.@X..l.7.p....ny.[.U........O....k"^....v|....e.g7HL............u0.&...S....0..P5....{/<.0..I.u.'....a0w..~..}.=.8..<......~....p..TJ~...!....<.~...v.Z&r..O?s.H...X.l......M.....r....u.]'........?;9.z.Y#..P.\\~..x..g.._?........[W.u.Y/1|L..'."..>/V..s.='.f..%..z.).?.....7......g...r.....g<..-....-Y.....%....E~2.......

<<< skipped >>>

GET /img/Tuburera/logo_b.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/png

Content-Length: 11762

Connection: keep-alive

x-amz-id-2: 24li0R/bDKl/K296kXfwDUoc1DKM7NC2X0hYEq0cvZ/LF623SYeNEdAPGX AIy00

x-amz-request-id: 4D6E84C7DC6788FD

x-amz-meta-s3fox-filesize: 11762

x-amz-meta-s3fox-modifiedtime: 1392281588994

Last-Modified: Thu, 13 Feb 2014 09:38:37 GMT

x-amz-version-id: akDXJVqWGXlhXhhZ8YepY7NAR4.yDN8P

ETag: "cc4bec630c2ec102cb6159e463ede5cc"

Accept-Ranges: bytes

.PNG........IHDR.......-.......;.....pHYs..........o.d...OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /img/Rewudaw/BG_FS.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:47 GMT

Content-Type: image/jpeg

Content-Length: 72475

Connection: keep-alive

x-amz-id-2: uM8MGJiYVgntkhgXaoQetwIUJJNe9mNxeDyzoQgwqs0/Yv5JVbMat9maoNGCZhDKUddcDKHcG k=

x-amz-request-id: C2F9127D9C62F0CE

x-amz-version-id: Nz7N2MAKlOO7oSd4nN3DlfFquV7Kpg4k

x-amz-meta-cb-modifiedtime: Wed, 06 Jan 2016 14:31:32 GMT

Last-Modified: Wed, 06 Jan 2016 14:31:44 GMT

ETag: "9146e3b2964074e188543372a5757a2f"

Accept-Ranges: bytes

......JFIF.....`.`.....fExif..MM.*.................>...........F.(...........1.........N.......`.......`....paint.net 4.0.6....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..^.;.O.|:.#....j.}...i..zu.Y]....x.T.....kI....&)6...Uj.5...7.-...'..-.'......E..Z.....6........@.J....`.p..Y...&...Y.....%......7v...p.K.c......#..#..K..,.Z=..$W.i.|......g.;..H.....7.....UtTe.[.M.J-.....J.Zz........E.HA..[.R.v.../....|W..u]S_...g.Vyg..!......h.....1....\.Z....}ona...<J..I...m......U.!._.6....8....$Pq#g.!.:...$......gut.[j...........(...'..m.7V.l......{.....>.P....S...p.R.[.E.k ].....mo..QN..\.4...t.......>4.n.w..G..............(5.3..]...x..ebnd.Hp..&X.............5.W....o... ...kAo...v.j0]E5..........E.Y.D.......GZ.P.,...k....F......x`72..f.WF..J..8.IB...N..d/..%.....c.WA.?.O.......y..>../..}.Z../N./. {....`...:..[G.....^./.,>..iZ..*r..S.jta)...\]Y(BZ... Y......^......q.%.J..j....e...]hwz..$.a..c.!q...5.S`..U1m.\.vF.!.q..k.<3.xj.L>...z..g....MI .x.HY.V...O

<<< skipped >>>

GET /img/FF_logo_new.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: image/png

Content-Length: 6157

Connection: keep-alive

x-amz-id-2: 2xTmrIX6FtcOk4vXzCG19w6MdMWUUEHZowCWWli8dtiDgi6TbYKWr38jwXvxg9vq

x-amz-request-id: 57871286BE740509

x-amz-version-id: wLXM_trCFKsgiAKj58s6fy6EyOPJSUfV

x-amz-meta-cb-modifiedtime: Thu, 12 Mar 2015 10:46:00 GMT

Last-Modified: Thu, 12 Mar 2015 10:46:07 GMT

ETag: "177a897550166829af6f7d037d86a2d6"

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E6EBD962C8A311E48FF2C56440BD2A7D" xmpMM:InstanceID="xmp.iid:E6EBD961C8A311E48FF2C56440BD2A7D" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01" stRef:documentID="xmp.did:A5370A64F8C7E411A9F2DF1F27361A01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....IDATx..Zil\.y=o.}...CR.6...}..6...v....l(..h."......E...Q4M..1P.-..N....$.lk."k.,..HQ.Dr8..g.~{...,...&..R.......r....> B....../..(.TU...m7..q.....S...W...H_..................)..,T.........h....H....!...]1#...........l'lx0....g.pZ..Z..k!lW....'9..T..T.................g.....u=.!OU.S..]FWb$.......r....VSQ7..u........C9.o.....;.......y..y.8.x..v@a.......=..9|......C.do2.M%.}.Y..T..l..../.M..e....~.....s......W<G...3l9.1...g......D...F&...}..{'{...SF:.C<l .V...Bw6.......DmT..t!...x:....{...c..O.y.Q.|..l.....f.\.&._.i..v`9...CS......H....9..............Gx>.5........\..MO...,...

<<< skipped >>>

GET /img/Nininininon/Nininininon.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: img.madihehife.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 21 Oct 2016 22:28:48 GMT

Content-Type: image/png

Content-Length: 415606

Connection: keep-alive

x-amz-id-2: oVhRDZEFW9BB0cfrRJDVZ0b6yR vEnI6zRPmSWsSX84gTDrZ0/mVR8TMIA71AOzLHgeU57ovVX8=

x-amz-request-id: F79DA88E4FC109AD

x-amz-version-id: s.HW.VrEMobnKgHFcVDtYUH1Ob1rUFLd

x-amz-meta-cb-modifiedtime: Wed, 09 Dec 2015 16:17:48 GMT

Last-Modified: Wed, 09 Dec 2015 16:18:51 GMT

ETag: "2cad81e24a9d1d2c55b26ee3c73b61e5"

Accept-Ranges: bytes

.PNG........IHDR...0.........A.>.....sRGB.........gAMA......a.....pHYs.......... ......IDATx^...LVi.........C..h,...q.............b..((U........DAE.......{.}ko.{..y...|W\.zm...c.u.k....e.7):...;.);....$...PQY@...T.>.......T;YP.f7a...u.6q[.R........w...5..Z...,......4...Q`bJEE(......@.-kj.-.s.....u...\.JYu.Ua^TW$..w......s.......G...hhh.2d.`Y..{.......w.8....9...csvq|...~.....g.v..;..{.&.........8..FN....s..QjcJ...J./Sl|.../.....P......r;...)..G.j]Zo<....1......._"..O....y;nPz....L.wp!..O.o....%.v.......G..'4&.S_.CMn.yw..u.Dmz.5NO(.t.5!....R/."N..~..E..}.9B..)....0.GcG...e..?....9*.r.n.....9..b..........K.._y~....'...6...-({v... ...R.....h*R_...%g.:R..A]..j._Q.PH}....]...=...hN..^....f...M..;.^}...-..|i.q..YS..JS.'Zs.i.k..yP..BkN..'\..s....T{..:.....4y.c.4x.4d...Z9X.Y.....T......M..D...alG..5....s...qn.w..{.d.7...g-.....C...x..2#}J..QpZ..kSj.....(7e..G8....M.....i6......S....N{x$..\.d.-E....!...........%<..g.i..e.zKUm<.n.....Z.....O...V.=.........$...t...X4D...?c..c.4x.....>.q..1~.`A....X.KWx...[#F.w.H....60.d.'.n....~.|.....).5..q.3N.^?....Qq..(F....T^<E...............ObF@(...4.?....N\...ek.~.@.g$.......<..r..w.... .-4...H...h..f..;.ZY.R.J....3..J..H.g..M&X.1q..f.........C.. .Mu...jR#..ap.Mu_............&V.......C0.Z..9.g..(h....$.9:b>z...7..~.. Q...x.. ...{.2.B......\.....=:z.,..e..sZ?........g...i....hOKg...L]..l..r^~f.......?... . .u.....4.k.5...ZE{b...Q...1..5&\..;#...?..........._nT...G.R...........d......'.m;....OSD...(.S../.j..3.~..~...~K.3...k..|.,&........0_|..M*<......C..

<<< skipped >>>

POST /?v=1.03&c=387944f9&at=584795107&cntr=0 HTTP/1.1

Accept: */*

Host: info.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JqV6q8cj1lxkkttuM2iOTS5wDb/nbDfcnZrK9z2BHH64yWAcrwJ1esfQVRZJ8r0r44BqhjlyRn5kurkWKSITDdF0TB60NHTSykXyqsPV838EgpMcyr etuzTHsU9EbcRM HJZVieNkChVuIJBJ97YH8=

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 21 Oct 2016 22:28:44 GMT

Content-Length: 2072

Connection: keep-alive

y/x3uO OxEwcEAoXCJ3zhDQO5RaRcfQ0s0Qba5sqMS3/DnbcJQKaCRDHZ/1rukEQPtSWYDmxHmA4kUdOdQLeA1cVK6kG8pvZVjW4 MHzsIN/Or4C RMxzB0KtIrKcL8KXcomDMzpQX8/seT8Zq2gqBYuHrLuKsDHD20/gx1hIBopcJA8DD8qRLnW0UxQRnhtXjFN9sIgQPA9 Rw3KDnjRFvjzZQwGsfMwdNZM2U1dvWkkXFn748LHPqQDgXujPXkYfMowJrMPE40MYJi9NrqLLUiBw2 6NtxRlzOsFNUE21 2uyP QUkodV9u/PPkhv8EKNI6sWSbvbIKDTd4t6335/JmKlThjGSFj1WXihUj5KK6wZP0FcJSKwyGwQe293cpdV6DYQLVL/ZfdLeUl2yjdbcnBFhjthBrDt dSRHSvd5Dga1vi18DE2qAcacrnrT83l/qNjM9fwjQtvPZlU5iIUx9dbsal90mc7kMteXwVO6s0S6yMdr/1SHkyyFuDkXjV0ySGX8cwZza0polhY vmPQOJ7Af7 fpEnf9s8FczkzBBvDvXH93NbCP/rHBExjALPoLbsEzBwRvgopvDN7AABhweog278N7QAk08lOfhqjYOVf/qMjJYVZgSPKnm/ F 1A2/Sijdu5W8ZbutlE3MJ5YletTU4saQXUM26YluwUbp9iQusRcRoptqqGOfjPCTrGYpHInWmda /WTAKWYD6J/H5gayJzAxPkx7OjzMLg1159fqkGh5E8NbZvSiEzO9C1urIWtdFutr9sRwLT7Oz29RU1YpMtISsm6SCFnjiZ0LW5rPRcVsrkioe3cNM86L8m8MyntqNpgdAewUefYXFYwltVR4Tb2GBaDSXr3dU/tGVjAVxk2c KeGOMMCd1 avzY2lQKDjWeWg/fEm5CFQaYI2PzxWYpGmdKEOGCeiAjQaGFiOlRAyxlJ96SxpXArMs/QCWlDEFIhQYPVR9zGpfDetxhMsUdAxydwEVPyXgvsIi/O/6pzD17k5mX1g16UabAS1yvHv0wBEBiqqwvonLfzXqpSmL8tH4TYID/ZGIBQplvsjPj8hi7ePadS6/ F/SrwFjKUkvQZeBOpXCyw8xZTjVjAIw/LQe07wQjKamwUXIxztdFpKkQFdMvMTEwPUsBuOrZ MRyvqNn1EppBEhl3swcowWLlOBZuPQuTglDkVTilrvBlat9wyQodKXznSNFn3qqD3Pj9TtQoCeJepvyN4xv /Yvz Klduo7mPEe4X3sKeSDfJP1J76Q5UiKHNmthCynVnVYcsx3YTe24sRSvkyL7u xJTygUSKgFVHt7fzoHcUdU4zhJZ42dDqR xyiSUC92zI dWFTJFelXATZhPaQHXU2OB4IJ dw9gfqP/XcI OKFf8U223e24VPZKBnPAk5ySfFcqM/O4WYnyAVqw924y0ayZFjofLlz6p3leKXlg5QD8tq/pFsCa4KhD1H03Ftbbzi6E5NPeh9RMyE1o8yYdnlRMEkuHsRXOIMUQWs3HWrq9jaBqlm1a

<<< skipped >>>

POST /details HTTP/1.1

Accept: */*

Host: giserv.madihehife.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 7

Cache-Control: no-cache

foo=bar

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: application/json

Date: Fri, 21 Oct 2016 22:42:15 GMT

Server: TornadoServer/3.2

Content-Length: 306

Connection: keep-alive

{"city": null, "region_code": null, "ip": "194.242.96.218", "area_code": 0, "time_zone": null, "dma_code": 0, "metro_code": null, "country_code3": "UKR", "latitude": 50.44999999999999, "postal_code": null, "longitude": 30.523300000000006, "country_code": "UA", "country_name": "Ukraine", "continent": "EU"}HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: application/json..Date: Fri, 21 Oct 2016 22:42:15 GMT..Server: TornadoServer/3.2..Content-Length: 306..Connection: keep-alive..{"city": null, "region_code": null, "ip": "194.242.96.218", "area_code": 0, "time_zone": null, "dma_code": 0, "metro_code": null, "country_code3": "UKR", "latitude": 50.44999999999999, "postal_code": null, "longitude": 30.523300000000006, "country_code": "UA", "country_name": "Ukraine", "continent": "EU"}..

Map

The Installer connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2240:

.idata

.idata

.rdata

.rdata

P.reloc

P.reloc

P.rsrc

P.rsrc

kernel32.dll

kernel32.dll

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

File I/O error %d

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

lzmadecompsmall: %s

LzmaDecode failed (%d)

LzmaDecode failed (%d)

shell32.dll

shell32.dll

/SUPPRESSMSGBOXES

/SUPPRESSMSGBOXES

/PASSWORD=password

/PASSWORD=password

Specifies the password to use.

Specifies the password to use.

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

/SL5="$%x,%d,%d,

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.3)

Inno Setup Messages (5.5.3)

user32.dll

user32.dll

oleaut32.dll

oleaut32.dll

advapi32.dll

advapi32.dll

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

GetWindowsDirectoryA

GetWindowsDirectoryA

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

ExitWindowsEx

ExitWindowsEx

comctl32.dll

comctl32.dll

name="JR.Inno.Setup"

name="JR.Inno.Setup"

version="1.0.0.0"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

true

true

!'%s' is not a valid integer value('%s' is not a valid floating point value

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

I/O error %d

Integer overflow Invalid floating point operation

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

Invalid variant operation"Variant method calls not supported

External exception %x

External exception %x

Generic Web

Generic Web

5.6.4.7

5.6.4.7

%original file name%.exe_2240_rwx_01150000_000CC000:

.rsrc

.rsrc

rnel32.dllwGetLongPathNam,

rnel32.dllwGetLongPathNam,

Q0.Fl

Q0.Fl

.xh%]

.xh%]

(_.SCK_LINES/$

(_.SCK_LINES/$

JYUIt.Vl?

JYUIt.Vl?

* (()@-3$-

* (()@-3$-

0J%Fs

0J%Fs

Keyw

Keyw

%s[%d]

%s[%d]

.FDiag

.FDiag

B.IIx

B.IIx

?7E(AL("%s",4),"

?7E(AL("%s",4),"

XI.Cr

XI.Cr

4'.Yt

4'.Yt

keysK

keysK

k3.yhF

k3.yhF

.cu%S

.cu%S

O%uorT

O%uorT

Ht.HA

Ht.HA

ibD.ZP

ibD.ZP

\*.*2XE

\*.*2XE

.dwcnh

.dwcnh

vfjzg V.fG!>_

vfjzg V.fG!>_

De-a.ew

De-a.ew

webqsk

webqsk

.fcclJL

.fcclJL

JL-Q.JW

JL-Q.JW

1.2.3

1.2.3

,M.DJ?

,M.DJ?

bVsqlz3_

bVsqlz3_

[.Il

[.Il

KG.Ia

KG.Ia

.FJn`m

.FJn`m

0.XC/X[

0.XC/X[

H|iqi.DD.

H|iqi.DD.

UC.HS

UC.HS

.cP>&*

.cP>&*

chmk.mswrzf

chmk.mswrzf

,kt V -,%D

,kt V -,%D

c.cjjm0).S"

c.cjjm0).S"

.rdf'.fks

.rdf'.fks

.qiuykchVw

.qiuykchVw

HB@FY,.sdaw

HB@FY,.sdaw

dcm.NH

dcm.NH

.wuf.

.wuf.

=.uwJj

=.uwJj

:.pk\d`P

:.pk\d`P

i!%u$3

i!%u$3

vgv,.Pn

vgv,.Pn

ir$ah.Lx

ir$ah.Lx

^.rzPcQI/&^#&

^.rzPcQI/&^#&

Lmca(WglzgjH.Mo5

Lmca(WglzgjH.Mo5

8"~l.VwDgv:V/

8"~l.VwDgv:V/

.dv6B.:

.dv6B.:

.bcs3i

.bcs3i

!zY^A.XGw

!zY^A.XGw

h`8q.Hy

h`8q.Hy

RI.AT

RI.AT

;XQw`%f

;XQw`%f

gjvZi.AT

gjvZi.AT

n.hhp

n.hhp

mw.ll

mw.ll

C|.uC

C|.uC

UrlJ

UrlJ

.Uvl7Ll#Q

.Uvl7Ll#Q

?3URLs@

?3URLs@

n6.GIg$

n6.GIg$

L_LCUNTF, KHC.op=

L_LCUNTF, KHC.op=

6?0N2=.Lq

6?0N2=.Lq

W]E).rG

W]E).rG

a%dH^

a%dH^

.LC&U

.LC&U

!-W.vB

!-W.vB

aaFj`iZ.iFN

aaFj`iZ.iFN

%f@#"

%f@#"

)hix.CBOP

)hix.CBOP

RWoCJ[hx.Xu

RWoCJ[hx.Xu

NAER_[URNDT].Lw/OFL[^\\[@

NAER_[URNDT].Lw/OFL[^\\[@

.BOhZ

.BOhZ

m^rk.Um_gtw

m^rk.Um_gtw

'JXpx6.tg

'JXpx6.tg

nDlb.vok

nDlb.vok

.Bp/pe,

.Bp/pe,

IWeb

IWeb

.mI25

.mI25

y.jHP

y.jHP

i.SpT

i.SpT

!.blv

!.blv

m.Advi

m.Advi

.1..WAHO9[Zcn*b

.1..WAHO9[Zcn*b

;)W.gD

;)W.gD

HX.Pd`bj

HX.Pd`bj

IWV.cQ

IWV.cQ

fa`w.eoicTjo7

fa`w.eoicTjo7

D\GOAJYDH8Y@BKCo.XI

D\GOAJYDH8Y@BKCo.XI

!a%Cv

!a%Cv

MSGOf

MSGOf

\6$945'/

\6$945'/

UM.xX

UM.xX

.Hagddw M,7

.Hagddw M,7

r.vY?"[

r.vY?"[

hWkkaTmjC.Oo

hWkkaTmjC.Oo

VZY*rf.aeWXM

VZY*rf.aeWXM

.qB/hkk[lfqd

.qB/hkk[lfqd

PIPE_DATA'

PIPE_DATA'

cnyzgcEi.Tc/7

cnyzgcEi.Tc/7

a,/.ia

a,/.ia

v=.vpF

v=.vpF

nwgbo\hfm.cV]

nwgbo\hfm.cV]

h%d;s

h%d;s

.VccSivfkw V

.VccSivfkw V

o>TP\Oqah`k,.nlvcTmK

o>TP\Oqah`k,.nlvcTmK

'AwdAmcd.oi

'AwdAmcd.oi

wYb.wv

wYb.wv

VNJPu.IgYJgrwljQ`q2

VNJPu.IgYJgrwljQ`q2

z`o1caig2,.hf5b"

z`o1caig2,.hf5b"

wg8k-P.VO

wg8k-P.VO

%xH1 FZ"

%xH1 FZ"

khbbxl,.blzz

khbbxl,.blzz

C$.rv

C$.rv

]s.ZRy

]s.ZRy

4.nBG

4.nBG

V%D.*f

V%D.*f

%uKHJ

%uKHJ

I)3%c

I)3%c

F.CBh

F.CBh

o8

o8

.mpTb

.mpTb

U.FIG

U.FIG

z.tRn$

z.tRn$

J?.XV"4p2

J?.XV"4p2

M.rH|p

M.rH|p

%2X`\

%2X`\

mSg6_

mSg6_

hp%xT

hp%xT

rxgw%Uj

rxgw%Uj

_u%s*

_u%s*

.lC)a

.lC)a

$"!(&&$' )#

$"!(&&$' )#

*/.)*72-7)

*/.)*72-7)

#-**(-#,

#-**(-#,

_ (505*4

_ (505*4

.PMDF

.PMDF

KERNEL32.DLL

KERNEL32.DLL

advapi32.dll

advapi32.dll

comctl32.dll

comctl32.dll

comdlg32.dll

comdlg32.dll

gdi32.dll

gdi32.dll

ole32.dll

ole32.dll

oleaut32.dll

oleaut32.dll

shell32.dll

shell32.dll

URLMON.DLL

URLMON.DLL

user32.dll

user32.dll

version.dll

version.dll

wininet.dll

wininet.dll

ShellExecuteExW

ShellExecuteExW

HtmlUIInstallerSADLL.dll

HtmlUIInstallerSADLL.dll

.tV58VU

.tV58VU

V4_%x

V4_%x

I(E>~%c

I(E>~%c

.suWg?

.suWg?

N%xLFg%U

N%xLFg%U

%xz&H

%xz&H

w@%crCA

w@%crCA

'GweBt

'GweBt

M!%uAj7

M!%uAj7

.TAs,

.TAs,

%C-BX

%C-BX

R

R

.Zs*r"

.Zs*r"

svchost.exe_3340:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

msvcrt.dll

msvcrt.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

RPCRT4.dll

RPCRT4.dll

ole32.dll

ole32.dll

ntdll.dll

ntdll.dll

_amsg_exit

_amsg_exit

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

GetProcessHeap

GetProcessHeap

svchost.pdb

svchost.pdb

version="5.1.0.0"

version="5.1.0.0"

name="Microsoft.Windows.Services.SvcHost"

name="Microsoft.Windows.Services.SvcHost"

Host Process for Windows Services

Host Process for Windows Services

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

\PIPE\

\PIPE\

Host Process for Windows Services

Host Process for Windows Services

6.1.7600.16385 (win7_rtm.090713-1255)

6.1.7600.16385 (win7_rtm.090713-1255)

svchost.exe

svchost.exe

Windows

Windows

Operating System

Operating System

6.1.7600.16385

6.1.7600.16385

%original file name%.exe_2240_rwx_01221000_00159000:

kernel32.dll

kernel32.dll

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

EVariantBadIndexError

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

u%CNu

u%CNu

%s[%d]

%s[%d]

%s_%d

%s_%d

.Owner

.Owner

EInvalidGraphicOperation

EInvalidGraphicOperation

USER32.DLL

USER32.DLL

comctl32.dll

comctl32.dll

UrlMon

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

JumpID("","%s")

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeywordD

HelpKeywordD

crSQLWait

crSQLWait

%s (%s)

%s (%s)

IMM32.DLL

IMM32.DLL

AutoHotkeys4_&

AutoHotkeys4_&

AutoHotkeys|_&

AutoHotkeys|_&

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreview(f&

KeyPreview(f&

WindowState`a&

WindowState`a&

OnKeyDown|:%

OnKeyDown|:%

OnKeyPress<:>

OnKeyPress<:>

OnKeyUp

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

vcltest3.dll

User32.dll

User32.dll

2301654879

2301654879

A`bng`@ikc-4,uUxlxs-4,Ht.HA

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TThreadExecuter

TScanAllWindowsCallBackData

TScanAllWindowsCallBackData

Portuguese

Portuguese

i\*.*2XE

i\*.*2XE

i.dwcnhE

i.dwcnhE

webqskv`T-Y

webqskv`T-Y

nmhpjhc03.fcclJL

nmhpjhc03.fcclJL

i.ulzn1E

i.ulzn1E

1.2.3

1.2.3

THttpTimeOutThread

THttpTimeOutThread

THttpCallBackShell

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Kcqjpc`-0,Aaj-1,gEdafa`.pM

SQL error or missing database

SQL error or missing database

An internal logic error in SQLite

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has another row ready

sqlite3_step() has finished executing

sqlite3_step() has finished executing

Unknown SQLite Error Code

Unknown SQLite Error Code

sqlite3.dll

sqlite3.dll

ESQLiteException

ESQLiteException

TSQLiteDatabase

TSQLiteDatabase

TSQLiteTable

TSQLiteTable

Error executing SQL

Error executing SQL

Could not prepare SQL statement

Could not prepare SQL statement

Error executing SQL statement

Error executing SQL statement

select [sql] from sqlite_master where [type] = 'table' and lower(name) = '

select [sql] from sqlite_master where [type] = 'table' and lower(name) = '

Could not prepare SQL statement

Could not prepare SQL statement

SQLite is Busy

SQLite is Busy

Ecezcb-4 S,Tmeic6.fA

Ecezcb-4 S,Tmeic6.fA

W,iqi.DD

W,iqi.DD

-00,chmk.ms

-00,chmk.ms

Locate sqlite3.dll

Locate sqlite3.dll

8SQLit

8SQLit

install.rdf

install.rdf

chrome version is not a number:

chrome version is not a number:

DoAddChromeStartupPage - status:

DoAddChromeStartupPage - status:

DoSetChromeHomePage AL=

DoSetChromeHomePage AL=

VHB@FY,.sda-0,` U,K\JH,-c`ql,.RMH\@ U,fk-1,8*J`cl-0,iq,-]`d-4,mm U,]-1,jsdj`w,-GA R,^.P

VHB@FY,.sda-0,` U,K\JH,-c`ql,.RMH\@ U,fk-1,8*J`cl-0,iq,-]`d-4,mm U,]-1,jsdj`w,-GA R,^.P

exception while getting Chrome SP(after DB copy):

exception while getting Chrome SP(after DB copy):

-0,iq-3,dcm.NH

-0,iq-3,dcm.NH

Exception in InstallChromeExtensionRegistry:

Exception in InstallChromeExtensionRegistry:

YUJ@X@,.ji-1,yn-3,a-2 Q,_@Z Q,ek-2,umkz^ywb

YUJ@X@,.ji-1,yn-3,a-2 Q,_@Z Q,ek-2,umkz^ywb

@QA^ T,WOLHF,.eazyavg-2,Qfbmeqs.i,4

@QA^ T,WOLHF,.eazyavg-2,Qfbmeqs.i,4

Bchnsjz/Uco-2,en,._tixfbc-1,/OB,.Mgeezv V,]faho-0,stk.y,f

Bchnsjz/Uco-2,en,._tixfbc-1,/OB,.Mgeezv V,]faho-0,stk.y,f

SetChromeSP: failed to Add SP:

SetChromeSP: failed to Add SP:

to chrome

to chrome

SetChromeSP: failed to set SP:

SetChromeSP: failed to set SP:

as default search provider at chrome

as default search provider at chrome

RemoveChromeSearchProvider - cannot remove

RemoveChromeSearchProvider - cannot remove

RemoveChromeSearchProvider - exception:

RemoveChromeSearchProvider - exception:

DoSetChromeExistingSP - no file:

DoSetChromeExistingSP - no file:

sqlGetQueryResultEx failed! Query:

sqlGetQueryResultEx failed! Query:

Gndovgv,.Pnc-1,`c R,^qdtggnp,.JO.]-h

Gndovgv,.Pnc-1,`c R,^qdtggnp,.JO.]-h

DoSetChromeExistingSP: error:

DoSetChromeExistingSP: error:

Q-4,sbkfmhQ`qh-4,nq-4,hir S,dah.Lx

Q-4,sbkfmhQ`qh-4,nq-4,hir S,dah.Lx

Q-3,cmf,.Bacb V,[gotkj-;.]

Q-3,cmf,.Bacb V,[gotkj-;.]

Kjij-0,ja.pz

Kjij-0,ja.pz

Ckkhskc07.Rb

Ckkhskc07.Rb

IE version is not supported:

IE version is not supported:

is not supported:

is not supported:

Y^A.XG

Y^A.XG

Hn-0,em`cY\CKmbcommd.Hy

Hn-0,em`cY\CKmbcommd.Hy

TPipeServer

TPipeServer

TPipeObject

TPipeObject

TPipeServerListener

TPipeServerListener

TPipeClientU

TPipeClientU

Starting default pipe server, PipeName:

Starting default pipe server, PipeName:

isrPipe

isrPipe

Falied to start default pipe server, PipeName:

Falied to start default pipe server, PipeName:

Bc/K-33,`-1.jG

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

ebP-3,dLfnda`-4,`yj-4.PL

Retrieved Filename from Url:

Retrieved Filename from Url:

Restart attempts surpassed the maximum (

Restart attempts surpassed the maximum (

) is different than supported (

) is different than supported (

Urls stored in Chunks Map differ from the ones provided, ignoring the Chunks Map:

Urls stored in Chunks Map differ from the ones provided, ignoring the Chunks Map:

Chunks Map contains URLs, but the size is illegal:

Chunks Map contains URLs, but the size is illegal:

New Source created, url:

New Source created, url:

, httpCode:

, httpCode:

, url:

, url:

, Url:

, Url:

, old Url:

, old Url:

, new Url:

, new Url:

Switching suspended Server back to use; Url:

Switching suspended Server back to use; Url:

, HttpCode:

, HttpCode:

TDownloadConnection.Destroy() was called from not authorized thread (

TDownloadConnection.Destroy() was called from not authorized thread (

HttpCode:

HttpCode:

Unsupported 3xx redirect response, code:

Unsupported 3xx redirect response, code:

]DKizHi-4,exc-1,Hc`hk-3.GI

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

L_LCUNTF, KHC.op

0.0.0.0

0.0.0.0

6?0N2=.Lq

6?0N2=.Lq

;768>1-80

;768>1-80

005345000000

005345000000

000000000000

000000000000

000000000010

000000000010

000000000030

000000000030

cabinet.dll

cabinet.dll

Rijndael Key is too short!

Rijndael Key is too short!

;7.Q,>N-Y,[ T,Tc.Uv

;7.Q,>N-Y,[ T,Tc.Uv

Reporting failed on first attempt, second attempt is cancelled (finallizing)! HttpRes:

Reporting failed on first attempt, second attempt is cancelled (finallizing)! HttpRes:

First report attempt failed, going for second! HttpRes:

First report attempt failed, going for second! HttpRes:

The report failed! HttpRes:

The report failed! HttpRes:

Report sent, Url:

Report sent, Url:

TUninstallExecuter

TUninstallExecuter

)hix.CB

)hix.CB

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

RootKey:

RootKey:

RegDelKey:

RegDelKey:

(FF) TUninstallExecuter.RestoreBrwAddrSearch: OpCode=

(FF) TUninstallExecuter.RestoreBrwAddrSearch: OpCode=

Opera SP is in use, can't restore

Opera SP is in use, can't restore

TUninstallExecuter.RestoreBrwSearchProvider: OpCode=

TUninstallExecuter.RestoreBrwSearchProvider: OpCode=

FireFox SP is in use, can't restore

FireFox SP is in use, can't restore

ExecuteCmd: key=

ExecuteCmd: key=

KillProcess: key=

KillProcess: key=

: key=

: key=

Remaining uninstall instructions after exeution:

Remaining uninstall instructions after exeution:

ExecuteCmd:

ExecuteCmd:

ExecuteCmd: ExitCode:

ExecuteCmd: ExitCode:

CJ[hx.Xu

CJ[hx.Xu

Downloading Bundles data from adServer on url:

Downloading Bundles data from adServer on url:

,,XW2.lu

,,XW2.lu

,.cwLlgmc5.O-]

,.cwLlgmc5.O-]

NAER_[URNDT].Lw

NAER_[URNDT].Lw

Report main param:

Report main param:

Exclusive Execution mode is switched to:

Exclusive Execution mode is switched to:

Report param

Report param

Report param:

Report param:

Package execution returned bad ExitCode:

Package execution returned bad ExitCode:

Package execution failed, bad ErrorCode:

Package execution failed, bad ErrorCode:

LJ_.ge

LJ_.ge

fxk S,Cym^rk.Um

fxk S,Cym^rk.Um

ole32.dll

ole32.dll

olepro32.dll

olepro32.dll

IWebBrowser

IWebBrowser

IWebBrowserApp

IWebBrowserApp

IWebBrowser2

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetWidth

TEWBWindowSetHeight

TEWBWindowSetHeight

bstrUrlContext

bstrUrlContext

bstrUrl

bstrUrl

OnWindowSetResizablelp.

OnWindowSetResizablelp.

OnWindowSetLeft

OnWindowSetLeft

OnWindowSetTop

OnWindowSetTop

OnWindowSetWidth

OnWindowSetWidth

OnWindowSetHeightTq.

OnWindowSetHeightTq.

grfKeyState

grfKeyState

TComTargetExecEvent

TComTargetExecEvent

CmdGroup

CmdGroup

nCmdID

nCmdID

nCmdexecopt

nCmdexecopt

hhctrl.ocx

hhctrl.ocx

URLMON.DLL

URLMON.DLL

SHDOCLC.DLL

SHDOCLC.DLL

rcmDefault

rcmDefault

rcmDebug

rcmDebug

DontExecuteScripts

DontExecuteScripts

DontExecuteJava

DontExecuteJava

DontExecuteActiveX

DontExecuteActiveX

DisableUrlIfEncodingUTF8

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

lpMsg

PMsg

PMsg

pguidCmdGroup

pguidCmdGroup

TTranslateUrlEvent

TTranslateUrlEvent

pchURLIn

pchURLIn

ppchURLOut

ppchURLOut

CmdID

CmdID

pszUrl

pszUrl

pszUrlContext

pszUrlContext

szPassWord

szPassWord

ErrorUrl

ErrorUrl

OptionKeyPath

OptionKeyPath

OverrideOptionKeyPath

OverrideOptionKeyPath

OnEnableModelessh

OnEnableModelessh

OnTranslateUrl

OnTranslateUrl

OnCommandExec

OnCommandExec

'%s' is not supported.

'%s' is not supported.

TMsgEvent

TMsgEvent

TKeyEventEx

TKeyEventEx

Port

Port

Password

Password

poPortrait

poPortrait

OnKeyDownP

OnKeyDownP

0.750000

0.750000

3333333

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

This object does not support this method (

Unsupported type for Parameter with Index %d

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXp://

hXXps://

hXXps://

eiOnKeyDown

eiOnKeyDown

eiOnKeyPress

eiOnKeyPress

eiOnKeyUp

eiOnKeyUp

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

Handler with EventID = %s already exists.

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

Source don't have connection point for [%s]

JS function sync-execution failed with message:

JS function sync-execution failed with message:

] execution failed with message:

] execution failed with message:

MAPI32.DLL

MAPI32.DLL

LeftPopup

LeftPopup

not supported

not supported

YR-0,xh]izn.cQ

YR-0,xh]izn.cQ

2.1.0.0

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

This exe was created with an old version of HtmlAppMaker.

https

https

Log server Url is invalid:

Log server Url is invalid:

Sending Log to the following Url:

Sending Log to the following Url:

Log Http request has failed, res:

Log Http request has failed, res:

MSGALL

MSGALL

irsoMsgDialog

irsoMsgDialog

irsoJoinPath

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoRegDeleteKey

irsoIsRegKeyExists

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoRegCopyKey

irsoHttpGetData

irsoHttpGetData

irsoHttpGetDataInThread

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecute

irsoIsMutexExists

irsoIsMutexExists

irsoCreatePipeServer

irsoCreatePipeServer

irsoStopPipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSendDataToPipeServer

irsoGetWebBrowserHandle

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetCurExeCheckSum

irsoGetExeInjection

irsoGetExeInjection

irsoSetSQLiteDll

irsoSetSQLiteDll

irsoGetSQLiteDll

irsoGetSQLiteDll

irsoLocateSQLiteDll

irsoLocateSQLiteDll

TExecArgsX

TExecArgsX

.html

.html

H-4,njBdi-2,o-4,r.vY

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

-4,fhxXahcxgw.rg

gghYcjrf.ae

gghYcjrf.ae

jehGbeags.qB

jehGbeags.qB

PIPE_DATA

PIPE_DATA

PIPE

PIPE

-0,cnyzgcEi.Tc

-0,cnyzgcEi.Tc

LNYCD_^.eP

LNYCD_^.eP

HMVH9>.PE

HMVH9>.PE

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

IE WebBrowser docRendMode:

IE WebBrowser docRendMode:

IE WebBrowser docRendMode is not 7 (

IE WebBrowser docRendMode is not 7 (

THtmlUIExeAppU

THtmlUIExeAppU

Pipe [

Pipe [

HtmlUIExeApp

HtmlUIExeApp

Pipe command unknown:

Pipe command unknown:

gbo`dhfm.cV

gbo`dhfm.cV

irsoExecutePackage

irsoExecutePackage

irsoReportPackageError

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageSuccess

irsoReportPackageInfo

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoSetPackageRelProgressShare

irsoIsFireFoxInstalled

irsoIsFireFoxInstalled

irsoIsChromeInstalled

irsoIsChromeInstalled

irsoIsOperaInstalled

irsoIsOperaInstalled

irsoGetFireFoxHomePage

irsoGetFireFoxHomePage

irsoGetChromeHomePage

irsoGetChromeHomePage

irsoGetOperaHomePage

irsoGetOperaHomePage

irsoSetFireFoxHomePage

irsoSetFireFoxHomePage

irsoSetChromeHomePage

irsoSetChromeHomePage

irsoSetOperaHomePage

irsoSetOperaHomePage

irsoSetChromeOnStartup

irsoSetChromeOnStartup

irsoAddChromeUrlToStartupPages

irsoAddChromeUrlToStartupPages

irsoGetFireFoxDefaultSP

irsoGetFireFoxDefaultSP

irsoGetChromeDefaultSP

irsoGetChromeDefaultSP

irsoGetOperaDefaultSP

irsoGetOperaDefaultSP

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSP

irsoAddFireFoxDefaultSP

irsoSetFireFoxAddressBar

irsoSetFireFoxAddressBar

irsoAddOperaDefaultSP

irsoAddOperaDefaultSP

irsoAddChromeDefaultSP

irsoAddChromeDefaultSP

irsoGetFireFoxEXE

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetChromeVer

irsoGetOperaVer

irsoGetOperaVer

irsoLocateSQLite

irsoLocateSQLite

irsoGetFireFoxCookie

irsoGetFireFoxCookie

irsoGetChromeCookie

irsoGetChromeCookie

irsoIsFireFoxExtensionInstalled

irsoIsFireFoxExtensionInstalled

irsoInstallFireFoxAddon

irsoInstallFireFoxAddon

irsoInstallChromeAddon

irsoInstallChromeAddon

irsoUninstallAddExeCmd

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoUninstallExecute

irsoReportStart

irsoReportStart

irsoReportInfo

irsoReportInfo

irsoSetExclusiveExec

irsoSetExclusiveExec

isroSetReportUrl

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

-11,jycmjaOaahDgvyc-11.Pg

An attempt to download bundle data was denied: adServer domain name must remain the same! Url:

An attempt to download bundle data was denied: adServer domain name must remain the same! Url:

_moCjx^cJbh.VJ

_moCjx^cJbh.VJ

Report Url changed dynamically from:

Report Url changed dynamically from:

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

\GCAPMA][.oj

TcUlue.PL

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

FbghLbtaYhe.AU

1.2.1

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

inflate 1.2.1 Copyright 1995-2003 Mark Adler

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

333333333333333333

333333333333333333

33333833

33333833

3333339

3333339

3333333333333338

3333333333333338

:*"*"$3338

:*"*"$3338

33333333

33333333

33333333333

33333333333

3333333333338

3333333333338

33338?383

33338?383

333333333333

333333333333

:*3:"$3338

:*3:"$3338

333333333333333

333333333333333

V%D.*f

V%D.*f

%uKHJ

%uKHJ

I)3%c?

I)3%c?

F.CBhc-

F.CBhc-

%uOF.

%uOF.

o8

o8

.mpTb

.mpTb

jl85l

jl85l

z.tRn$

z.tRn$

J?.XV"4p2

J?.XV"4p2

M.rH|p

M.rH|p

6y<.cl>

6y<.cl>

%2X`\

%2X`\

hp%xT

hp%xT

.sY,

.sY,

rxgw%Uj

rxgw%Uj

_u%s*

_u%s*

WaitNamedPipeA

WaitNamedPipeA

PeekNamedPipe

PeekNamedPipe

GetWindowsDirectoryW

GetWindowsDirectoryW

GetCPInfo

GetCPInfo

DisconnectNamedPipe

DisconnectNamedPipe

CreatePipe

CreatePipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegQueryInfoKeyA

RegQueryInfoKeyA

RegOpenKeyExW

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyExA

RegFlushKey

RegFlushKey

RegEnumKeyW

RegEnumKeyW

RegEnumKeyExA

RegEnumKeyExA

RegDeleteKeyW

RegDeleteKeyW

RegDeleteKeyA

RegDeleteKeyA

RegCreateKeyExW

RegCreateKeyExW

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

SetViewportOrgEx

SetViewportOrgEx

ShellExecuteExW

ShellExecuteExW

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

MapVirtualKeyA

MapVirtualKeyA

LoadKeyboardLayoutA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyboardLayout

GetKeyState

GetKeyState

GetKeyNameTextA

GetKeyNameTextA

GetAsyncKeyState

GetAsyncKeyState

EnumWindows

EnumWindows

EnumThreadWindows

EnumThreadWindows

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

GetKeyboardType

GetKeyboardType

"$ %),'8

"$ %),'8

38000=344

38000=344

&W%%C)1

&W%%C)1

.AF{H)

.AF{H)

H.JXA

H.JXA

1 0 .'7(2':

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

&)"%&$&'&",,/- '

944(@32%2u8

944(@32%2u8

.PMDF

.PMDF

&&'%%'%'%

&&'%%'%'%

.idata

.idata

.edata

.edata

P.reloc

P.reloc

P.rsrc

P.rsrc

_ (505*4

_ (505*4

Attempt to access registry key: "

Attempt to access registry key: "

supported by OS for "HKEY_CURRENT_USER\Software\"; access directly under "HKEY_CURRENT_USER\Software\Wow6432Node".

supported by OS for "HKEY_CURRENT_USER\Software\"; access directly under "HKEY_CURRENT_USER\Software\Wow6432Node".

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

!Found Firefox sqlite dll at:

!Found Firefox sqlite dll at:

!Reading firefox cookies without sqlite.dll support

!Reading firefox cookies without sqlite.dll support

!Reading Chrome cookies without sqlite.dll support

!Reading Chrome cookies without sqlite.dll support

DoAddChromeStartupPage

DoAddChromeStartupPage

GetChromeDefaultSearchProviderFromDb - failed to get spid, returning default!

GetChromeDefaultSearchProviderFromDb - failed to get spid, returning default!

AddChromeSP: no profiles

AddChromeSP: no profiles

DoSetChromeExistingSP:no sql lite

DoSetChromeExistingSP:no sql lite

DoRemoveOperaSearchProvider - cannot remove

DoRemoveOperaSearchProvider - cannot remove

" was sucessfully removed but references to its HexKey: "

" was sucessfully removed but references to its HexKey: "

Stopping default pipe server

Stopping default pipe server

There is no source with range support for connection, picking one without.

There is no source with range support for connection, picking one without.

None of our requests are passing in Proxy Mode - suspecting inability to download from current server, trying another HEAD request to make sure.

None of our requests are passing in Proxy Mode - suspecting inability to download from current server, trying another HEAD request to make sure.

File size seems to be changed from the same source after HEAD request, suspecting rare case of lack of HEAD support - disabling it.

File size seems to be changed from the same source after HEAD request, suspecting rare case of lack of HEAD support - disabling it.

Only HEAD requests are passing in Proxy Mode - unable to work with this server (probably no Range support)

Only HEAD requests are passing in Proxy Mode - unable to work with this server (probably no Range support)

TDownloadAccelerator.Run() was ignored, since another download is currently in progress.

TDownloadAccelerator.Run() was ignored, since another download is currently in progress.

Urls:

Urls:

Pause request ignored, servers without HTTP Range support will cause download restart.

Pause request ignored, servers without HTTP Range support will cause download restart.

The source dropped range support.

The source dropped range support.

The source does not have range support - ignored range request.

The source does not have range support - ignored range request.

UnregDLL executed: "

UnregDLL executed: "

ExecuteCmd: Exe:

ExecuteCmd: Exe:

Waiting for all the ongoing reports to complete...

Waiting for all the ongoing reports to complete...

; main package already reported

; main package already reported

InstallerName altered after at least one report already sent.

InstallerName altered after at least one report already sent.

package already reported

package already reported

Starting execute, exe:

Starting execute, exe:

MSI package detected. switching to synchronic package execution

MSI package detected. switching to synchronic package execution

errorUrl

errorUrl

Failed to launch htmlUI from the following url:

Failed to launch htmlUI from the following url:

Log server Url is not provided.

Log server Url is not provided.

Log Http request has timed out.

Log Http request has timed out.

Remote mask loading is currently not supported. mask:

Remote mask loading is currently not supported. mask:

Setting SQLite dll path to:

Setting SQLite dll path to:

Registry entry removed: HtmlUI Browser object's IE7 fallback support is now enabled.

Registry entry removed: HtmlUI Browser object's IE7 fallback support is now enabled.

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_CURRENT_USER).

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_CURRENT_USER).

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_LOCAL_MACHINE).

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_LOCAL_MACHINE).

Loading in stealth mode, url:

Loading in stealth mode, url:

Read form default pipe timed out, can't determine if there's another instance running

Read form default pipe timed out, can't determine if there's another instance running

Pipe server TIMED OUT , can't determine if there's another instance running. continuing..

Pipe server TIMED OUT , can't determine if there's another instance running. continuing..

CANNOT start default pipe server, possible reason is that another instance of this installer is stuck

CANNOT start default pipe server, possible reason is that another instance of this installer is stuck

Please login as administrator and try again.

Please login as administrator and try again.

Installer Account Name altered after at least one report already sent.

Installer Account Name altered after at least one report already sent.

isroSetReportUrl() was ignored due to lack of Privelege Mode.

isroSetReportUrl() was ignored due to lack of Privelege Mode.

Installer Report Url changed after at least one report already sent.

Installer Report Url changed after at least one report already sent.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

No help found for %s#No context-sensitive help installed$No topic-based help system installed6Cipher has already been padded, cannot process message,Cipher is not in valid state for this action4Message length for %s must be a multiple of %d bytes1Keymaterial is too large for use (Security Issue)0Initvector is too large for use (Security Issue))Hash function have to many bits processed

No help found for %s#No context-sensitive help installed$No topic-based help system installed6Cipher has already been padded, cannot process message,Cipher is not in valid state for this action4Message length for %s must be a multiple of %d bytes1Keymaterial is too large for use (Security Issue)0Initvector is too large for use (Security Issue))Hash function have to many bits processed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

!Control '%s' has no parent window

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to get data for '%s'

Failed to set data for '%s'

Failed to set data for '%s'

Resource %s not found

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Property %s does not exist

Cannot assign a %s to a %s

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot create file %s

Cannot open file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Invalid stream format$''%s'' is not a valid component name

Ancestor for '%s' not found

Ancestor for '%s' not found

External exception %x

External exception %x

Interface not supported

Interface not supported

%s (%s, line %d)

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

System Error. Code: %d.

Invalid variant operation!Invalid variant operation ($%.8x)

Invalid variant operation!Invalid variant operation ($%.8x)

Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Operation not supported

Integer overflow Invalid floating point operation

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time

!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time

'%s' is not a valid GUID value

'%s' is not a valid GUID value

I/O error %d

I/O error %d

WerFault.exe_3364:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

ADVAPI32.dll

ADVAPI32.dll

ntdll.DLL

ntdll.DLL

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

msvcrt.dll

msvcrt.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SHLWAPI.dll

SHLWAPI.dll

IMM32.dll

IMM32.dll

wer.dll

wer.dll

COMCTL32.dll

COMCTL32.dll

faultrep.dll

faultrep.dll

Starting kernel vertical - %S

Starting kernel vertical - %S

rundll32.exe

rundll32.exe

NtQueryInformationProcess failed with status: 0x%x

NtQueryInformationProcess failed with status: 0x%x

Reporting never started for process id %u

Reporting never started for process id %u

StringCchPrintf failed with 0x%x

StringCchPrintf failed with 0x%x

NtWow64QueryInformationProcess64 failed with 0x%x

NtWow64QueryInformationProcess64 failed with 0x%x

NtWow64ReadVirtualMemory64 failed with 0x%x

NtWow64ReadVirtualMemory64 failed with 0x%x

NtQueryInformationProcess failed with status 0x%x

NtQueryInformationProcess failed with status 0x%x

WerpNtWow64QueryInformationProcess64 failed with status 0x%x

WerpNtWow64QueryInformationProcess64 failed with status 0x%x

StringCchCopy failed with 0x%x

StringCchCopy failed with 0x%x

Invalid arg in %s

Invalid arg in %s

wdi.dll

wdi.dll

dbgeng.dll

dbgeng.dll

dbghelp.dll

dbghelp.dll

SETUPAPI.dll

SETUPAPI.dll

SHELL32.dll

SHELL32.dll

VERSION.dll

VERSION.dll

WTSAPI32.dll

WTSAPI32.dll

WerFault.pdb

WerFault.pdb

PSShD

PSShD

tSSh,

tSSh,

t.PSj6

t.PSj6

t5SSh

t5SSh

SShx`

SShx`

tsShxc

tsShxc

t.Ph0j

t.Ph0j

_amsg_exit

_amsg_exit

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegEnumKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryW

GetWindowsDirectoryW

RegDeleteKeyW

RegDeleteKeyW

ReportEventW

ReportEventW

RegOpenKeyW

RegOpenKeyW

RegSetKeyValueW

RegSetKeyValueW

GetProcessWindowStation

GetProcessWindowStation

EnumWindows

EnumWindows

NtAlpcSendWaitReceivePort

NtAlpcSendWaitReceivePort

NtAlpcConnectPort

NtAlpcConnectPort

ShipAssert

ShipAssert

ntdll.dll

ntdll.dll

RegisterErrorReportingDialog

RegisterErrorReportingDialog

WerReportSubmit

WerReportSubmit

WerReportAddFile

WerReportAddFile

WerReportCreate

WerReportCreate

WerReportCloseHandle

WerReportCloseHandle

WerReportSetUIOption

WerReportSetUIOption

WerpGetReportConsent

WerpGetReportConsent

WerpSetIntegratorReportId

WerpSetIntegratorReportId

WerpReportCancel

WerpReportCancel

WerpAddRegisteredDataToReport

WerpAddRegisteredDataToReport

WerReportAddDump

WerReportAddDump

WerpCreateIntegratorReportId

WerpCreateIntegratorReportId

WerpSetReportFlags

WerpSetReportFlags

WerpGetReportFlags

WerpGetReportFlags

WerpIsTransportAvailable

WerpIsTransportAvailable

WerReportSetParameter

WerReportSetParameter

WerpInitiateCrashReporting

WerpInitiateCrashReporting

version="1.0.0.0"

version="1.0.0.0"

name="Microsoft.Windows.Feedback.Watson"

name="Microsoft.Windows.Feedback.Watson"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

ÝCD0

ÝCD0

#$$$3355

#$$$3355

##$$$335566

##$$$335566

% "#$$$3355666=

% "#$$$3355666=

"#$$33555666

"#$$33555666

!.DQ$

!.DQ$

.Py>o

.Py>o

Kÿg

Kÿg

.ib:?

.ib:?

T3%X_

T3%X_

a,M.cbd

a,M.cbd

KEYW8

KEYW8

KEYWH

KEYWH

? ?$?(?,?0?4?8?

? ?$?(?,?0?4?8?

1 2$2(2,20242

1 2$2(2,20242

>,?0?4?8?@?

>,?0?4?8?@?

?%?5?:?|?

?%?5?:?|?

5'565^5{5

5'565^5{5

3#3(353_3

3#3(353_3

=#='= =/=3=7=;=?=

=#='= =/=3=7=;=?=

=#=(=>=]=

=#=(=>=]=

>!>&>3>}>

>!>&>3>}>

1!1&131[1

1!1&131[1

Microsoft\Windows\WindowsErrorReporting\WerFault

Microsoft\Windows\WindowsErrorReporting\WerFault

%s %s

%s %s

Global\WerKernelVerticalReporting

Global\WerKernelVerticalReporting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

CrashDumpEnabled.Old

CrashDumpEnabled.Old

CrashDumpEnabled.New

CrashDumpEnabled.New

%SystemRoot%\MEMORY.DMP

%SystemRoot%\MEMORY.DMP

LiveKernelReports

LiveKernelReports

Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports

Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports

LiveKernelReportsPath

LiveKernelReportsPath

BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u

BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u

*WerKernelReporting

*WerKernelReporting

%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq

%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue

SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue

sysdata.xml

sysdata.xml

%s -k -q

%s -k -q

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

%u.%u.%u %u.%u

%u.%u.%u %u.%u

%u

%u

%u

%u

%u

%u

%u

%u

d-d-d d:d:d

d-d-d d:d:d

%s

%s

%s

%s

Failed at Step: %s with error 0x%x

Failed at Step: %s with error 0x%x

%sDrivers\%s.sys

%sDrivers\%s.sys

%s>

%s>

%s%s>

%s%s>

%u.%u.%u.%u

%u.%u.%u.%u

*.mrk

*.mrk

WER-%u-%u.sysdata.xml

WER-%u-%u.sysdata.xml

Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER

Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER

SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic

SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic

Web Server

Web Server

Software\Microsoft\Windows\Windows Error Reporting\Debug

Software\Microsoft\Windows\Windows Error Reporting\Debug

%SystemRoot%\Minidump

%SystemRoot%\Minidump

0xx (0xx, 0xx, 0xx, 0xx)

0xx (0xx, 0xx, 0xx, 0xx)

%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp

%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp

*.dmp

*.dmp

Software\Microsoft\Windows\Windows Error Reporting

Software\Microsoft\Windows\Windows Error Reporting

Software\Policies\Microsoft\Windows\Windows Error Reporting

Software\Policies\Microsoft\Windows\Windows Error Reporting

\KernelObjects\SystemErrorPortReady

\KernelObjects\SystemErrorPortReady

%s\%s

%s\%s

Microsoft.Windows.Setup

Microsoft.Windows.Setup

\WindowsErrorReportingServicePort

\WindowsErrorReportingServicePort

(0x%x): %s

(0x%x): %s

%u %s

%u %s

WindowsNTVersion

WindowsNTVersion

%u.%u

%u.%u

ErrorPort

ErrorPort

\StringFileInfo\xx\%s

\StringFileInfo\xx\%s

HKEY_USERS\

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

HKEY_CURRENT_USER\

%s="%s"

%s="%s"

%s.%s

%s.%s

%s %d

%s %d

Software\Microsoft\Windows\Windows Error Reporting\Hangs

Software\Microsoft\Windows\Windows Error Reporting\Hangs

_NT_EXECUTABLE_IMAGE_PATH

_NT_EXECUTABLE_IMAGE_PATH

wxmu.dmp

wxmu.dmp

wxhu.dmp

wxhu.dmp

axmu.dmp

axmu.dmp

axhu.dmp

axhu.dmp

hu.kdmp

hu.kdmp

mu.kdmp

mu.kdmp

hu.dmp

hu.dmp

mu.dmp

mu.dmp

Software\Microsoft\.NETFramework

Software\Microsoft\.NETFramework

NOT_TCPIP

NOT_TCPIP

sos.dll

sos.dll

version.xml

version.xml

.version.xml

.version.xml

%s.xml

%s.xml

memory.hdmp

memory.hdmp

minidump.mdmp

minidump.mdmp

Local\WERReportingForProcess%d

Local\WERReportingForProcess%d

atk.kdmp

atk.kdmp

Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes

Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes

%i|%d|%d

%i|%d|%d

xxxxxxxxxxxxxxxx

xxxxxxxxxxxxxxxx

xx

xx

%d.%d.%d.%d

%d.%d.%d.%d

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)

dc.noreflect

dc.noreflect

dc.xpmemdump

dc.xpmemdump

dc.xpdata

dc.xpdata

dc.CustomDump

dc.CustomDump

dc.expmodmem

dc.expmodmem

dc.expmoddata

dc.expmoddata

dc.OnDemandKdmp

dc.OnDemandKdmp

dc.xpmodmem

dc.xpmodmem

dc.xpmoddata

dc.xpmoddata

default=%s

default=%s

memory=%s

memory=%s

module=%s

module=%s

.dbgcfg.ini

.dbgcfg.ini

ElevatedDataCollectionStatus.txt

ElevatedDataCollectionStatus.txt

Open process failed unexpectedly: 0X%X

Open process failed unexpectedly: 0X%X

Attempting to cross-proc reporting process!

Attempting to cross-proc reporting process!

Elevation:Administrator!new:%s

Elevation:Administrator!new:%s

Reflection attempt failed: 0X%X

Reflection attempt failed: 0X%X

Attempting to reflect reporting process!

Attempting to reflect reporting process!

Could not collect dump for reflection cross process: 0x%x

Could not collect dump for reflection cross process: 0x%x

Could not collect xproc for reflection: 0x%x

Could not collect xproc for reflection: 0x%x

CollectFile for reflection failed: 0x%x

CollectFile for reflection failed: 0x%x

Could not collect dump for cross process: 0x%x

Could not collect dump for cross process: 0x%x

CollectReflectionDump failed with: 0x%x

CollectReflectionDump failed with: 0x%x

0 processes found for xproc module: %s

0 processes found for xproc module: %s

Could not collect cross dump from module: 0x%x

Could not collect cross dump from module: 0x%x

CollectCrossProcessModuleDumps failed: 0x%x

CollectCrossProcessModuleDumps failed: 0x%x

CollectCrossProcessDumps failed: 0x%x

CollectCrossProcessDumps failed: 0x%x

KernelDump failed: 0x%x

KernelDump failed: 0x%x

ProcessHandle

ProcessHandle

%s|%s

%s|%s

rpcrt4

rpcrt4

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

sntdll.dll

sntdll.dll

WerDiagController.dll

WerDiagController.dll

Software\Microsoft\Windows\Windows Error Reporting\Plugins

Software\Microsoft\Windows\Windows Error Reporting\Plugins

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession

Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession

%s\%s\%u-%u.etl

%s\%s\%u-%u.etl

%s\%s\%u-%u.etl_%d

%s\%s\%u-%u.etl_%d

Microsoft\Windows\FDR

Microsoft\Windows\FDR

%s-%d

%s-%d

Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier

Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier

Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder

Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder

%d-AppRecorderEnabled

%d-AppRecorderEnabled

%s /stop

%s /stop

psr.exe

psr.exe

Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules

Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules

verifier.dll

verifier.dll

nVerifier.dll

nVerifier.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

lsvchost.exe

lsvchost.exe

"%s" "%s" "%s"

"%s" "%s" "%s"

%s\system32\cofire.exe

%s\system32\cofire.exe

psapi.dll

psapi.dll

sfc_os.dll

sfc_os.dll

werfault.exe

werfault.exe

%s\%s-(PID-%u)-%u

%s\%s-(PID-%u)-%u

%s\%s-(PID-%u).dmp

%s\%s-(PID-%u).dmp

%s\*-(PID-*)-*

%s\*-(PID-*)-*

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit

kernel32.dll

kernel32.dll

kernelbase.dll

kernelbase.dll

ReportingMode

ReportingMode

WinShipAssert

WinShipAssert

WindowsMessageReportingB1

WindowsMessageReportingB1

Windows

Windows

ws2_32.dll

ws2_32.dll

Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo

Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo

%s\Sqm%d.bin

%s\Sqm%d.bin

CorporateWerPortNumber

CorporateWerPortNumber

BypassDataThrottling

BypassDataThrottling

Software\Microsoft\Windows\Windows Error Reporting\Consent

Software\Microsoft\Windows\Windows Error Reporting\Consent

Windows Problem Reporting

Windows Problem Reporting

6.1.7600.16385 (win7_rtm.090713-1255)

6.1.7600.16385 (win7_rtm.090713-1255)

WerFault.exe

WerFault.exe

Windows

Windows

Operating System

Operating System

6.1.7600.16385

6.1.7600.16385

Microsoft-Windows-WER-Diag/Operational

Microsoft-Windows-WER-Diag/Operational