Virus.Win32.Sality_9c3e3cbe96

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Virus creates the following process(es):No processes have been created.The Virus injects its code into the following process(es):

%original file name%.exe:468
Explorer.EXE:1140

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:468 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\universaldownloader-prefetch[1].htm (93 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=8777117 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[2].htm (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\OpenSans-CondBold-webfont[1].eot (2077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=6157950 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[3].htm (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\OpenSans-CondLight-webfont[1].eot (492 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2d9b4-fff45[1].css (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondLight-webfont[1].eot (974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_78[1].js (3472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\90f12-4a489[1].css (1391 bytes)
C:\illrd.pif (103 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\container[1].html (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\eaa2a-e6efe[1].js (2356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b5ae7-49f02[1].css (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bid[1].com/universaldownloader-prefetch&cb=2033782 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\font-icon[1].eot (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gpt[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (7961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondBold-webfont[1].eot (2783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\427b6-cd0ca[1].js (399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\font-icon[1].eot (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bid[1].com/universaldownloader-prefetch&cb=3057370 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\container[1].htm (4 bytes)
C:\autorun.inf (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windwiiww.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondBold-webfont[1].eot (1621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\4cd46-1a865[1].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\7b1b9-727eb[1].js (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1467b-931a2[1].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondLight-webfont[1].eot (1418 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\font-icon[1].eot (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[2].js (15 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondLight-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\OpenSans-CondBold-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondBold-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windwiiww.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\OpenSans-CondLight-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\font-icon[1].eot (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondLight-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondBold-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\font-icon[1].eot (0 bytes)

Registry activity

The process %original file name%.exe:468 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494852394"
"a2_349" = "2502017258"
"a2_346" = "2480520237"
"a2_347" = "2487687120"
"a2_344" = "2466184000"
"a2_345" = "2473353194"
"a2_342" = "2451833211"
"a2_343" = "2459002794"
"a2_340" = "2437499011"
"a2_341" = "2444662162"
"a2_180" = "1290439005"
"a2_181" = "1297603234"
"a2_182" = "1304772875"
"a2_183" = "1311955452"
"a2_184" = "1319124122"
"a2_185" = "1326295496"
"a2_186" = "1333448237"
"a2_187" = "1340623672"
"a2_188" = "1347788980"
"a2_189" = "1354971212"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074694922"
"a2_742" = "1024518441"
"a2_743" = "1031697984"
"a2_740" = "1010184633"
"a2_741" = "1017353628"
"a2_746" = "1053201850"
"a2_747" = "1060357994"
"a2_744" = "1038850527"
"a2_745" = "1046022438"
"a1_503" = "1289098190"
"a1_502" = "2775347331"
"a1_501" = "333007691"
"a1_500" = "2573676751"
"a1_507" = "2186630469"
"a1_506" = "2161527166"
"a1_505" = "1296232419"
"a1_504" = "2372508319"
"a1_509" = "3881996823"
"a1_508" = "2438879274"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "3629647296"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "1730366082"
"a1_434" = "2737588828"
"a1_433" = "1802007237"
"a1_432" = "1876476399"
"a1_431" = "3197684497"
"a1_430" = "2336003313"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a3_449" = "3202245640"
"a1_636" = "847710378"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "968066179"
"a1_728" = "1864324481"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "493978988"
"a2_748" = "1067542717"
"a1_593" = "2782795690"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_980" = "2825588505"
"a1_855" = "3273582252"
"a3_655" = "383827462"
"a1_857" = "3423790585"
"a1_856" = "3782902502"
"a1_851" = "1009752367"
"a1_850" = "1230931884"
"a1_853" = "4158345358"
"a3_654" = "376767975"
"a1_859" = "4100188110"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "1281675219"
"a1_184" = "4235810789"
"a1_183" = "2424927341"
"a1_182" = "1426679400"
"a1_181" = "3984378926"
"a1_180" = "3933629539"
"a1_963" = "3389375077"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "1574230759"
"a1_801" = "577756991"
"a4_824" = "1612388408"
"a4_393" = "2817464553"
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "2721776215"
"a4_866" = "1913491490"
"a1_933" = "2398753000"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "3739952026"
"a4_863" = "1891984127"
"a1_936" = "3199757047"
"a4_862" = "1884815006"
"a1_937" = "2738178384"
"a2_405" = "2903496130"
"a2_404" = "2896328597"
"a2_407" = "2917829974"
"a2_406" = "2910660841"
"a2_401" = "2874811094"
"a2_400" = "2867646442"
"a2_403" = "2889162261"
"a2_402" = "2881993649"
"a1_935" = "3282785785"
"a2_409" = "2932163738"
"a2_408" = "2924993401"
"a2_975" = "2694932645"
"a2_974" = "2687758881"
"a2_977" = "2709261238"
"a2_976" = "2702087189"
"a2_971" = "2666242258"
"a2_970" = "2659077042"
"a2_973" = "2680593719"
"a4_896" = "2128565120"
"a2_979" = "2723596267"
"a2_978" = "2716429629"
"a1_222" = "2489351844"
"a1_223" = "3451521042"
"a1_220" = "1074383877"
"a1_221" = "1020038004"
"a1_226" = "2019964972"
"a1_227" = "3466626249"
"a1_224" = "1899529148"
"a1_225" = "1716077079"
"a1_228" = "1788844246"
"a1_229" = "2409125531"
"a2_579" = "4150926086"
"a2_578" = "4143757861"
"a2_571" = "4093573407"
"a2_570" = "4086389803"
"a2_573" = "4107907472"
"a2_572" = "4100739469"
"a2_575" = "4122242137"
"a2_574" = "4115074157"
"a2_577" = "4136576123"
"a2_576" = "4129407405"
"a2_351" = "2516367898"
"a2_350" = "2509186813"
"a2_353" = "2530704734"
"a2_352" = "2523535827"
"a2_355" = "2545035828"
"a2_354" = "2537869477"
"a2_357" = "2559371130"
"a2_356" = "2552205245"
"a2_359" = "2573717963"
"a2_358" = "2566537718"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642486"
"a2_192" = "1376473649"
"a2_191" = "1369294624"
"a2_190" = "1362126336"
"a2_197" = "1412311042"
"a2_196" = "1405155846"
"a2_195" = "1397973552"
"a2_194" = "1390808356"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426662504"
"a2_198" = "1419493073"
"a3_625" = "168917752"
"a2_759" = "1146392093"
"a3_626" = "175906587"
"a2_755" = "1117724506"
"a2_754" = "1110542214"
"a2_757" = "1132055375"
"a3_627" = "183481274"
"a2_751" = "1089036947"
"a2_750" = "1081871784"
"a2_753" = "1103386870"
"a2_752" = "1096207315"
"a1_536" = "1685242734"
"a1_537" = "2702755620"
"a1_534" = "64504847"
"a1_535" = "3918041579"
"a1_89" = "933397518"
"a1_88" = "884484586"
"a1_530" = "2052196235"
"a1_531" = "3914111119"
"a1_85" = "2726509448"
"a1_84" = "2046411405"
"a1_87" = "3608648517"
"a1_86" = "3262699560"
"a1_81" = "772774026"
"a1_80" = "1900545131"
"a1_83" = "3989493309"
"a1_82" = "1265175629"
"a3_914" = "2274560123"
"a2_898" = "2142896883"
"a1_896" = "425862383"
"a1_890" = "2801433460"
"a2_899" = "2150080756"
"a1_67" = "1237487581"
"a1_66" = "2703271503"
"a1_65" = "2757074931"
"a3_133" = "970345548"
"a1_63" = "3903951862"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "463476838"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "3098909359"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "3173260404"
"a1_68" = "1665106448"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "3411785415"
"a1_409" = "2627109920"
"a1_402" = "1011609324"
"a1_403" = "1139811050"
"a1_400" = "1685364292"
"a1_401" = "1731085130"
"a1_406" = "2376808691"
"a1_407" = "1986396780"
"a1_404" = "679608651"
"a1_405" = "3319325628"
"a2_823" = "1605216692"
"a2_822" = "1598057892"
"a2_821" = "1590882892"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633902446"
"a1_628" = "3784207239"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "1242571615"
"a2_826" = "1626731888"
"a2_825" = "1619550369"
"a1_718" = "1878447796"
"a1_719" = "2228065354"
"a1_716" = "3747808645"
"a1_717" = "1219812883"
"a1_714" = "3804805845"
"a1_715" = "3927092919"
"a1_712" = "1325490550"
"a1_713" = "1446560612"
"a1_710" = "1056900168"
"a1_711" = "926792506"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "3362191855"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a2_941" = "2451167414"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "2434143285"
"a1_889" = "2281337189"
"a1_886" = "4132739873"
"a1_887" = "4074567018"
"a1_884" = "429184842"
"a1_885" = "3073641373"
"a1_882" = "235706989"
"a1_883" = "2950282954"
"a1_880" = "2093352798"
"a1_881" = "3914835821"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251294294"
"a3_444" = "3166269973"
"a3_445" = "3206813364"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Aas]
"a1_831" = "2602066283"
"a2_592" = "4244127379"
"a1_930" = "3100047064"
"a1_948" = "2919141485"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "3906977569"
"a1_723" = "3663901041"
"a1_722" = "389807918"
"a1_721" = "2027862068"
"a1_720" = "2923080172"
"a1_768" = "993062741"
"a1_727" = "4127948856"
"a1_726" = "1091345994"
"a2_643" = "314769916"
"a2_790" = "1368644111"
"a1_725" = "240836072"
"a2_642" = "307604541"
"a1_724" = "2630993898"
"a2_641" = "300437371"
"a2_640" = "293267879"
"a2_647" = "343452428"
"a2_646" = "336293653"
"a1_158" = "3183835783"
"a1_159" = "580588414"
"a2_645" = "329119111"
"a1_150" = "996678536"
"a1_151" = "4104351629"
"a1_152" = "2531653670"
"a1_153" = "1142198857"
"a1_154" = "2255005195"
"a1_155" = "3664357365"
"a1_156" = "2302662213"
"a1_157" = "2578994476"
"a1_235" = "3073116383"
"a1_234" = "1692768242"
"a1_237" = "2346742791"
"a1_236" = "3790733621"
"a1_231" = "1704926174"
"a1_230" = "1849330324"
"a1_233" = "2830009361"
"a1_232" = "1987975807"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Aas]
"a1_239" = "2305603294"
"a1_238" = "247112268"
"a2_210" = "1505512575"
"a2_211" = "1512680758"
"a2_212" = "1519861704"
"a2_213" = "1527028546"
"a2_214" = "1534183819"
"a2_215" = "1541361764"
"a2_216" = "1548527572"
"a2_217" = "1555695668"
"a2_218" = "1562861821"
"a2_219" = "1570030173"
"a1_966" = "4185437513"
"a2_508" = "3641911782"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_504" = "3613231567"
"a2_505" = "3620412025"
"a2_506" = "3627580363"
"a2_507" = "3634752748"
"a2_500" = "3584562446"
"a2_501" = "3591727351"
"a2_502" = "3598907255"
"a2_503" = "3606062177"
"a2_791" = "1375812550"
"a2_698" = "709078668"
"a2_699" = "716243476"
"a2_694" = "680395422"
"a2_695" = "687578458"
"a2_696" = "694746776"
"a2_697" = "701912598"
"a2_690" = "651727158"
"a2_691" = "658892808"
"a2_692" = "666061971"
"a2_693" = "673227898"
"a2_324" = "2322800479"
"a2_325" = "2329966952"
"a2_326" = "2337131101"
"a2_327" = "2344299374"
"a2_320" = "2294113254"
"a2_321" = "2301283873"
"a2_322" = "2308466271"
"a2_323" = "2315617832"
"a1_521" = "4154998587"
"a1_520" = "2416305939"
"a1_523" = "2378747291"
"a1_522" = "2555430044"
"a2_328" = "2351466243"
"a2_329" = "2358648222"
"a1_527" = "2251870707"
"a1_526" = "1364041855"
"a2_799" = "1433164820"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Aas]
"a2_798" = "1425982356"
"a4_962" = "2601727106"
"a1_98" = "912101749"
"a1_99" = "1294940661"
"a1_92" = "349526536"
"a1_93" = "1394749409"
"a1_90" = "1891469092"
"a1_91" = "45773323"
"a1_96" = "1142893348"
"a1_97" = "3312800135"
"a1_94" = "2909444900"
"a1_95" = "196413757"
"a1_74" = "2705637044"
"a1_75" = "2916885461"
"a1_76" = "586003609"
"a1_77" = "778492153"
"a1_70" = "779879387"
"a1_71" = "1618253490"
"a1_72" = "3154050064"
"a1_73" = "4066546870"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "726810716"
"a1_79" = "3443493554"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "579052213"
"a1_418" = "1711388463"
"a3_953" = "2520368944"
"a1_415" = "2180369295"
"a1_414" = "3609845889"
"a1_417" = "554236756"
"a1_416" = "1539077985"
"a1_411" = "883622913"
"a1_410" = "115325711"
"a1_413" = "2964702584"
"a1_412" = "2945086112"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "321832225"
"a1_700" = "1659642631"
"a1_703" = "2015464198"
"a1_702" = "1238511779"
"a1_705" = "3593067108"
"a1_704" = "959141147"
"a1_707" = "3909569452"
"a1_706" = "4237662780"
"a1_709" = "682361240"
"a1_708" = "2394127857"
"a2_360" = "2580885861"
"a4_838" = "1712756102"
"a2_361" = "2588061438"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595219965"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609552075"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616745338"
"a2_366" = "2623904963"
"a2_367" = "2631072260"
"a1_743" = "690298679"
"a2_168" = "1204404929"
"a2_169" = "1211585054"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a3_279" = "1983582110"
"a4_973" = "2680587437"
"a2_161" = "1154236116"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "1207603662"
"a3_776" = "1251683361"
"a1_893" = "2688615471"
"a1_892" = "1257582889"
"a1_895" = "751189163"
"a1_894" = "244479187"
"a1_897" = "1726457222"
"a3_777" = "1292288064"
"a1_899" = "105136424"
"a1_898" = "2509919988"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261952409"
"a1_617" = "1816816405"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "50325372"
"a2_459" = "3290618208"
"a3_678" = "548713167"
"a1_614" = "2847432733"
"a1_820" = "3968888770"
"a1_821" = "401118019"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Aas]
"a1_822" = "1272414664"

"a1_149" = "29037390"
"a1_148" = "471670861"
"a1_143" = "983945332"
"a1_142" = "2834666244"
"a1_141" = "3992598576"
"a1_140" = "2180223026"
"a1_147" = "2370850024"
"a1_146" = "2708738125"
"a1_145" = "882339242"
"a1_144" = "4019472875"
"a1_826" = "1036992663"
"a1_827" = "3552589061"
"a2_203" = "1455326420"
"a2_202" = "1448160528"
"a2_201" = "1440992889"
"a2_200" = "1433827441"
"a2_207" = "1483999468"
"a2_206" = "1476841758"
"a2_205" = "1469675585"
"a2_204" = "1462495779"
"a2_209" = "1498344866"
"a2_208" = "1491185243"
"a2_519" = "3720782807"
"a2_518" = "3713598317"
"a2_517" = "3706427044"
"a2_516" = "3699265057"
"a2_515" = "3692098171"
"a2_514" = "3684931981"
"a2_513" = "3677750694"
"a2_512" = "3670599171"
"a2_511" = "3663415045"
"a2_510" = "3656246619"
"a2_689" = "644562942"
"a2_688" = "637393032"
"a2_687" = "630226463"
"a2_686" = "623046441"
"a2_685" = "615878061"
"a2_684" = "608710189"
"a2_683" = "601543342"
"a2_682" = "594378513"
"a2_681" = "587207014"
"a2_680" = "580039905"
"a2_337" = "2416000588"
"a2_336" = "2408819258"
"a2_335" = "2401648720"
"a2_334" = "2394478543"
"a2_333" = "2387316316"
"a2_332" = "2380138502"
"a2_331" = "2372983809"
"a2_330" = "2365800713"
"a1_554" = "4031425104"
"a1_555" = "1698498578"
"a1_556" = "2861098768"
"a1_557" = "2164135600"
"a3_242" = "1718323611"
"a1_551" = "1678151561"
"a2_339" = "2430323129"
"a2_338" = "2423166113"
"a4_673" = "529851137"
"a1_918" = "1123228085"
"a1_919" = "2867921663"
"a3_243" = "1725243962"
"a1_852" = "237446941"
"a1_914" = "3459866953"
"a1_398" = "1523665848"
"a1_399" = "2094650216"
"a4_679" = "572865863"
"a1_392" = "2307672372"
"a1_393" = "1888171184"
"a1_390" = "609470111"
"a1_391" = "3797554814"
"a1_396" = "1056561746"
"a1_397" = "1106541476"
"a1_394" = "1586737012"
"a1_395" = "2492381206"
"a1_858" = "1745999822"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "2767232235"
"a1_48" = "3882507113"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "306999407"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "4073519669"
"a1_775" = "695504115"
"a1_776" = "3435740016"
"a1_777" = "4009788208"
"a1_191" = "3552991125"
"a1_771" = "3785988987"
"a1_772" = "1111807434"
"a1_773" = "834166987"
"a1_953" = "2485035852"
"a3_927" = "2367492374"
"a1_778" = "3800000423"
"a1_779" = "1345613551"
"a3_926" = "2326953207"
"a2_17" = "121877862"
"a2_16" = "114710827"
"a2_15" = "107542335"
"a2_14" = "100363250"
"a2_13" = "93193275"
"a2_12" = "86027344"
"a2_11" = "78869254"
"a2_10" = "71692661"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "1779819787"
"a2_19" = "136210630"
"a2_18" = "129046645"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "641591917"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "2782872778"
"a1_596" = "1656121629"
"a1_597" = "4071300104"
"a1_608" = "2029719518"
"a1_609" = "2019726764"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "689925315"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "229419654"
"a3_484" = "3486690637"
"a1_952" = "3794368368"
"a2_925" = "2336466090"
"a1_954" = "2749583040"
"a1_955" = "1767986857"
"a1_956" = "563585633"
"a3_485" = "3460055532"
"a1_958" = "874255917"
"a2_922" = "2314965157"
"a1_750" = "2243958423"
"a1_751" = "3137363930"
"a1_756" = "1957542189"
"a1_757" = "1164913387"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "2026911932"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "919282982"
"a4_903" = "2178748967"
"a1_188" = "2452082001"
"a4_900" = "2157241604"
"a1_187" = "2879860372"
"a4_901" = "2164410725"
"a1_186" = "1083904200"
"a2_929" = "2365149746"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "2786767918"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "1605072226"
"a1_558" = "763881015"
"a1_559" = "714817972"
"a1_606" = "4294900672"
"a3_925" = "2319505492"
"a1_178" = "2597114828"
"a1_179" = "108989342"
"a1_176" = "1096841446"
"a1_177" = "3064443053"
"a1_174" = "3912626986"
"a1_175" = "2644986132"
"a1_172" = "2114518869"
"a1_173" = "871798835"
"a1_170" = "2703951318"
"a1_171" = "2618883447"
"a1_550" = "4061667391"
"a2_236" = "1691914819"
"a2_237" = "1699084241"
"a2_234" = "1677580685"
"a2_235" = "1684749277"
"a2_232" = "1663227826"
"a2_233" = "1670398620"
"a2_230" = "1648900150"
"a2_231" = "1656063127"
"a1_553" = "2574213336"
"a2_238" = "1706247505"
"a2_239" = "1713410885"
"a2_522" = "3742284541"
"a2_523" = "3749447691"
"a2_520" = "3727947653"
"a2_521" = "3735114174"
"a2_526" = "3770951330"
"a2_527" = "3778131340"
"a2_524" = "3756610909"
"a2_525" = "3763785510"
"a2_838" = "1712764587"
"a2_839" = "1719918064"
"a2_528" = "3785299781"
"a2_529" = "3792466388"
"a3_688" = "620670617"
"a1_626" = "1368579320"
"a1_541" = "1559993000"
"a1_627" = "123251369"
"a1_624" = "2551796430"
"a1_549" = "2380962741"
"a1_548" = "1084823753"
"a1_547" = "1450125556"
"a1_546" = "3118788702"
"a1_545" = "3834770388"
"a1_544" = "311112822"
"a1_543" = "1754567658"
"a1_542" = "1756464597"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a1_540" = "3512102837"
"a2_658" = "422319701"
"a2_659" = "429488397"
"a2_308" = "2208095292"
"a2_309" = "2215250164"
"a2_302" = "2165079829"
"a2_303" = "2172251384"
"a2_300" = "2150742723"
"a2_301" = "2157910450"
"a2_306" = "2193742047"
"a2_307" = "2200928218"
"a2_304" = "2179410699"
"a2_305" = "2186579320"
"a2_786" = "1339959305"
"a2_787" = "1347128244"
"a2_784" = "1325626798"
"a2_785" = "1332794540"
"a2_782" = "1311293261"
"a2_783" = "1318462612"
"a2_780" = "1296944426"
"a2_781" = "1304109813"
"a2_788" = "1354291691"
"a2_789" = "1361464174"
"a1_389" = "3093162027"
"a1_388" = "1832181176"
"a1_385" = "1812276144"
"a1_384" = "1465773037"
"a1_387" = "428111864"
"a1_386" = "2504949531"
"a1_381" = "2087563891"
"a1_380" = "44326289"
"a1_383" = "3190492442"
"a1_382" = "3775943364"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Aas]
"a1_58" = "275986991"
"a1_59" = "1788717829"
"a1_56" = "4204613264"
"a1_57" = "3288152270"
"a1_54" = "4273674148"
"a1_55" = "3495093677"
"a1_52" = "313596130"
"a1_53" = "1801466665"
"a1_50" = "1308731706"
"a1_51" = "390918113"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "475298747"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a2_916" = "2271951995"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "3716559112"
"a1_764" = "643683113"

"a1_762" = "510142461"
"a1_761" = "1077202415"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257601473"
"a4_858" = "1856138522"
"a1_586" = "3700722261"
"a1_789" = "2259799102"
"a3_720" = "849951481"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "1328089437"
"a1_619" = "2031224533"
"a1_618" = "1699889937"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"

"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "857950011"
"a4_522" = "3742281162"
"a2_62" = "444488310"
"a4_523" = "3749450283"
"a2_63" = "451653384"
"a4_524" = "3756619404"
"a1_971" = "2648712066"
"a2_60" = "430155773"
"a4_525" = "3763788525"
"a1_943" = "1712121598"
"a1_942" = "2028349330"
"a1_941" = "390723208"
"a2_61" = "437307440"
"a1_947" = "3005121930"
"a4_526" = "3770957646"
"a1_945" = "1538657550"
"a1_944" = "263863564"
"a2_66" = "473168873"
"a1_949" = "618900427"
"a4_527" = "3778126767"
"a2_67" = "480337061"
"a2_64" = "458819027"
"a2_65" = "465986779"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "3318058007"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "2636385944"
"a1_41" = "3264452572"
"a1_40" = "3111120883"
"a1_43" = "1907532950"
"a3_819" = "1559971962"
"a1_42" = "750272212"
"a3_813" = "1516544548"
"a1_45" = "1518047315"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "2605895526"
"a1_47" = "872291218"
"a1_46" = "1434958100"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a1_783" = "2414964729"
"a3_757" = "1115339004"
"a1_959" = "3591306358"
"a2_907" = "2207430370"
"a1_161" = "2849728076"
"a1_160" = "876965737"
"a1_163" = "1131222356"
"a1_162" = "1853126929"
"a1_165" = "2205250557"
"a1_164" = "3801439637"
"a1_167" = "2631346698"
"a1_166" = "255094493"
"a1_169" = "1394997081"
"a1_168" = "3492356378"
"a3_727" = "933979486"
"a2_535" = "3835482941"
"a2_534" = "3828316155"
"a2_537" = "3849818888"
"a2_536" = "3842641726"
"a2_531" = "3806801880"
"a2_530" = "3799632439"
"a2_533" = "3821136666"
"a2_532" = "3813968996"
"a2_829" = "1648235519"
"a2_828" = "1641070389"
"a2_539" = "3864150660"
"a2_538" = "3856984720"
"a4_447" = "3204597087"
"a1_572" = "1169956337"
"a1_573" = "4138238515"
"a1_570" = "3369841982"
"a1_571" = "1080609794"
"a1_576" = "655867414"
"a1_577" = "441796381"
"a1_574" = "2120383016"
"a1_575" = "4240295567"
"a1_578" = "4101076059"
"a1_579" = "3200353581"
"a2_649" = "357786313"
"a2_648" = "350620423"
"a2_319" = "2286946621"
"a2_318" = "2279777885"
"a2_315" = "2258277564"
"a2_314" = "2251096108"
"a2_317" = "2272614132"
"a2_316" = "2265444395"
"a2_311" = "2229593718"
"a2_310" = "2222430445"
"a2_313" = "2243928197"
"a2_312" = "2236774315"
"a2_229" = "1641730468"
"a2_228" = "1634551221"
"a2_221" = "1584381146"
"a2_220" = "1577214900"
"a2_223" = "1598712180"
"a2_222" = "1591546446"
"a2_225" = "1613046582"
"a2_224" = "1605881147"
"a2_227" = "1627397402"
"a2_226" = "1620216389"
"a1_370" = "3662176879"
"a1_371" = "2805483461"
"a1_372" = "1394931418"
"a1_373" = "1845125870"
"a1_374" = "1557724936"
"a1_375" = "3240925017"
"a1_376" = "3408856262"
"a1_377" = "2169108116"
"a1_378" = "2395164948"
"a1_379" = "3820501985"
"a2_793" = "1390144630"
"a2_792" = "1382979383"
"a2_795" = "1404477538"
"a2_794" = "1397323767"
"a2_797" = "1418829706"
"a2_796" = "1411647290"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "390669480"
"a1_28" = "3728944565"
"a1_590" = "4041964247"
"a1_23" = "1807237385"
"a1_22" = "2705231736"
"a1_21" = "1149257862"
"a1_20" = "2257338338"
"a1_27" = "2459097974"
"a1_26" = "2915035876"
"a1_25" = "1063100174"
"a1_24" = "3060540112"
"a1_284" = "1472596932"
"a1_285" = "1269386886"
"a1_286" = "847787492"
"a1_287" = "875623797"
"a1_280" = "3815323279"
"a1_281" = "1640307239"
"a1_282" = "2412434419"
"a1_283" = "1854192484"
"a3_31" = "205278614"
"a1_288" = "1668491341"
"a1_289" = "2658207454"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746497"
"a1_591" = "120062266"
"a3_32" = "212854281"
"a2_972" = "2673426106"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "738874774"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "1763556140"
"a1_599" = "1918880335"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222248810"
"a2_30" = "215078269"
"a2_33" = "236580609"
"a2_32" = "229415886"
"a2_35" = "250913765"
"a2_34" = "243745145"
"a2_37" = "265265202"
"a2_36" = "258080782"
"a2_39" = "279598774"
"a2_38" = "272418653"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186758479"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193943374"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "3984217025"
"a1_625" = "2833212300"
"a1_622" = "1300569148"
"a1_623" = "2379153855"
"a1_620" = "1283151700"
"a1_621" = "12459835"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "214"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "1496052142"
"a2_588" = "4215446075"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222610939"
"a1_976" = "1011201377"
"a1_977" = "2955171694"
"a1_974" = "2383164092"
"a1_975" = "1028747732"
"a1_972" = "3364050977"
"a1_973" = "2399111703"
"a1_970" = "3552079300"
"a3_827" = "1616916338"
"a1_770" = "3299539687"
"a1_978" = "2905269594"
"a1_979" = "1481901111"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Aas]
"a4_199" = "1426655079"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Aas]
"a3_504" = "3596547281"
"a2_363" = "2602389293"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157247272"
"a1_746" = "2418866319"
"a4_827" = "1633895771"
"a2_901" = "2164416010"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171583079"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185915879"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193080565"
"a2_906" = "2200248403"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "1204588851"
"a1_115" = "859258829"
"a1_116" = "1305412024"
"a1_117" = "2010487296"
"a1_110" = "1951869617"
"a1_111" = "3512983633"
"a1_112" = "3447712449"
"a1_113" = "3456119454"
"a1_824" = "622026853"
"a1_118" = "2886972403"
"a1_119" = "3817081210"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570225975"
"a2_499" = "3577395142"
"a2_492" = "3527209911"
"a2_493" = "3534384918"
"a2_490" = "3512875573"
"a2_491" = "3520041016"
"a2_496" = "3555875671"
"a2_497" = "3563058326"
"a2_494" = "3541543669"
"a2_495" = "3548722248"
"a2_816" = "1555026955"
"a2_817" = "1562199871"
"a2_814" = "1540700929"
"a2_815" = "1547875080"
"a2_812" = "1526364726"
"a3_740" = "1026900557"
"a2_810" = "1512014647"
"a2_811" = "1519180417"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569368763"
"a2_819" = "1576549235"
"a1_565" = "1704621223"
"a1_564" = "2047476973"
"a1_567" = "2051875210"
"a1_566" = "2861863481"
"a1_561" = "4129318606"
"a1_560" = "4247908205"
"a1_563" = "4062783767"
"a1_562" = "2129168699"
"a1_569" = "2273142223"
"a1_568" = "545782631"
"a1_525" = "1859277219"
"a2_678" = "565693741"
"a2_679" = "572859612"
"a2_676" = "551357535"
"a2_677" = "558526247"
"a2_674" = "537033791"
"a2_675" = "544191686"
"a2_672" = "522674205"
"a2_673" = "529856866"
"a2_670" = "508342009"
"a2_671" = "515506958"
"a2_258" = "1849625154"
"a2_259" = "1856804572"
"a2_254" = "1820953975"
"a2_255" = "1828119896"
"a2_256" = "1835287515"
"a2_257" = "1842470595"
"a2_250" = "1792285235"
"a2_251" = "1799452479"
"a2_252" = "1806621040"
"a2_253" = "1813783610"
"a1_363" = "3929826981"
"a1_362" = "3578035727"
"a1_361" = "4210573468"
"a1_360" = "3645961045"
"a1_367" = "2426777954"
"a1_366" = "3533831270"
"a1_365" = "1317892889"
"a1_364" = "230736769"
"a1_369" = "690866568"
"a1_368" = "2587574465"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2178691764"
"a1_39" = "447252861"
"a1_30" = "3536387328"
"a1_31" = "2636143858"
"a1_32" = "935179328"
"a1_33" = "2733324719"
"a1_34" = "2914623787"
"a1_35" = "3357584710"
"a1_36" = "1218146794"
"a1_37" = "83921754"
"a1_297" = "3693348820"
"a1_296" = "3517983414"
"a1_295" = "3425448345"
"a1_294" = "4015660972"
"a1_293" = "2024312529"
"a1_292" = "3090340861"
"a1_291" = "3618564758"
"a1_290" = "1551468972"
"a1_299" = "132094622"
"a1_298" = "1280336319"
"a3_769" = "1234824520"
"a1_600" = "2771061380"
"a2_668" = "493997867"
"a1_601" = "1471073175"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "1551136375"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774273985"
"a2_109" = "781427894"
"a4_878" = "1999520942"
"a1_603" = "2387259717"
"a2_100" = "716908850"
"a2_101" = "724075904"
"a2_102" = "731243002"
"a2_103" = "738426224"
"a2_104" = "745591077"
"a2_105" = "752761984"
"a2_106" = "759924893"
"a2_107" = "767090960"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "385361062"
"a1_589" = "280689970"
"a1_588" = "1852276450"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "129223837"
"a1_748" = "504012496"
"a2_28" = "200726995"
"a2_29" = "207912618"
"a2_26" = "186389520"
"a2_27" = "193561395"
"a2_24" = "172062536"
"a2_25" = "179236010"
"a2_22" = "157725405"
"a2_23" = "164895072"
"a2_20" = "143377339"
"a2_21" = "150546298"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139224299"
"a2_7" = "50178323"
"a2_6" = "43008421"
"a2_5" = "35844089"
"a2_4" = "28674263"
"a2_3" = "21509312"
"a2_2" = "14341778"
"a2_1" = "7161776"
"a2_0" = "7639"
"a1_639" = "466938188"
"a1_638" = "3979106934"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64526842"
"a2_8" = "57357655"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124890951"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "733436201"
"a1_533" = "2719011500"
"a4_845" = "1762939949"
"a2_853" = "1820290138"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 54 C4 C3 74 B2 FA 02 5E 39 E2 90 A3 B5 76 63"

[HKCU\Software\Aas]
"a1_968" = "3042047134"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "1188180203"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "3962845314"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "544216694"
"a2_911" = "2236099208"
"a1_957" = "2250530795"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0A00687474703A2F2F696B686F7576616E6972616B657A656E2E6E6C2F6C6F676F2E67696600687474703A2F2F7777772E6E6F76656461646573323031332E756E6C756761722E636F6D2F6C6F676F2E67696600687474703A2F2F7777772E707573686B6172696E7465726E6174696F6E616C2E636F6D2F6C6F676F2E67696600687474703A2F2F6E67616F7363686F6F6C2E61632E74682F6C6F676F2E67696600687474703A2F2F7065646169737563686F612E636F6D2F6C6F676F732E67696600687474703A2F2F6D656E64657A6D6F72616C65732E636F6D2F6C6F676F2E67696600687474703A2F2F6C616E646D61726B67726F75702E636F6D2E61752F696D616765732F6C6F676F732F6C6F676F732E67696600687474703A2F2F647369676E2D73747564696F2E636F6D2F696D616765732F627574746F6E2E67696600687474703A2F2F62617272796D776172642E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E677265656E62656163682E64652F6C6F676F2E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014706639"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "1091427079"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "2206832109"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013860427"
"a1_107" = "3061453263"
"a1_106" = "2570608499"
"a1_105" = "258626583"
"a1_104" = "2450501033"
"a1_103" = "1081101517"
"a1_102" = "437249733"
"a1_101" = "3651025019"
"a1_100" = "2595379899"
"a3_134" = "943841519"
"a1_109" = "1271588414"
"a1_62" = "1771924906"
"a1_61" = "759482180"
"a3_137" = "998890944"
"a2_883" = "2035360786"
"a3_686" = "606179783"
"a2_489" = "3505693465"
"a2_488" = "3498525639"
"a3_687" = "613616230"
"a2_485" = "3477028297"
"a2_484" = "3469859429"
"a2_487" = "3491359021"
"a2_486" = "3484192079"
"a2_481" = "3448340534"
"a2_480" = "3441173443"
"a2_483" = "3462689160"
"a2_482" = "3455509312"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028205280"
"a3_976" = "2685262841"
"a2_809" = "1504849318"
"a2_808" = "1497691711"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447496904"
"a2_800" = "1440331266"
"a2_803" = "1461831129"
"a3_681" = "570649632"
"a2_805" = "1476181671"
"a2_804" = "1469011765"
"a2_807" = "1490515167"
"a2_806" = "1483347723"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049710946"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443812929"
"a2_660" = "436655251"
"a2_663" = "458156455"
"a3_146" = "1063277947"
"a2_665" = "472491582"
"a2_664" = "465325671"
"a2_667" = "486838951"
"a2_666" = "479671077"
"a2_669" = "501171223"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021026406"
"a3_143" = "1008236550"
"a2_249" = "1785117612"
"a2_248" = "1777935715"
"a2_247" = "1770766867"
"a2_246" = "1763595383"
"a2_245" = "1756432723"
"a2_244" = "1749256376"
"a2_243" = "1742099960"
"a2_242" = "1734931723"
"a2_241" = "1727751753"
"a2_240" = "1720582967"
"a1_356" = "304444453"
"a1_357" = "1838665756"
"a1_354" = "1177810036"
"a1_355" = "434206941"
"a1_352" = "4171430866"
"a1_353" = "814559228"
"a1_350" = "1064656329"
"a1_351" = "1304529707"
"a2_855" = "1834624776"
"a3_639" = "269411382"
"a1_358" = "4210336879"
"a1_359" = "3329223448"
"a3_638" = "295912343"
"a2_887" = "2064046676"
"a2_886" = "2056878834"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583716767"
"a2_119" = "853117844"
"a2_118" = "845961661"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810112058"
"a2_112" = "802933085"
"a2_111" = "795777856"
"a2_110" = "788608196"
"a2_117" = "838792890"
"a2_116" = "831611332"
"a2_115" = "824445942"
"a2_114" = "817276036"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533530413"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422985448"
"a2_58" = "415802725"
"a2_53" = "379969335"
"a2_52" = "372786111"
"a2_51" = "365617524"
"a2_50" = "358463858"
"a2_57" = "408636642"
"a2_56" = "401465375"
"a2_55" = "394300441"
"a2_54" = "387124897"
"a4_842" = "1741432586"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "919255097"
"a1_645" = "170736300"
"a1_646" = "2859611002"
"a1_647" = "1102693502"
"a1_640" = "1576510940"
"a1_641" = "832353117"
"a1_642" = "904928795"
"a1_643" = "974469661"
"a1_648" = "2000575542"
"a1_649" = "1367805876"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas]
"a2_953" = "2537195731"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "757431822"
"a1_829" = "3315653844"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "2207402094"
"a1_916" = "3138476105"
"a1_917" = "2481104731"
"a1_910" = "1843055218"
"a1_911" = "267246937"
"a1_912" = "254683342"
"a1_913" = "4133484580"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "2794327285"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "3016346935"
"a1_139" = "2946398182"
"a3_907" = "2190592386"
"a1_132" = "743388088"
"a1_133" = "2817992826"
"a1_130" = "3907838974"
"a1_131" = "2116582609"
"a1_136" = "1725491766"
"a1_137" = "3538535604"
"a1_134" = "2507850891"
"a1_135" = "2943864446"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369490364"
"a2_471" = "3376658852"
"a2_472" = "3383822637"
"a2_473" = "3390986072"
"a2_474" = "3398157037"
"a2_475" = "3405325545"
"a2_476" = "3412507755"
"a2_477" = "3419672680"
"a2_478" = "3426840777"
"a2_479" = "3434007245"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "3342890410"
"a2_878" = "1999529855"
"a2_879" = "2006694417"
"a2_874" = "1970843264"
"a2_875" = "1978011316"
"a2_876" = "1985207291"
"a2_877" = "1992357386"
"a2_870" = "1942174191"
"a2_871" = "1949343008"
"a2_872" = "1956508561"
"a2_873" = "1963679049"
"a1_349" = "2577191443"
"a1_348" = "3875067037"
"a2_586" = "4201109733"
"a2_587" = "4208276539"
"a2_580" = "4158094953"
"a2_581" = "4165258624"
"a2_582" = "4172425867"
"a2_583" = "4179594652"
"a1_341" = "2983315849"
"a1_340" = "3463134895"
"a1_343" = "3872788138"
"a1_342" = "2218668239"
"a1_345" = "1188774085"
"a1_344" = "1245525732"
"a1_347" = "3044752981"
"a1_346" = "3769030982"
"a2_614" = "106879622"
"a2_615" = "114047048"
"a2_616" = "121220258"
"a2_617" = "128382229"
"a2_610" = "78197975"
"a2_611" = "85373738"
"a2_612" = "92528656"
"a2_613" = "99697552"
"a2_618" = "135547889"
"a2_619" = "142713654"
"a2_272" = "1950003801"
"a2_273" = "1957173454"
"a2_270" = "1935670945"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978671743"
"a2_277" = "1985841848"
"a2_274" = "1964340757"
"a2_275" = "1971506732"
"a2_908" = "2214600459"
"a2_909" = "2221765549"
"a2_278" = "1993023088"
"a2_279" = "2000190228"
"a1_842" = "3239597919"
"a2_298" = "2136392048"
"a2_299" = "2143561305"
"a1_841" = "2619390204"
"a2_290" = "2079039624"
"a2_291" = "2086209062"
"a2_292" = "2093377407"
"a2_293" = "2100557936"
"a2_294" = "2107729171"
"a2_295" = "2114893258"
"a2_296" = "2122058959"
"a2_297" = "2129227498"
"a2_728" = "924151095"
"a2_729" = "931317230"
"a2_720" = "866797750"
"a2_721" = "873965967"
"a2_722" = "881132135"
"a2_723" = "888300451"
"a2_724" = "895482504"
"a2_725" = "902650834"
"a2_726" = "909805767"
"a2_727" = "916984588"
"a1_594" = "499217059"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917646179"
"a2_129" = "924814132"
"a2_126" = "903300453"
"a2_127" = "910481680"
"a2_124" = "888965086"
"a2_125" = "896143626"
"a2_122" = "874640873"
"a2_123" = "881798585"
"a2_120" = "860302493"
"a2_121" = "867462259"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612386262"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "267117368"
"a1_13" = "3569431491"
"a1_10" = "2231964582"
"a1_11" = "4005100951"
"a1_16" = "3065968206"
"a1_17" = "1394929738"
"a1_14" = "3206061176"
"a1_15" = "482705656"
"a1_18" = "1468002414"
"a1_19" = "1186779557"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563919"
"a2_48" = "344115543"
"a2_49" = "351279056"
"a1_846" = "58587611"
"a2_40" = "286765770"
"a2_41" = "293932420"
"a2_42" = "301099601"
"a2_43" = "308265588"
"a2_44" = "315448861"
"a2_45" = "322615586"
"a2_46" = "329782891"
"a2_47" = "336950466"
"a2_897" = "2135728218"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "2591158188"
"a1_656" = "1027425348"
"a1_655" = "1758626961"
"a1_632" = "2417557565"
"a1_653" = "1151433267"
"a1_652" = "946202945"
"a1_651" = "3976719325"
"a1_650" = "449513974"
"a3_796" = "1428649909"
"a1_659" = "3401311741"
"a1_658" = "397993993"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086305"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Aas]
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "585422229"
"a1_838" = "449895739"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "2418168343"
"a1_906" = "711243027"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "4256172443"
"a1_902" = "3820510483"
"a1_901" = "3037619834"
"a1_900" = "3615253688"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "4138069798"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "600296359"
"a2_644" = "321952131"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "1753413181"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "3676581678"
"a1_879" = "3727830614"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "3757503420"
"a1_128" = "1167423065"
"a1_125" = "4056149729"
"a1_124" = "1212936914"
"a1_127" = "3623440942"
"a1_126" = "3543607925"
"a1_121" = "3348584832"
"a1_120" = "207370276"
"a1_123" = "860731598"
"a1_122" = "1838544123"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "1364181275"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "140435403"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "2671516451"
"a4_793" = "1390145657"
"a1_836" = "1463688071"
"a1_835" = "2124659370"
"a1_754" = "2697534147"
"a1_834" = "1160976319"
"a1_634" = "708209761"
"a2_463" = "3319304405"
"a2_462" = "3312124612"
"a2_461" = "3304972672"
"a2_460" = "3297788279"
"a2_467" = "3347973257"
"a2_466" = "3340805445"
"a2_465" = "3333636602"
"a2_464" = "3326472345"
"a2_469" = "3362324054"
"a2_468" = "3355155272"
"a1_934" = "160547512"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934993110"
"a2_868" = "1927825043"
"a2_867" = "1920657469"
"a2_866" = "1913500400"
"a2_865" = "1906326737"
"a2_864" = "1899158407"
"a2_863" = "1891989904"
"a1_791" = "2749035781"
"a2_861" = "1877642259"
"a2_860" = "1870471335"
"a2_597" = "4279963050"
"a2_596" = "4272794768"
"a2_595" = "4265630459"
"a2_594" = "4258460749"
"a1_338" = "2607777839"
"a1_339" = "1745917857"
"a2_591" = "4236941784"
"a2_590" = "4229778791"
"a1_334" = "868025918"
"a1_335" = "1437299894"
"a1_336" = "1605796110"
"a1_337" = "2522630836"
"a1_330" = "2016123230"
"a1_331" = "789151963"
"a1_332" = "2205354271"
"a1_333" = "545328755"
"a2_607" = "56694920"
"a2_606" = "49512657"
"a3_30" = "231909751"
"a2_604" = "35177395"
"a1_64" = "1592635935"
"a2_602" = "20844976"
"a2_601" = "13678871"
"a2_600" = "6513605"
"a4_875" = "1978013579"
"a2_609" = "71035782"
"a2_608" = "63850273"
"a2_265" = "1899819238"
"a2_264" = "1892654775"
"a2_267" = "1914152001"
"a2_266" = "1906990077"
"a2_261" = "1871138500"
"a2_260" = "1863967851"
"a2_263" = "1885471593"
"a2_262" = "1878305953"
"a2_919" = "2293463781"
"a1_908" = "934236977"
"a2_269" = "1928488357"
"a2_268" = "1921319142"
"a1_905" = "1185779121"
"a2_884" = "2042529475"
"a1_482" = "3280492760"
"a1_483" = "430655178"
"a2_289" = "2071873484"
"a2_288" = "2064709439"
"a1_486" = "2681634708"
"a1_487" = "3201759984"
"a1_484" = "1590340617"
"a1_485" = "123158160"
"a2_283" = "2028855380"
"a2_282" = "2021688825"
"a2_281" = "2014525338"
"a2_280" = "2007359443"
"a2_287" = "2057545752"
"a2_286" = "2050375064"
"a2_285" = "2043192107"
"a2_284" = "2036038056"
"a2_739" = "1003018835"
"a2_738" = "995835909"
"a3_522" = "3725445091"
"a2_733" = "960000527"
"a2_732" = "952835248"
"a2_731" = "945667230"
"a2_730" = "938486441"
"a2_737" = "988669951"
"a2_736" = "981503436"
"a2_735" = "974334048"
"a2_734" = "967168429"
"a4_446" = "3197427966"
"a1_637" = "1074320358"
"a3_912" = "2226582457"
"a1_240" = "1185756841"
"a1_241" = "3680686829"
"a1_242" = "2706135773"
"a1_243" = "2138988874"
"a1_244" = "3884834601"
"a1_245" = "563655711"
"a1_246" = "594473326"
"a1_247" = "4201589193"
"a1_248" = "2896554966"
"a1_249" = "3218480738"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939149826"
"a2_130" = "931982376"
"a2_133" = "953495954"
"a2_132" = "946331273"
"a2_135" = "967833655"
"a2_134" = "960665977"
"a2_137" = "982166027"
"a2_136" = "974998969"
"a2_139" = "996513672"
"a2_138" = "989332281"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566355938"
"a2_78" = "559188813"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "3085882402"
"a1_583" = "3843744434"
"a1_794" = "282526085"
"a1_795" = "2288179573"
"a1_792" = "1645725352"
"a1_793" = "4244225588"
"a1_790" = "565076558"
"a1_582" = "1313135431"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "2044347006"
"a1_798" = "1563544833"
"a1_799" = "147319247"
"a1_580" = "587506298"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a1_585" = "2275747070"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "2868291044"
"a1_469" = "3026562053"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "3538101787"
"a1_461" = "2896710051"
"a1_462" = "652053856"
"a1_463" = "3623250094"
"a1_464" = "2998624622"
"a1_465" = "3407329404"
"a1_466" = "4188106287"
"a1_467" = "3461184701"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "1397694882"
"a1_669" = "3870222434"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655395135"
"a3_499" = "3560555322"
"a2_831" = "1662568591"
"a3_498" = "3587059355"
"a2_832" = "1669736339"
"a3_497" = "3579611768"
"a2_833" = "1676904698"
"a3_496" = "3539014105"
"a2_834" = "1684086367"
"a3_495" = "3532029350"
"a2_835" = "1691254123"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698418995"
"a3_493" = "3551077604"
"a2_837" = "1705586441"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a1_837" = "2508881563"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a3_869" = "1918293868"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "1234499540"
"a1_807" = "1639975056"
"a1_804" = "2527314154"
"a1_805" = "4183478215"
"a1_802" = "4125604307"
"a1_803" = "4231600179"
"a1_800" = "1771601934"

"a1_808" = "3694903573"
"a1_809" = "2878916405"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "488662329"
"a1_939" = "3332204875"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407971731"
"a1_875" = "1034565909"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "1775658096"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "1681521553"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269122648"
"a2_457" = "3276281318"
"a2_454" = "3254786215"
"a3_380" = "2741212629"
"a2_452" = "3240435879"
"a2_453" = "3247604136"
"a2_450" = "3226102801"
"a2_451" = "3233271247"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283454081"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "3585577025"
"a2_852" = "1813120323"
"a1_730" = "4206272223"
"a2_850" = "1798787132"
"a2_851" = "1805957097"
"a2_856" = "1841803783"
"a2_857" = "1848978093"
"a2_854" = "1827456411"
"a1_731" = "2695400866"
"a3_632" = "252486993"
"a2_858" = "1856142218"
"a2_859" = "1863305307"
"a1_732" = "1604987653"
"a2_714" = "823782357"
"a1_733" = "3917018595"
"a1_329" = "3203318908"
"a1_328" = "1680371188"
"a1_327" = "138115417"
"a1_326" = "3121425909"
"a1_325" = "516658964"
"a1_324" = "1486390753"
"a1_323" = "1107315924"
"a1_322" = "4094110797"
"a1_321" = "2102174310"
"a1_320" = "3961867550"
"a2_650" = "364954665"
"a1_436" = "107927917"
"a1_736" = "2633780318"
"a3_631" = "211878206"
"a1_737" = "3168421375"
"a2_652" = "379305827"
"a3_923" = "2339079058"
"a2_926" = "2343635721"
"a2_927" = "2350801539"
"a2_924" = "2329303283"
"a2_653" = "386473226"
"a4_887" = "2064043031"
"a2_923" = "2322134389"
"a2_920" = "2300619250"
"a2_921" = "2307799756"
"a2_654" = "393628899"
"a2_928" = "2357969392"
"a2_655" = "400815874"
"a3_630" = "204893343"
"a2_657" = "415140639"
"a3_922" = "2298015603"
"a1_495" = "434811738"
"a1_494" = "3386434674"
"a1_497" = "3732474599"
"a1_496" = "3472493376"
"a1_491" = "2922711086"
"a1_490" = "951928316"
"a1_493" = "1521011718"
"a1_492" = "708654247"
"a1_499" = "415448893"
"a1_498" = "3224440320"
"a3_637" = "288468852"
"a2_708" = "780764123"
"a2_709" = "787945790"
"a2_706" = "766430674"
"a2_707" = "773595566"
"a2_704" = "752096090"
"a2_705" = "759264450"
"a2_702" = "737761209"
"a2_703" = "744930853"
"a2_700" = "723412313"
"a2_701" = "730579154"
"a4_885" = "2049704789"
"a2_638" = "278924658"
"a2_639" = "286102107"
"a3_808" = "1481095169"
"a2_632" = "235919487"
"a2_633" = "243083843"
"a2_630" = "221585391"
"a2_631" = "228750430"
"a2_636" = "264598787"
"a2_637" = "271769393"
"a2_634" = "250264349"
"a2_635" = "257418372"
"a1_253" = "999514099"
"a1_252" = "3627056930"
"a1_251" = "4012812185"
"a1_250" = "897477268"
"a1_257" = "1083454685"
"a1_256" = "217354672"
"a1_255" = "433481425"
"a1_254" = "2402700140"
"a3_920" = "2284050097"
"a1_259" = "3371642988"
"a1_258" = "2342190747"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032345021"
"a2_145" = "1039519110"
"a2_146" = "1046685298"
"a2_147" = "1053866980"
"a2_140" = "1003682836"
"a2_141" = "1010848715"
"a2_142" = "1018016882"
"a2_143" = "1025182786"
"a1_781" = "700724712"
"a1_780" = "3281507663"
"a2_68" = "487505535"
"a2_69" = "494672202"
"a2_148" = "1061031993"
"a2_149" = "1068203834"
"a1_787" = "3078444386"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a1_904" = "2406594199"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "3295438867"
"a1_478" = "1311839648"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "3444812423"
"a1_472" = "431188357"
"a1_471" = "2715824168"
"a1_470" = "4036807757"
"a1_477" = "3478614785"
"a1_476" = "2739151890"
"a1_475" = "1114104480"
"a1_474" = "3587567775"
"a4_533" = "3821141493"
"a1_679" = "1162431514"
"a1_678" = "4082995542"
"a4_532" = "3813972372"
"a1_675" = "982219120"
"a1_674" = "1205695079"
"a1_677" = "281435339"
"a1_676" = "810836601"
"a1_671" = "1837742688"
"a4_531" = "3806803251"
"a1_673" = "2330041675"
"a1_672" = "1375000575"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a1_868" = "213451487"
"a4_535" = "3835479735"
"a3_980" = "2747738493"
"a4_534" = "3828310614"
"a2_151" = "1082534714"
"a2_150" = "1075366513"
"a1_869" = "1196530427"
"a2_271" = "1942838923"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "64917646"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139888108"
"a4_758" = "1139226422"
"a2_158" = "1132712525"
"a1_925" = "896369197"
"a1_924" = "3995923742"
"a1_927" = "1549250074"
"a1_926" = "2166775392"
"a1_921" = "2697633975"
"a1_920" = "128572149"
"a3_787" = "1363737626"
"a1_922" = "291893781"
"a3_80" = "590099577"
"a1_929" = "536420911"
"a1_928" = "925315717"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "1280363399"
"a1_818" = "1708692395"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "2183476169"
"a1_810" = "2215710643"
"a1_813" = "3400594067"
"a1_812" = "2719849317"
"a1_815" = "466600567"
"a1_814" = "1341341918"
"a1_817" = "319021351"
"a1_816" = "231062251"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454665653"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"

[HKCU\Software\Aas\695404737]
"50183847" = "38AC3BD32A37CB1E794E8CFABEEE28D872DF56445AE379304E9A3E6096C4F2440E36F058B7722A2403413887ED38CBE6100C4234F16B51D6B1B859E5DBAC9FBDAD8EB7A4872261631C4516E99ECAFEB5BFB9093B9BED484FE41D3FF7CCD4D496A5DFDC679F97617320B671F86B99C7448380C05CE71495D9FAB4B0F113CCC271"

[HKCU\Software\Aas]
"a2_845" = "1762937338"
"a2_844" = "1755773179"
"a2_847" = "1777272246"
"a2_846" = "1770104590"
"a2_841" = "1734268270"
"a2_840" = "1727087212"
"a2_843" = "1748604463"
"a2_842" = "1741423065"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791608272"
"a2_848" = "1784453756"
"a1_312" = "2257464437"
"a1_313" = "2562628136"
"a1_310" = "565341130"
"a1_311" = "1241515113"
"a1_316" = "4043792143"
"a1_317" = "4281334179"
"a1_314" = "743139284"
"a1_315" = "760684293"
"a3_620" = "166490309"
"a1_318" = "2172447659"
"a1_319" = "1124230753"
"a4_929" = "2365146113"
"a2_449" = "3218936708"
"a2_448" = "3211768556"
"a3_621" = "140449124"
"a2_441" = "3161583866"
"a2_440" = "3154418849"
"a2_443" = "3175919282"
"a2_442" = "3168752301"
"a2_445" = "3190252226"
"a2_444" = "3183083904"
"a2_447" = "3204601465"
"a2_446" = "3197435566"
"a2_939" = "2436840768"
"a2_938" = "2429671246"
"a4_893" = "2107057757"
"a2_931" = "2379485309"
"a2_930" = "2372318770"
"a2_933" = "2393820084"
"a2_932" = "2386653096"
"a2_935" = "2408154920"
"a2_934" = "2400985801"
"a2_937" = "2422504306"
"a2_936" = "2415336982"
"a3_818" = "1552537563"
"a2_711" = "802280088"
"a2_710" = "795114448"
"a2_713" = "816614116"
"a2_712" = "809438527"
"a2_715" = "830951297"
"a1_510" = "2482554720"
"a2_717" = "845298868"
"a2_716" = "838115995"
"a2_719" = "859633408"
"a2_718" = "852467232"
"a1_587" = "423467729"
"a3_623" = "187965990"
"a2_629" = "214401159"
"a2_628" = "207231038"
"a2_625" = "185732081"
"a2_624" = "178566316"
"a2_627" = "200066105"
"a2_626" = "192899279"
"a2_621" = "157049310"
"a2_620" = "149881283"
"a2_623" = "171398751"
"a2_622" = "164231017"
"a1_266" = "1271858554"
"a1_267" = "3410477943"
"a1_264" = "490997172"
"a1_265" = "149831990"
"a1_262" = "3124606973"
"a1_263" = "3258324152"
"a1_260" = "3551156189"
"a1_261" = "593405627"
"a3_363" = "2585673634"
"a1_268" = "3505516592"
"a1_269" = "1992518478"
"a2_157" = "1125558967"
"a2_156" = "1118385918"
"a2_155" = "1111219905"
"a2_154" = "1104050253"
"a2_153" = "1096868726"
"a2_152" = "1089714681"
"a2_99" = "709742368"
"a2_98" = "702564584"
"a2_97" = "695407979"
"a2_96" = "688226730"
"a2_95" = "681059405"
"a2_94" = "673905663"
"a2_93" = "666718967"
"a2_92" = "659558073"
"a2_91" = "652390664"
"a2_90" = "645222717"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "2183435524"
"a1_847" = "3483446843"
"a3_404" = "2913010493"
"a1_844" = "3127387762"
"a3_405" = "2886510428"
"a1_845" = "4007510167"
"a2_862" = "1884808060"
"a1_961" = "1655195720"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "2264434612"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "1414301536"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "160316292"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "1030931350"
"a1_449" = "1132606111"
"a1_446" = "3033162048"
"a3_408" = "2941554865"
"a1_444" = "3755102604"
"a1_445" = "3102865347"
"a1_442" = "1586278852"
"a1_443" = "1980336005"
"a1_440" = "1566437866"
"a3_409" = "2949002448"
"a1_680" = "2858392374"
"a1_681" = "1237609567"
"a1_682" = "3255411668"
"a1_683" = "526393564"
"a2_561" = "4021869542"
"a1_685" = "1432111923"
"a1_686" = "862320025"
"a1_687" = "2783093300"
"a1_688" = "2821963237"
"a1_689" = "487810223"

"a3_834" = "1700949547"
"a1_767" = "1923531472"
"a1_766" = "2614266145"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294296964"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "4001457830"
"a2_605" = "42342816"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "3797738865"
"a2_603" = "28010821"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "1279283707"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "1419836984"
"a1_441" = "628804160"
"a4_964" = "2616065348"
"a1_744" = "2685236526"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250432681"
"a1_747" = "3201114293"
"a2_912" = "2243278851"

"a2_651" = "372136900"
"a2_910" = "2228930900"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "394"

[HKCU\Software\Aas]
"a2_917" = "2279117340"
"a4_883" = "2035366547"
"a2_509" = "3649090613"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "3408775320"
"a1_867" = "3246827577"
"a1_860" = "2343180931"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Aas]
"a1_862" = "1543973975"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "1671209884"
"a2_918" = "2286284403"
"a4_168" = "1204412328"
"a1_194" = "2769467869"
"a1_195" = "3096637118"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287128395"
"a1_192" = "4224219654"
"a1_193" = "1542341877"
"a1_969" = "4055564076"
"a4_934" = "2400991718"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "3298729224"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a3_505" = "3603458416"
"a1_305" = "2081862191"
"a1_304" = "968919647"
"a1_307" = "3232126294"
"a1_306" = "2804912782"
"a1_301" = "1723803925"
"a1_300" = "602928589"
"a1_303" = "4221300417"
"a1_302" = "374812757"
"a3_792" = "1399711281"
"a1_309" = "1188767403"
"a1_308" = "159013382"
"a2_540" = "3871320871"
"a2_541" = "3878501266"
"a2_542" = "3885670361"
"a1_481" = "2780843544"
"a2_544" = "3900004791"
"a2_545" = "3907187808"
"a2_546" = "3914337616"
"a2_547" = "3921503172"
"a2_548" = "3928671893"
"a2_549" = "3935852930"
"a2_894" = "2114231689"
"a2_895" = "2121387058"
"a2_892" = "2099896509"
"a2_893" = "2107060570"
"a2_890" = "2085544913"
"a2_891" = "2092713420"
"a2_438" = "3140066005"
"a2_439" = "3147251238"
"a2_434" = "3111402141"
"a2_435" = "3118576921"
"a2_436" = "3125731481"
"a2_437" = "3132901046"
"a2_430" = "3082715481"
"a2_431" = "3089885480"
"a2_432" = "3097065750"
"a2_433" = "3104231462"
"a2_948" = "2501357548"
"a2_949" = "2508522067"
"a4_908" = "2214594572"
"a2_944" = "2472689619"
"a2_945" = "2479860935"
"a2_946" = "2487023461"
"a2_947" = "2494189390"
"a2_940" = "2444001767"
"a1_488" = "2563326385"
"a2_942" = "2458337982"
"a2_943" = "2465521678"
"a1_279" = "2743808452"
"a1_278" = "585824107"
"a1_489" = "916951824"
"a1_271" = "2280205305"
"a1_270" = "710257682"
"a1_273" = "173815343"
"a1_272" = "4011056453"
"a1_275" = "1613180276"
"a1_274" = "1045448860"
"a1_277" = "7162587"
"a1_276" = "2263271080"
"a2_764" = "1182239961"
"a2_765" = "1189406866"
"a2_766" = "1196573084"
"a2_767" = "1203741686"
"a2_760" = "1153556856"
"a2_761" = "1160738913"
"a2_762" = "1167908165"
"a2_763" = "1175073934"
"a2_768" = "1210923609"
"a2_769" = "1218089398"
"a2_382" = "2738606567"
"a2_383" = "2745765738"
"a2_380" = "2724260285"
"a2_381" = "2731440436"
"a2_386" = "2767274341"
"a2_387" = "2774445001"
"a2_384" = "2752940092"
"a2_385" = "2760103023"
"a2_388" = "2781624860"
"a2_389" = "2788790454"
"a1_613" = "2845324828"
"a1_612" = "3652740351"
"a1_611" = "2759360173"
"a2_368" = "2638238442"
"a2_369" = "2645397366"
"a1_610" = "3362367977"
"a2_88" = "630891666"
"a2_89" = "638042227"
"a2_84" = "602208325"
"a2_85" = "609373226"
"a2_86" = "616536903"
"a2_87" = "623706894"
"a2_80" = "573523129"
"a2_81" = "580703649"
"a2_82" = "587873395"
"a2_83" = "595044399"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161402897"
"a2_163" = "1168568572"
"a2_160" = "1147052407"
"a3_278" = "2009623423"
"a2_166" = "1190068560"
"a2_167" = "1197238260"
"a2_164" = "1175737231"
"a2_165" = "1182898158"
"a3_690" = "668723035"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "767349761"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "3932504469"
"a1_450" = "3910274005"
"a1_453" = "3888314763"
"a1_452" = "1130941176"
"a1_455" = "221688666"
"a1_454" = "3966907688"
"a1_457" = "469320564"
"a1_456" = "3063653527"
"a1_459" = "649479329"
"a1_458" = "768554203"
"a1_693" = "1644619357"
"a1_692" = "814183033"
"a1_691" = "1603442304"
"a1_690" = "2052895426"
"a1_697" = "422849448"
"a1_696" = "307566293"
"a1_695" = "1949026188"
"a1_694" = "1612831704"
"a1_699" = "2421278482"
"a1_698" = "1071200040"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "2883221981"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "2834758872"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "1016539884"
"a4_387" = "2774449827"
"a1_940" = "1686004464"
"a1_752" = "3327922762"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537676216"
"a2_74" = "530523943"
"a1_763" = "482213551"
"a2_77" = "552020113"
"a2_76" = "544854221"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509003825"
"a2_70" = "501835257"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523340483"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "4109344508"
"a1_876" = "203988914"
"a4_759" = "1146395543"
"a2_72" = "516168315"
"a1_873" = "1826136734"
"a1_872" = "3240059981"
"a1_871" = "3092407074"
"a1_870" = "2400388007"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "1654974740"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "2429323164"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Aas]
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "1773306799"
"a1_437" = "3471592749"
"a3_960" = "2604335593"
"a2_553" = "3964518627"
"a2_552" = "3957353727"
"a2_551" = "3950188456"
"a2_550" = "3943008363"
"a2_557" = "3993205211"
"a2_556" = "3986035806"
"a2_555" = "3978870337"
"a2_554" = "3971688378"
"a2_889" = "2078379150"
"a2_888" = "2071210466"
"a2_559" = "4007540076"
"a2_558" = "4000373765"
"a4_980" = "2730771284"
"a2_429" = "3075576844"
"a2_428" = "3068381219"
"a2_427" = "3061216188"
"a2_426" = "3054048557"
"a2_425" = "3046879429"
"a2_424" = "3039714573"
"a2_423" = "3032533579"
"a2_422" = "3025366833"
"a2_421" = "3018196066"
"a2_420" = "3011031369"
"a1_758" = "2107391998"
"a2_565" = "4050556396"
"a2_959" = "2580224460"
"a2_958" = "2573044928"
"a2_957" = "2565874424"
"a2_956" = "2558709590"
"a2_955" = "2551540493"
"a2_954" = "2544371342"
"a1_785" = "470565817"
"a2_952" = "2530039249"
"a2_951" = "2522872592"
"a2_950" = "2515692073"
"a1_208" = "2891594730"
"a1_209" = "4121587587"
"a1_204" = "1790170133"
"a1_205" = "3527661159"
"a1_206" = "1676189380"
"a1_207" = "836784698"
"a1_200" = "1800700700"
"a1_201" = "119786135"
"a1_202" = "3573646804"
"a1_203" = "477788471"
"a2_777" = "1275441414"
"a2_776" = "1268275833"
"a2_775" = "1261107333"
"a2_774" = "1253926758"
"a2_773" = "1246757719"
"a2_772" = "1239589260"
"a2_771" = "1232434665"
"a2_770" = "1225257679"
"a2_779" = "1289776812"
"a2_778" = "1282610031"
"a2_395" = "2831810555"
"a2_394" = "2824627340"
"a2_397" = "2846145870"
"a2_396" = "2838978223"
"a2_391" = "2803126224"
"a2_390" = "2795958943"
"a2_393" = "2817458422"
"a2_392" = "2810293131"
"a2_399" = "2860470274"
"a2_398" = "2853318115"
"a2_568" = "4072057855"
"a2_569" = "4079224212"
"a2_379" = "2717090374"
"a2_378" = "2709925475"
"a2_373" = "2674088618"
"a2_372" = "2666907285"
"a2_371" = "2659738470"
"a2_370" = "2652573337"
"a2_377" = "2702755888"
"a2_376" = "2695591069"
"a2_375" = "2688423914"
"a2_374" = "2681256616"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283274728"
"a2_178" = "1276105009"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254590928"
"a2_174" = "1247420707"
"a2_177" = "1268940297"
"a2_176" = "1261771562"
"a2_171" = "1225922836"
"a2_170" = "1218753153"
"a2_173" = "1240255018"
"a3_249" = "1801832560"
"a4_960" = "2587388864"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Aas]
"a1_511" = "761807313"
"a1_512" = "2842203229"
"a1_513" = "4025785873"
"a1_514" = "2686481534"
"a1_515" = "4121458438"
"a1_516" = "570349021"
"a1_517" = "756394847"
"a1_518" = "212694800"
"a1_519" = "1204377598"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "705686341"
"a3_514" = "3667976427"
"a2_543" = "3892834512"
"a1_424" = "3715860585"
"a1_425" = "4051810487"
"a1_426" = "1589257011"
"a1_427" = "3020028304"
"a1_420" = "1957214704"
"a1_421" = "1453655240"
"a1_422" = "3949417959"
"a1_423" = "2633114460"
"a3_199" = "1409969486"
"a1_428" = "2668571792"
"a1_429" = "3858963587"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623240444"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "2953376097"
"a1_739" = "1326620237"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "3115271470"
"a2_915" = "2264781172"
"a1_865" = "2809601399"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_861" = "3545365579"
"a1_863" = "4130937413"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"

"a4_871" = "1949337095"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "778504194"
"a1_849" = "751129604"
"a1_439" = "2097535570"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450988446"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "1533723464"
"a1_199" = "1662119121"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "366969086"
"a4_145" = "1039522545"
"a1_190" = "1024232883"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "1128400157"
"a1_663" = "2968572526"
"a3_965" = "2639793036"
"a1_660" = "2409302554"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "826160750"
"a1_664" = "874450116"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "1669313766"
"a1_0" = "1964074070"
"a1_1" = "2501731546"
"a1_2" = "2690160784"
"a1_3" = "1334817149"
"a1_4" = "1663558974"
"a1_5" = "134958939"
"a1_6" = "2875123703"
"a1_7" = "3056108601"
"a1_8" = "30703174"
"a1_9" = "1372762677"
"a2_566" = "4057724321"
"a2_567" = "4064889710"
"a2_564" = "4043387019"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029041601"
"a2_563" = "4036222126"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953679058"
"a2_413" = "2960846526"
"a2_410" = "2939346186"
"a2_411" = "2946511034"
"a2_416" = "2982347693"
"a2_417" = "2989530327"
"a2_414" = "2968013065"
"a2_415" = "2975180172"
"a2_418" = "2996697809"
"a2_419" = "3003866404"
"a2_962" = "2601718997"
"a2_963" = "2608890925"
"a2_960" = "2587379949"
"a2_961" = "2594556546"
"a2_966" = "2630409319"
"a2_967" = "2637564666"
"a2_964" = "2616057125"
"a4_950" = "2515697654"
"a1_631" = "1388923814"
"a2_968" = "2644743339"
"a2_969" = "2651909078"
"a4_564" = "4043384244"
"a1_219" = "3975654822"
"a1_218" = "345841450"
"a1_217" = "4220043287"
"a1_216" = "1057316086"
"a1_215" = "1797371326"
"a1_214" = "513299567"
"a1_213" = "2354671367"
"a1_212" = "4170243554"
"a1_211" = "2222404"
"a1_210" = "1562147301"
"a4_567" = "4064891607"
"a1_630" = "3479712744"
"a2_980" = "2730777555"
"a4_560" = "4014707760"
"a4_956" = "2558712380"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "439451526"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
218741385c7e2273e2ca170ac1a4ce22	c:\illrd.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Virus file.
   
3. Delete or disinfect the following files created/modified by the Virus:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\universaldownloader-prefetch[1].htm (93 bytes)
   %WinDir%\system.ini (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=8777117 (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[2].htm (911 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\OpenSans-CondBold-webfont[1].eot (2077 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=6157950 (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[3].htm (961 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (6872 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\OpenSans-CondLight-webfont[1].eot (492 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (834 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2d9b4-fff45[1].css (41 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondLight-webfont[1].eot (974 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_78[1].js (3472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\90f12-4a489[1].css (1391 bytes)
   C:\illrd.pif (103 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\container[1].html (655 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\eaa2a-e6efe[1].js (2356 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b5ae7-49f02[1].css (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bid[1].com/universaldownloader-prefetch&cb=2033782 (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\font-icon[1].eot (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gpt[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (7961 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondBold-webfont[1].eot (2783 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\427b6-cd0ca[1].js (399 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\font-icon[1].eot (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bid[1].com/universaldownloader-prefetch&cb=3057370 (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\px[1].js (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\container[1].htm (4 bytes)
   C:\autorun.inf (265 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\windwiiww.exe (741 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondBold-webfont[1].eot (1621 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\4cd46-1a865[1].js (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\7b1b9-727eb[1].js (6386 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1467b-931a2[1].js (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondLight-webfont[1].eot (1418 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (3856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\font-icon[1].eot (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[2].js (15 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1, 40, 1, 0
Legal Copyright: Copyright (C) 2013
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: Softonic Downloader
File Version: 1, 40, 1, 0
File Description: Softonic Downloader
Comments:
Language: English (United States)

Company Name: Softonic Product Name: Softonic Downloader Product Version: 1, 40, 1, 0Legal Copyright: Copyright (C) 2013Legal Trademarks: Original Filename: SoftonicDownloader.exe Internal Name: Softonic Downloader File Version: 1, 40, 1, 0File Description: Softonic Downloader Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
hC8i700F	4096	1081344	0	0	d41d8cd98f00b204e9800998ecf8427e
E01D6Y47	1085440	360448	357376	5.54407	7deaa27994180637e04a27621751b75b
.rsrc	1445888	90112	90112	5.38012	3fb02e304f99c741041ac684b774b66b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch	46.28.209.1
hxxp://v1es.sftcdn.net/es/css/generated/90f12-4a489.css	46.28.209.40
hxxp://v1es.sftcdn.net/es/css/generated/2d9b4-fff45.css	46.28.209.40
hxxp://v1es.sftcdn.net/es/css/generated/b5ae7-49f02.css	46.28.209.40
hxxp://v1es.sftcdn.net/es/js/generated/eaa2a-e6efe.js	46.28.209.40
hxxp://v1es.sftcdn.net/shared/font/es/OpenSans-CondLight-webfont.eot?	46.28.209.40
hxxp://v1es.sftcdn.net/shared/font/softonic/font-icon.eot?	46.28.209.40
hxxp://v1es.sftcdn.net/shared/font/es/OpenSans-CondBold-webfont.eot?	46.28.209.40
hxxp://v1es.sftcdn.net/es/js/generated/4cd46-1a865.js	46.28.209.40
hxxp://v1es.sftcdn.net/es/js/generated/427b6-cd0ca.js	46.28.209.40
hxxp://v1es.sftcdn.net/es/js/generated/1467b-931a2.js	46.28.209.40
hxxp://v1es.sftcdn.net/es/js/generated/7b1b9-727eb.js	46.28.209.40
hxxp://latency-optimizer.sd.softonic.com/shared/abp_detection/px.js?ch=1	46.28.209.1
hxxp://latency-optimizer.sd.softonic.com/shared/abp_detection/px.js?ch=2	46.28.209.1
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=94214117414&varName=crtg_content	178.250.2.100
hxxp://d1ykf07e75w7ss.cloudfront.net/aax2/amzn_ads.js
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=6157950
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_78.js
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-2/html/container.html
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=36197053729&varName=crtg_content	178.250.2.100
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=2033782
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=61759328311&varName=crtg_content	178.250.2.100
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=8777117
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=21779022559&varName=crtg_content	178.250.2.100
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=3057370
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=8777117	178.236.4.159
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=3057370	178.236.4.159
hxxp://c.amazon-adsystem.com/aax2/amzn_ads.js	54.192.202.224
hxxp://tpc.googlesyndication.com/safeframe/1-0-2/html/container.html	216.58.209.193
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=2033782	178.236.4.159
hxxp://v2es.sftcdn.net/es/js/generated/7b1b9-727eb.js	46.28.209.40
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=6157950	178.236.4.159
hxxp://www.googletagservices.com/tag/js/gpt.js	173.194.113.218
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js	173.194.113.218
hxxp://partner.googleadservices.com/gpt/pubads_impl_78.js	173.194.113.217

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=6157950 HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: aax.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 18 Dec 2015 06:49:08 GMT

Server: Server

Content-Type: text/javascript;charset=UTF-8

Content-Length: 8

Vary: User-Agent

Keep-Alive: timeout=2, max=6

Connection: Keep-Alive

void(0);HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:08 GMT..Server: Server..Content-Type: text/javascript;charset=UTF-8..Content-Length: 8..Vary: User-Agent..Keep-Alive: timeout=2, max=6..Connection: Keep-Alive..void(0);....

GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=2033782 HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: aax.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 18 Dec 2015 06:49:10 GMT

Server: Server

Content-Type: text/javascript;charset=UTF-8

Content-Length: 8

Vary: User-Agent

nnCoection: close

void(0);HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:10 GMT..Server: Server..Content-Type: text/javascript;charset=UTF-8..Content-Length: 8..Vary: User-Agent..nnCoection: close..void(0);....

GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=8777117 HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: aax.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 18 Dec 2015 06:49:11 GMT

Server: Server

Content-Type: text/javascript;charset=UTF-8

Content-Length: 8

Vary: User-Agent

Keep-Alive: timeout=2, max=1

Connection: Keep-Alive

void(0);HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:11 GMT..Server: Server..Content-Type: text/javascript;charset=UTF-8..Content-Length: 8..Vary: User-Agent..Keep-Alive: timeout=2, max=1..Connection: Keep-Alive..void(0);....

GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=3057370 HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: aax.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 18 Dec 2015 06:49:12 GMT

Server: Server

Content-Type: text/javascript;charset=UTF-8

Content-Length: 8

Vary: User-Agent

Keep-Alive: timeout=2, max=16

Connection: Keep-Alive

void(0);..

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 15216135633433300900

Date: Fri, 18 Dec 2015 06:27:12 GMT

Expires: Fri, 18 Dec 2015 07:27:12 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 84768

X-XSS-Protection: 1; mode=block

Age: 1317

Cache-Control: public, max-age=3600

...........}g{....w..{N.3........l ....N[Y.g......D.....p.......9Yk.I..@....l.M...i.zt..={..N...*..~...l<X}.v....m;...9..<..c;......F.........S.5..U.^...s..x..h:..!.....f......._v..`..v..M.k.t[S....Z..8.kU......4...*Q....yZ_._..GG.M...e..[.N..2..{.xS..]......v...3.0[u<v^,.....Q....JD.U...x6.........N.7.qw..zN..mQ....._.......x.5..H6..........c..!)P........7..T.3/X__IO.......tR...... .Zz.i... ..........."4..._v...;$..X..I.*b.3.S......K ..;......^. m..h...@....V"..c.\.S.*.K.fy...-Oh.i.....QU........$.s..........f;08.....D/....Yg4...N.....q.f{0.@.z..0.k.5...O......m...*'`.{.....-:.%-..,..r.Vc8....V9.k6 .&..1_5..8..b.l5.M........r.j.#$..7.k...T..L .....v...v..Uo....<8........Nrd...9.7`c.e`wm....u.......8D......}.L..`.4.'@...O...`?..t....N..u.a{.6..Y.V=.I^8l......G..0#v..c.....x.M.c......z..kA....9.....X)X.c.....)w2..].l...J.w....}.{..IY..L.o.>.#g<.....4.|....saz.|.?.*.;.*@.a.~S...j`.\..^.G.(...7.,x......Ae-W.....1.#.%@Lc......=m42wY....U`... .s....Uy..&..8..q.N..L..9......k@[.e..C.4r.\.`9..T...<H.O...c...5..h.?....}.}.k.'.{..5-.m.M.}.a.....r..|!.g,.{.%. . o..D..D..D.Y".......}t.'.)=Y.P_..p....?....p....(.!;......T....#....Y^~.2...C(.........,>.W.6`Y.M.<7......=.../...s.u. ......].N0[.( ..A.b.......t.....n....h8.R5...`.......<6..F.V.J.5......l2..)...}..p...Vs.}. J.Nf..*3.\I}a.n..1.A.w...i...Z.R.a@=..........kd....f..8....DA.h...)...&5-...7..v.._...9.. .R~..7..\..J....f.;.Q..T....M......D}....a$.;F......Eq9..k.q. G.6...2R.'......fI_.x........#..0Qw8.x....xf}..._'.....}...%....$..|.g....t

<<< skipped >>>

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Timing-Allow-Origin: *

Date: Fri, 18 Dec 2015 06:39:27 GMT

Expires: Fri, 18 Dec 2015 06:39:27 GMT

Last-Modified: Tue, 08 Dec 2015 11:45:39 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1489

X-XSS-Protection: 1; mode=block

Age: 581

Cache-Control: private, max-age=900

......n....Vmw.:.....o..#...]K......n-}.F.=Nl kH...1..~e;..v..}.G.,=.d Fo.z..B.O.iR.D.....#.:..Z.HL...........Q........gY.5.2{........]....l..|..}R............p.a...iu...n..=.....~....p......Tx.........m.\Y...@.eo ..fPHRP.a.`o*}.D........g....J.....k..RC;6GZ.].K....6...27.._s.%.'.......%x*...U.V.a.^..fIz.%-.[R.W..._.p.d.a..........4.g.)].>.'{...K.....zt5.....G.....l...>.jL.~....h?....Ls...O....;....d...(...@....q..c.1'..9..g.g.K.2q(.}N.F.'......oy..ae..`>r)K......p/..; ...l.-S....?./..$".IA.6....x..cKZ....".L{Qb..q.......:......|.P.t....ZAT.-N".yQ...My......j."Tlg...Z.....4..S...i>...c?d.X.}%...........NI.*.C.P....:k..r$4..x.............5V{.i....xG.7.h..[.....M......Dc....*...*.B.......D|.X...........jAE....@...a.|\~O..V.......xS..5n...TG..sl.[.....'XJ...')....n,z..r}.9..L.6a.7.B.....!...N..z4...Y.c.y..........HMN.$.Q..:.A..............0.4....$..b. *.....('.3G...!cZ":....-......@G3(_.f...6.Vp[2St.U..p4ty...HV....T.h.2..C.Pe.Mcx2...q.......'...j....@....s.@..(....ae2..R.....9....9L.r.*_6.....Z..Y..Z.Y.s..';........<#...@...pI.....j.3.....$.#..k.(.x.Y. Fc.....*.VB.=..Kw..YZ..W.{T ......o.\.&.._..hn..2...S.K&....>S..h0..q.. r..G.......-.h." ...r.Q . ..r....C.u....2..H&......s......{.%j...Z5.P6e.Jh......w.eg.)18-&Y.....KS,.=..b......k2.....!{.......j........_I..A,........1..C..-80...x-.....T/-...V.Z...W...A.|]F]G...."..q..n..NU....Z.}...r.x..........dw..K..e........Cf|..k.4..x%..[R.q...H.y~.....^..w@E.....LN._..\9F......m......[^....c..w.?`.w.<.T.o....~\*.......&S.......

<<< skipped >>>

GET /gpt/pubads_impl_78.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Date: Wed, 16 Dec 2015 05:29:58 GMT

Expires: Thu, 15 Dec 2016 05:29:58 GMT

Last-Modified: Thu, 03 Dec 2015 10:34:42 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 51142

X-XSS-Protection: 1; mode=block

Age: 177550

Cache-Control: public, max-age=31536000

......n.....i_...(...S.N.#..c.B........!.$.......".,......E-Y&.y...3.Rw.........p...m.....v...t{..{:.w~.|2M..W.^..X.<..|.3..../|.....v.G....b....<.X..8..0.w.7.&.0D..4.o.Q......a>P!.h5p......q:.....d.q...I=..}...p"Z...7.F.g..P.&.V.....lf........T..a2...[.a....G.Z....../....y:.=...`..A.`..3lK.f9.c...B..joe.8..&...m...........U.:...K).V..K...............R....C...U......0N....-..9.VU...3..,........a....p..s. K4.Rt....W.P.[.....y>..Y....g..Q6M.....[5.y...w..[O}.9..y..i.a..5X.l..X......?..om....c~....N2hqo.KX%k.3......4..6.....N...a...5.}..Enz..k.._-a..^.;n.j:...x"...HW..4..|.X...1 sv.0 7...F.8......e....N.^....}C......(.L.Y....Z..7.=.&.stQ.#5l..Ml.n9,..nx.8..W..l-....~...x2..o.._[5.v..f....j\js/......:ky....Nt.....?.......~.......VC<..|.. .v.../%..C~...).p.gQ:.'...!. 0k.Y....%bu.....r...r/.V.{Y.9...F...y'.g....9....b...:./.g..hXOF...'~2........^.._....z..>\.......J.O|...._^...........M.....$.........t..?..a.@....@1.%,.6.B..t...b.AE.....SY.O.......(}.......4S.. ....h99..Cs.$|..g.....b.D.K..K.l.W..U.2Be...m.......x..^...^.H4.........q.0w...h...F~..&.Zw5.0<.....l*... ._.4.@.z..4.`|.@v..[.6.`.<.)..o......X.y0M,f.....|..!....#.~_...o.. .@i...N!..-......5...r......w.j9'.0..g.>..>....,L...l..........A.x\.a..?..D.!\.?J.s......1..o...n..D~.H}...Y.....d;.^G.;.(,..Q.|...K......@I..q..2RQ.I....l..v."UgE..9..U....Y_..m.u....p......%.H.'.0..4W.$Q..>.%.`.,.YZ...n2.U.......}.q....-....._..t.i.-.M~....g..0..s`...:x;.....aA..VC.....q.O..............w.h....,..........,..n*/''V... ...s.....5.....7x.iK..

<<< skipped >>>

GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=94214117414&varName=crtg_content HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: rtax.criteo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/javascript; charset=utf-8

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Server: Microsoft-IIS/8.5

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

X-Powered-By: ASP.NET

Date: Fri, 18 Dec 2015 06:49:08 GMT

Content-Length: 165

crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text/javascript; charset=utf-8..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Server: Microsoft-IIS/8.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..X-Powered-By: ASP.NET..Date: Fri, 18 Dec 2015 06:49:08 GMT..Content-Length: 165..crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();....

GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=36197053729&varName=crtg_content HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: rtax.criteo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/javascript; charset=utf-8

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Server: Microsoft-IIS/8.5

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

X-Powered-By: ASP.NET

Date: Fri, 18 Dec 2015 06:49:09 GMT

Content-Length: 165

crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text/javascript; charset=utf-8..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Server: Microsoft-IIS/8.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..X-Powered-By: ASP.NET..Date: Fri, 18 Dec 2015 06:49:09 GMT..Content-Length: 165..crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();....

GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=61759328311&varName=crtg_content HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: rtax.criteo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/javascript; charset=utf-8

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Server: Microsoft-IIS/8.5

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

X-Powered-By: ASP.NET

Date: Fri, 18 Dec 2015 06:49:11 GMT

Content-Length: 165

crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text/javascript; charset=utf-8..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Server: Microsoft-IIS/8.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..X-Powered-By: ASP.NET..Date: Fri, 18 Dec 2015 06:49:11 GMT..Content-Length: 165..crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();....

GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=21779022559&varName=crtg_content HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: rtax.criteo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/javascript; charset=utf-8

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Server: Microsoft-IIS/8.5

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

X-Powered-By: ASP.NET

Date: Fri, 18 Dec 2015 06:49:11 GMT

Content-Length: 165

crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();..

GET /es/css/generated/2d9b4-fff45.css HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 10 Nov 2015 11:00:44 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/css

Vary: Accept-Encoding

Content-Length: 8171

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:04 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 2991173

Expires: Sun, 17 Jan 2016 06:49:04 GMT

...........=k..8r..W..h.........e.n.....].9...,..nd.'..3kt~{...(.v... .;..T$..b.XU,.>..u.Z........7..9..P....U.C.vh.....!......@......vy(..m.2G5...............>......S...uY=..E....P5E[T.y...-..b...b.....v.`|..XW..]....2...........=..A.......?.EZ:...u.|7.%.......................h..j.......D.v.\..v>....4....b...w*0{F.f..W...T-{....y..X...j.[....[V8.x..Q.y.....3..MsL5\......*}.....~....0....A..;=K.?....t.J.O..:.s...>H..|"u..?....=....s....>.Q..........O...."...........S..O&...a...r..(..v...f.~4.T.6j...Y...{H...1KWMU.1..!.9......4...._.....yh..e..(..&3.P....~...[...E..PW.".....e.'./5..uU...-..j.u.m.4/.../>....>......G.J.........(..z7B..z.1..:.^.......~.B.R..x... ... RM.Ax...d.K...............W....~...._8..-Y(NT..(...>..r.U..'...<....!.T...Q&.>...9_A/..D.x.P...?tR.......R........].b.}b_...R.k..{....`6........ST..:;...q....Lh........W...?&. .:......L.!.......*UNLz..b#.BI.c.N.I..T.a=i..h]......8....,.].......q&J.,.(.l.......h.\.O..?.&S...Sgl..,q....]...v@R...>.9...F...f..l..>!...=.........q.W..]j!...hFV8N.`..T........rG..M.........../Q.W(.5..7.[...Ki..x.un..Z..116.A...a.7..b]s.W.....j2........x..R......J..P.K..\.6:..-.F.......o@Fv...T.C........7......y...r.6F...L.P...7.....v'VQ..D....-e....Wb=.,(#G.?z.2..=_V$.h.........)..83... .G).=..*..ol.&..<....7..... ..$.DW..EX.#..g..3.J.b.g...Z. ).f0y"._. ..D.H#Ld.f.....g:aV5J..>.V.8S..#\.M._...ihe@.&[.....g^.<h%..v.f....Wy.A../Z.}<OU.......t..}*.bU...1}.,H.X.y x>...:.a.p{.nok fp.T..E.AL{M$...1.....q...c......8.....[.e.6a6z9[.".

<<< skipped >>>

GET /es/css/generated/b5ae7-49f02.css HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Wed, 09 Sep 2015 10:13:15 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/css

Vary: Accept-Encoding

Content-Length: 3152

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:04 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 807805

Expires: Sun, 17 Jan 2016 06:49:04 GMT

............ko...{... ..]..g.8X..p@?\...(P...%.6/..#.89#..3....rr:...n$...79....".M..,.....?}..........w ....Q......DQ/!..K8..A......~........7e..]u.I.......>.&D.....J1..L.LMe..,.?./....A>..|u>.?L.w..T...?.....~.......^s..q<.sC6...........td.KC?b...W.....x...r(2.dBb..d....rk..........1.3.v....."7.8..(.....(.{..\.......!M.Y2.q.I........G.....5.*e./G5Mj.&..Z...,...0........4.Ot\...M.....fp.O....4..6.q.sn..LQ9.a \.".h<..7-..e...).(.G...DJq.3J..&.qM...,....4...c.....b:D~r.i..k..*....=B.....|.. ..p.D..$..gi*bU...e.`t......T8.a.Od..h.#>g*u83p"$.=.....D.%nA...os........Nn'd..tG2>@.....tU..@..7.L9.)..s.S..)!:i5._}..........f7.M.-..=..<PU|.TB..M.U........`;j.:*!........OG....j.<?x;.....no...y.K._.U.;a:=.8......r.....!.!I. 1.(..Q.S...O(.......!..!....O)}............ '...0"i..Nx........p......T)d...I'ZL.\..H...b/......)...."x< ..*.......1S.l................6s<.{...PP..........(...4!.>..I.9... ....Z.s....Ax... .......5......F{...6L.....$...9M1.n.%...q/E...L..W_..t.~a...b.._O%...1z;M...wN,.DK(I......L*!..`.B.. /5r_[........w........]?..l(pt..%.7#;....g..^...L...*.$y~...j..rM.!..b}...8J.$.......,."rn..*...q..I.^HFU C.......R...N....4......C...y&.Et_<....Q...v.Z-....t..V....s...q..!...w........c....8.5Up........;.X.2_...b`...6^;ZN:..'.2O...O.&...Qk..S'.F%%..\.U.q.r...p..._.x.....p'...L..J.,..s......E#.iA .0.R......Ji.9...Zix.....p.5".b.A.T............>.6.`.XR...bZm..E..Frh}sB>.IJ@.z}.z.%)..4..]..phpc4<c.9.V....;....,..1.7c.K1..7{....`.AE.A.A(?{.h...{.U.t..H...g...5..0..._,.v..

<<< skipped >>>

GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 13715

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:05 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 98

............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...

<<< skipped >>>

GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 14130

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:07 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 86

............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<

<<< skipped >>>

GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 14130

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:10 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 87

............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<

<<< skipped >>>

GET /shared/font/softonic/font-icon.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 17 Nov 2015 11:00:45 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 4997

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:10 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 68

...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K

<<< skipped >>>

GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 14130

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:11 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 89

............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<

<<< skipped >>>

GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 13715

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:12 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 100

............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...

<<< skipped >>>

GET /es/css/generated/90f12-4a489.css HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 15 Dec 2015 11:00:31 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/css

Vary: Accept-Encoding

Content-Length: 29552

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:04 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 1460649

Expires: Sun, 17 Jan 2016 06:49:04 GMT

............i....(.}~.. :.i...EkU.o.:....:.=.fb.\.%R%.)Q..^\Q..aG.H.T...}. .J"....H$r....8u.y..r.F.7.....F...M..........j..].....:..U....\...J?....Zx]t.yp....).k..:.w...?..o.......g.(......U..;..I....;.n..C{..............:..8t....:tU..)..Cw.._N..o..H....Z....F.G...%.....j.o.}a........7.H......T.uU.U.......z.n|%...v.0..."9.!...R}.1...;.. #...{..... F......c._4~N.[....KG....!4.......|.y...x..k...Po...&......t|.lWt'Rz.."E....cu(G^.....s...3..q.i..D.h...sWU.q|>......*.........,s_l..L...Ey.Ub...d.7.......O...!$...{.Pw..n....]M....oH.....s;....@..g..s.n..}qz....a...ISm....\<F....6..=D......~.H....=.o..hW.t .1H..!..rl#......`..u.y.xj/.2..M{..[..t.s.pj...Z......W=.b ... .v...c.CT.7.#BJ.j.....). .) Bv.N..4....T34HY8.N.....y$...!..4 [L....?.........!..cu.k..............Z!..4B C0..?.e..4...j..........u...T....^...,1hcUU.....i....r.Vm..jYU[..5.[.V.......a...O.'.s..c.y.~.F..#{....E..}.:c...D...9.:.q .F..;.....=a....y7b2...H.O...PEl3y.....-._u..~.fE....U....?..S]...._.....=...pr~^...qY.....<..r|i.m3n..........&..t.....jL............x9....3....q........y7>.....Hd.;.eY...'........g..=..SIw..i.cW......i..!x>J....Q..i.?.,..Tw..n.).t....P.i.j\n.......#....3..K.....=T...y.D{!*..9......?QO...>M..X%.._W.....-1.......4.6...y...T.D&R...*...].O..L.......\..h..%..a;v.}...e..-..OP..c.k....S]4...Neq(..................jo..,&.g>.gK....jF.c. ..yN{7...]j...=....aD...8...o..%6....R?I..L..L&VC&1.y&./h.^..........<^2.sIc..4f.Ac..6..<.-:.x.3B'..I...87.....s./..&c.3g.,2Zm...b.O.......m..Ap.....h..>G..i|......?..i7....

<<< skipped >>>

GET /es/js/generated/eaa2a-e6efe.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 08 Oct 2015 10:06:07 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Length: 46093

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:04 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 38005969

Expires: Sun, 17 Jan 2016 06:49:04 GMT

............y{.X.(...>....BA.v.'..u..*U.:NM..<B..6 ..C......'!...s.....#m.yX.^......M.t.......^s....m=Y..O.4o...a...8........Q.~.dQ..?..*q.....e:M.i6Y...n...~6..O.i......K..7.,....3...h.ov....f.@.7.D..|..6..(..r1.r..K.MRz..t.%...8u.g...=H.i.....f.F.......M.L`G...i..x.........~:..........L...h..^%....~..qc.m..d.5.U?5..t...j......~...............4........$.....Qm.....qck.k...p.R...Q<.%i.v...u...s {Ni..].$..O............<U]x..F0.........(.i.....:.wg....O. ..%kP.>C..wo>...1l.t....b.|../.i...w7.n...'.r>...|%z.D?...ZQ?....pz?N.....`.FOkI....h.Do....u...W.P.#>..D.,i....N......Do.h..f.%.(...,..Q..s.m...g.......k.E.iv.31..~..^....}.d.t2.....y.>...O..M.tw..I:.MFk..v..S.|.....-...A.8.jW7;.J.q.<9....../..U.>.......l.].......Ep.n..>..f._.~}vw.......A....A}.g.....:..~....'..T a......."...rv[...'g[..P.......9~....N.xX...'.t.nA.?..y.c..\...u.............h2..g..$.<?.|.y./|... ....b.......O'.t~...t>....M....Y..N.g..|...k..Y.f.v.[?x.b1......a.N`7Wp.~.........%....ko.9..t2..5..a.zx...|P..Qr.:.]..p.........T.&.8e.&...icE....8.nR'........".A.i.A...).........[....O.i..(o..F......gt.b....O..#i.F...x.M3...>..< .1.!.it..p.7.e...u>.p...M...T/......$..f5......5.........y..:)........C...7Nz...ww.6.. ....3...I-.KcXyl.......;..|...S...U.....>a..;.....kow..=..a:.H 8....q.......0....^m.%.g....e..V/....... .c..81.w.|*.C..j... ..>t/..W.w...r@.......^.)..............`j-.N..@}Y,.........t.j.bg_..I.gO;...>.o........ .F..0.|...k..]q..q^.p.I.....}...'.....R.........;......Na...j.B.u_.I...j..

<<< skipped >>>

GET /shared/font/softonic/font-icon.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 17 Nov 2015 11:00:35 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 4997

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:05 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 27

...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K

<<< skipped >>>

GET /es/js/generated/4cd46-1a865.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 17 Dec 2015 14:56:18 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Length: 6274

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:07 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 406972

Expires: Sun, 17 Jan 2016 06:49:07 GMT

...........\yw.:...>..;'.n..f..t.$m.lm...4.#..Imp..q..g.......V..........{.....,'EK..............1&..;....r%N............;?.x..PN..{....Q..K.(........-z..;...b...}o.\.......b...w.v.$$C...M.....V..w....=t.....3...Io .. 'I...~.V7m'P.......P...[q..&n...x..o].F.8#...9:...v...*.!A....Bd.m.....)H.".vs.2..u.dG....!......p.... .9...u...?f%.4 ......;..^.....y.FLEw,...N..a...J0.~...ph ..U.8...{..$.....8........95M...t.$.Q............@.......$\.........'.'..M....j.R....t2..d...w'q....Y{.......h...y....."fhZm%....... ..N...X....nU6...A:..S. E..#96.".D.W9J...Q...4.p.G..F.gG..'x]....q... 0-.1.b..(.......i...5.x...@..bC.Xl...C...].mYF.H....P/......s ...b.?.9.x.~.....d.^..V.*8..j.cFz..y.F<.F-....lA...#.1..:.m...D........4....p..0.uSqB.v .q..c..........a...........C`..U..L..&.c...^.pp.9....iF.U...~.!.v.(.u...,..:r.g@EUwp..0....N..I0/.d...h....kWh98..B...0K9r...&. ..4....g...65JG4u@...Vw..KrT...B..Lg.D...\.....C.Z..B."..J.qN...6<.......I.....".....D..U.C.D.^..A.AH9.,.......tt.*.Ji.."b.2>...6....u...w$..k..#.vj..-S..B.........U.x.jMk;J;...'..Q..$.ZB..y..('.'.!.k..~9..=............j.UB.8...#v.F.a_.@..`PD.....yH#...P.B,..U>.t..<...:.2...*Yw9OA.. 'E3=.\......N..D6.I...k...h.GI>..4F.:..!.3..tQ.V.9,.i..bB.i...}L.....Z.#.....`..!..ht..a..:.X5m9g.g.P. ..[..x...o..z....D......4 ..F..H."....D.5xE.<.....@uh.,..=-j.b.....7.4];..Ck... ........KX=.!N'ph1..^.8...@..]U.U....A.._..6..Zd.....x"...L .z.iD.......Q"7...b.5US..{.$rmO....U.{h..m`X&d\.cg.in=\.......Z....,..Y04.."..&......|Fb.mK.B.s.hC(.c."9..A.TL/.M...".(.@....A

<<< skipped >>>

GET /es/js/generated/427b6-cd0ca.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 15 Sep 2015 13:30:42 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Length: 8368

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:07 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 1919820

Expires: Sun, 17 Jan 2016 06:49:07 GMT

...........|iw.6.... d..EZ4-9MkSAt.g...Ic']$..\$1.H..d9..................$..l....<:..#.'~Z.f...Dk........>.]?.k........G.d.....?L.C7I....O.?.<..9.s..Ec..e..............(l....M.(...r.....V...........S?....4...1-r>.n.u..[.....YF?l.2..}...G.../..0/..."w.D......^........q.....d..U.....L....{34.{31.... ...Yv...gL.....|...;l.Z.....{..q..K{....{.A.@3g...u.6..wo..f:......z.A../5..L.i....?.iY.{S.........wot......n......lYvo. lYA..[V0(..n..p...^.....(|.6K>...c..:;v......o..f.n....{=....u:.t..._.....?....1.1.a4`.o0Lk...e..44....i....Z....Ck....5............/..'U..o&H.9}..~...:..);.q.1z.G.a....(G.,..U..l...|...[...Cf....1....".l..I...\=y.7.^. .).......Z.Gk...$......'......t.lj....C..w.....b..5.!>|S~.........2.v.n..a..z.......:aT.b|.`.*`......h....h?....D.i(D.W!...i.q...:.);...S`~..o..M..2`...Q....H."~..K.O.~....10]3rN....,4.c?..a-..p.q$.S...}.w...e.>N|.....K..O...............%..G..........._...'/..%.4.O......L..F1r.g.|. k.......4.O.....5.^....g....<Id.q..,.B.Y..o.c..........q....OV.../..~8LGZ;....io......D....#.O...m.W...:?.5&..S.l.......B.p.8cdy-.i|.....?..Y..........x......-...,....9O}...\c.n$.....5....B`....~..kO.m}.7<2..:...J..q...D1X.S...A.')...&&]ZU!#Wpl.O..O=.n.=. ......@.:^...A..Iy....y4..4#.fo.:o.1]...",.p.?...-.....z....M...Ik.......)..= )i.....``O..w......?...!..P./!......#!J.U.(.\RY. .K,.=v\b.36.[....,.2..2......sQB.....8..M{.qi. v......a.|.Y-.......A..E)u7JX4...M....z..l..b.Y..24..|m>3}...ES?.G...I....ka.S.H.;v..?E'..8..N.....B.x.Z-...d....a... p....g:...Mg$......A.t.7..u..Tv.3...

<<< skipped >>>

GET /es/js/generated/1467b-931a2.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 15 Sep 2015 13:30:37 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Length: 3783

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:07 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 42702117

Expires: Sun, 17 Jan 2016 06:49:07 GMT

............]s.6..~......))..zb.......q.q;w.....EZ...A....~..H...4..Cbb....{......c9....../.98....t.1.>.G.s.S..^r.<.....4.IN....@....NW......i.%.ej._.>.....o.>^.l.(FX.>...........s......Y{.@.-..q.VhQs.........l.6m................R.3".`.X....7.[..j|&......cs.G..H...,....'...Q.O..#...ss.(/XzPO.[<m..Y9...j.a:a....q...Y...f.......=...T..K........l....[..P|......-D.|.y1.}..@..0..`Nm.Q.Sb....o.PQ#.I...S.4.Gwat.....H.......[.Q.Om$.q...=.G.(....&....^.$.i..V$U3w@b...6.[Q.%|C)'..5.Ob.A.a.L...f...-q...og................,[...i.*g>..%`VH:t%.c...;%'...9G.%.t..\..([.........:...[F._2..^..........8.........)%..D>..Ec....>..G...)...F.onW....|..aB....5......rA...Io...CmF.nZ$I..EJs.[Q#..'f.H.....6..1_.I..#......"\7.v.g..}s[}.. ..nx.....v.G|/)X.%8^.h.. ...\.....{.3{.2....k.&.......>'.>.....T.-(a.@..n........MB.3?...... r..s....Nh:...p.K....Y...........??.'G?.M..p........d...4!..........'........kL|o...9.|.XC...i@W<B`P!fi:...X..h..|JSo.........x-......P..T.....R....j....,.h....4.o.U..o.i.o..'^:/ .aP. X.IA..nF.B.^.........aRFe.p.W@./=v7.....Vs5.hH...A....Y..t.Ub.X...,m..2..........X.V.....i..#.e". _p......r..r...R^....Tc .5....B..-...5.. h...Y*`..v.2....n.....4....(..8`............P.2.1O(...B.....8.8...4.a.....".v*...4.@..."a.$N.SH.,..`v..Pj!.....K..A..\y..pG..u............H....<.~..W.|.}.E....v......F...\..*..J.....5a.z..V.vv..l....*4...l........T.H..@..rVPGE../.!..D\.]...O.........F..c(.2&.o$.@.qs..wdDR.i.>.,..l...4.......)...V.....y.0..U....,..%..........^.p*.W..."Hu......h..>$....C a

<<< skipped >>>

GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 13715

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:10 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 71

............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...

<<< skipped >>>

GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 13715

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:11 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 72

............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...

<<< skipped >>>

GET /shared/font/softonic/font-icon.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 17 Nov 2015 11:00:35 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 4997

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:11 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 29

...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K

<<< skipped >>>

GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 09 Apr 2015 09:12:46 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 14130

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:12 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 12

............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<

<<< skipped >>>

GET /shared/font/softonic/font-icon.eot? HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 17 Nov 2015 11:00:35 GMT

Content-Encoding: gzip

Access-Control-Allow-Origin: *

Content-Type: application/vnd.ms-fontobject

Vary: Accept-Encoding

Content-Length: 4997

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:12 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 31

...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K

<<< skipped >>>

GET /universaldownloader-prefetch HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: latency-optimizer.sd.softonic.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Fri, 18 Dec 2015 06:49:02 GMT

Server: Apache

Set-Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; path=/; domain=softonic.com; HttpOnly

Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:01 GMT; path=/; domain=softonic.com

Set-Cookie: blang=en_US; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com

Set-Cookie: country=UA; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com

Set-Cookie: ucountry=EU; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com

Set-Cookie: entry=Direct; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com

Vary: User-Agent,Accept-Encoding

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Encoding: gzip

Content-Length: 11322

Keep-Alive: timeout=3, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}Y..I..3. ..;.U....>2.b.....]bUwc..&<#<3.*.......&..E..B.~...P.Z.... `...a!H.. 3w...##.j. ."f."#..>7777...../...szB......>1Mb....In......<!....F$...b..........E..<v.....,&...../..M&..<F...hDV...)...].F.E......q.;V.....MOP.&@Bd...lh0n.....s}.....W0.;.......t.}....L..&Ap)8.z...t........b..0:.......8s|J..0...8.6=.J.....)..4.,..I<5w..M?..cC.f...0v.. ...........,.5...".;.MlF.A...6K"JnI....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!....@......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;.;......Dg....rx.i.^BUi_..,r..R.@N...Z...@..1....(..GF..d...*.7.W...?.........Sf.=..%....3...h!...jd.8.ug..,...^o....tsw.#.....@.._-.'c<..&..t:..Z........1yuBv?.\X&[....{..`...'..o;....d......jswko......j.R..,.mL.c4..)(h$....4._~.l.Sp.J..W ..<aGP.........j*..^VF...l.MY........J...6-{s......j~...........i.=..X.k.A..7.w&..F....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv

<<< skipped >>>

GET /shared/abp_detection/px.js?ch=1 HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: latency-optimizer.sd.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct

HTTP/1.1 200 OK

Date: Fri, 18 Dec 2015 06:49:08 GMT

Server: Apache

Last-Modified: Tue, 12 May 2015 12:57:02 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Sun, 17 Jan 2016 06:49:08 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 236

Keep-Alive: timeout=3, max=100

Connection: Keep-Alive

Content-Type: text/javascript

..........eP.j.!....aQ.1.^.,.z..7c.....&V.@H.....B...o..7......x..cP6..&(ho\...........,.cx.}..]M.Q.!....SQ;.p..i.If.\@r_..3.[...5.....wGq<..=....!B..&b.T#...../l.x."...y......-6...N.....V.......L.\..u...I.;......RF...gRSl....~..5..Z.......

GET /shared/abp_detection/px.js?ch=2 HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: latency-optimizer.sd.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct

HTTP/1.1 200 OK

Date: Fri, 18 Dec 2015 06:49:08 GMT

Server: Apache

Last-Modified: Tue, 12 May 2015 12:57:02 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Sun, 17 Jan 2016 06:49:08 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 236

Keep-Alive: timeout=3, max=99

Connection: Keep-Alive

Content-Type: text/javascript

..........eP.j.!....aQ.1.^.,.z..7c.....&V.@H.....B...o..7......x..cP6..&(ho\...........,.cx.}..]M.Q.!....SQ;.p..i.If.\@r_..3.[...5.....wGq<..=....!B..&b.T#...../l.x."...y......-6...N.....V.......L.\..u...I.;......RF...gRSl....~..5..Z...HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:08 GMT..Server: Apache..Last-Modified: Tue, 12 May 2015 12:57:02 GMT..Accept-Ranges: bytes..Cache-Control: max-age=2592000..Expires: Sun, 17 Jan 2016 06:49:08 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 236..Keep-Alive: timeout=3, max=99..Connection: Keep-Alive..Content-Type: text/javascript............eP.j.!....aQ.1.^.,.z..7c.....&V.@H.....B...o..7......x..cP6..&(ho\...........,.cx.}..]M.Q.!....SQ;.p..i.If.\@r_..3.[...5.....wGq<..=....!B..&b.T#...../l.x."...y......-6...N.....V.......L.\..u...I.;......RF...gRSl....~..5..Z.......

GET /universaldownloader-prefetch HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: latency-optimizer.sd.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct

HTTP/1.1 404 Not Found

Date: Fri, 18 Dec 2015 06:49:10 GMT

Server: Apache

Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:09 GMT; path=/; domain=softonic.com

Vary: User-Agent,Accept-Encoding

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Encoding: gzip

Content-Length: 11324

Keep-Alive: timeout=3, max=98

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}[o.I.... B.;]....U,.Y%S....IM..n.4.BTfTU.y..L^.[o.._|yX....`.n..._.........=..>'"23.RYE.zm..L3 .D./N.8qN\.......7.'d.{......$......6H...9...<..gD...-.9q..>.~..YD,.c.=1...bB...w..>.d...c.,..FdEh...p...h.X.;...`...cu........i.$DF\........An<.....Py.......?K?N'.......Zl....C.cc.;.x...3j.......4 .$.w?....? ...?..M.......bJ.9.8..F.O.].t..>......"'...7.f.|.}.oi4..K~.. ....o...i.y......[.....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!.M..C......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;......^}.3@xd_9<..d/.../.k.9.~). .Q.]...u.K...@.A.[.#...2..t.... Q[...`.......)3..K....b...Sj..]..5.d...3.v...|oc....:......f...g.W..........N.......y.L...W'd....e.E..9..n..a9|....3..^O..P..l...[{[....Z..Jq....1..........J....|.U..O.U !F_......A-..G.2..#....zY..}j.m6e..n...2.(....X.`......j~...........i...-.(...2...w&..f....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv...(.E...:.

<<< skipped >>>

GET /universaldownloader-prefetch HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: latency-optimizer.sd.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct

HTTP/1.1 404 Not Found

Date: Fri, 18 Dec 2015 06:49:11 GMT

Server: Apache

Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:10 GMT; path=/; domain=softonic.com

Vary: User-Agent,Accept-Encoding

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Encoding: gzip

Content-Length: 11321

Keep-Alive: timeout=3, max=97

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}Y..I..3. ..;.U....>2.b.....]bUwc..&<#<3.*.......&..E..B.~...P.Z.... `...a!H.. 3w...##.j. ."f."#..>7777...../...szB......>1Mb....In......<!....F$...b..........E..<v.....,&...../..M&..<F...hDV...)...].F.E......q.;V.....MOP.&@Bd...lh0n.....s}.....W0.;.......t.}....L..&Ap)8.z...t........b..0:.......8s|J..0...8.6=.J.....)..4.,..I<5w..M?..cC.f...0v.. ...........,.5...".;.MlF.A...6K"JnI....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!....@......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;.;......Dg....rx.i.^BUi_..,r..R.@N...Z...@..1....(..GF..d...*.7.W...?.........Sf.=..%....3...h!...jd.8.ug..,...^o....tsw.#.....@.._-.'c<..&..t:..Z........1yuBv?.\X&[....{..`...'..o;....d......jswko......j.R..,.mL.c4..)(h$....4._~.l.Sp.J..W ..<aGP.........j*..^VF...l.MY........J...6-{s......j~...........i.=..X.k.A..7.w&..F....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv

<<< skipped >>>

GET /universaldownloader-prefetch HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: latency-optimizer.sd.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct

HTTP/1.1 404 Not Found

Date: Fri, 18 Dec 2015 06:49:12 GMT

Server: Apache

Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:11 GMT; path=/; domain=softonic.com

Vary: User-Agent,Accept-Encoding

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Encoding: gzip

Content-Length: 11319

Keep-Alive: timeout=3, max=96

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}Y..I..3. ..;.U....>2.b.....]bUwc..&<#<3.*.......&..E..B.~...P.Z.... `...a!H.. 3w...##.j. ."f."#..>7777...../...szB......>1Mb....In......<!....F$...b..........E..<v.....,&...../..M&..<F...hDV...)...].F.E......q.;V.....MOP.&@Bd...lh0n.....s}.....W0.;.......t.}....L..&Ap)8.z...t........b..0:.......8s|J..0...8.6=.J.....)..4.,..I<5w..M?..cC.f...0v.. ...........,.5...".;.MlF.A...6K"JnI....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!....@......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;.;......Dg....rx.i.^BUi_..,r..R.@N...Z...@..1....(..GF..d...*.7.W...?.........Sf.=..%....3...h!...jd.8.ug..,...^o....tsw.#.....@.._-.'c<..&..t:..Z........1yuBv?.\X&[....{..`...'..o;....d......jswko......j.R..,.mL.c4..)(h$....4._~.l.Sp.J..W ..<aGP.........j*..^VF...l.MY........J...6-{s......j~...........i.=..X.k.A..7.w&..F....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv

<<< skipped >>>

GET /aax2/amzn_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 4756

Connection: keep-alive

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public, max-age=86400

ETag: 684fe64613a5f767675bcef1070025ee

Date: Sat, 12 Dec 2015 23:29:50 GMT

Server: Server

Age: 26357

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SFDRPxfKUqCO-y7gGPqX-eQsvPj-gqC5qZR3bjC5xARYN4ts_Ar4SQ==

...........[{s.8..*4.J...j.....'.w...Y?2u... ...P.. e ..._7.$HQ.3..u..X..F..._7.I..E.r....w$.^.?....(x......G....r.....Q.......#..Y.XF..M=..:p.>5....^.'.z.........i..A..............@.9L'^....c...9-J.;K.&..............-.whT."c.u.........$.a.l<\N<.....:D9FY.So..?`......4r....{R.B..<...._.&..6.|......t...:i.......:.iR...ckF....&...q.~!K"b...._v.....,.."7g.#I....F..u..O.\....2t..1.....3....l.F.....V..D.=fE..u.........,.z.#..pJ.....7...K.0...T..... ...S.q...Dh..z.........`.z..#..<....8I."# .VN].....z.5=2.........z...@..G..b...{..........Z......r...-.*.a..\.R.."..I.4..,.t.[..X.cz.DD.Wy.Q.{....~g...x.f.p.Y......p{.-.N`v..{0..d.P.\...S....../.i.........,.qCz..O......M<..I.q.t..6......|.5.......v...8....p.|t.6.>Xl..-((L"..[.>l..?\...y^.C....|.........~2.........(2~sg....v..v....p8..F...6D...m...Q.v"{....:........=p.b....E...oh98....J...q&`.8#.._..F.8a^w.I@.z7 .Y...Q...0Q.....X.}..O..G^N...9.R?D?M...zy.... .. ..C..4f...`..j......\\T.5(.e..7....X..,.d.1.%.l... .z'.>.....Dw...5...L'......Y$..t.1d......'.\}...D..L4.,...ey..5.. ..&`....x..!...=.;f...?.?C.&H..{N......h.8.T.&..<.sn7!.[.~..s;..=o...*.._..P)T...-....m....A.Zx>....CT...I..;.,.g.......c$T..e$.|N. .r?..v.{.......,....Y=r..TD..}Y........A.g~...{.....R.o...U.....*..Z.....f..!Q...u3Xj<p..T.a.Z....A.....H<....wG...AR.......f....R..~.m5.......Hq.\.Y..^..pw....]7y!.y..&5l.........g. ....x!....md.....m.t......._{..x-.U.A.J..o..........^..e.. =......kg^.H.^.........t.).....y..H..!.4K..{....:..8...]_^.*QH' ......;...rJ.9{.t......Y.6^

<<< skipped >>>

GET /safeframe/1-0-2/html/container.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tpc.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/html

Date: Wed, 16 Dec 2015 18:25:20 GMT

Expires: Thu, 15 Dec 2016 18:25:20 GMT

Last-Modified: Fri, 16 Jan 2015 15:36:52 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1877

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 131029

......n....W{s....?..0.........X.....i...h.v;.dC....Wc..=..Wr.wwv.u.<..yR.=.l.|.jj..D.;......F}..."..;l..;.t..F........%..B..&.<..{J!..o.$.G..p.R...e.K....7-.._...<bD...0....'1s.i......3G.X..D.....L3G2.x8.......8.D...?M(.<".pd.dI...%b>dIO.N.Cz..`...q1......x$h.I.#...s&.<..|..m.Ke$..\G.a$.ZC..D..D..<...G..|)....v..~2...Vx..m.)8Jj.....e.^.#Y..."0.}....!.....n:......!.b~:j.a.........g.t..n.`O../...V^...I.Z.*"..,.1-..c.qv.Ib]JA.l. ....R.;U...<.k......}..U.....L...<..o...3..ni.|ze.M]..._.k.]....~.J..z.Z............$.S.p..AV.1.X...G}..I..S@b...>h<M.....!......\e.K..K....b.M......-~.C....p.:m....x...D..._!@...d.x.... .)s.B!.v..t..q........1...O<.?..".u...'>.N.....9}.... .{h..%...-DZV.k...t..<.!a...*uD.%6.t......n...^8..>JN.E..<..Op..u.......=s.B..Q.U.6v...%.o....y(...].V!...>*....{8.|.N......Y5 .0.......?.....`c..]..\Rvz.GY......c....-....C79_.9..5.3..Vh^....`......8.T.@|%.....t.OrU<RJ.Y.9.".u:..\X.x.....G._q.?Q......}..k.Q..kF....n0.m...v..l.......I.%.L.R0.....i,.$..26..."Q...sK..X..|...>.|SRq:.Bh...q....k.M.....V..G.O.x.C.,.Ho.Z.F2.R9r.Z.z.uR_b.J`.?p^9...e.rDv...#.".NR..G....m.x.9".......H.Xo....Q...'..S"...b...JFm...y...r....$......-.}..)K~O......j..q....xF*nS.n.g......aJ'L;..(.lhBy.....|..;..0....c.......ws.8-..Jq........K......D[.C..P..........8...0N,..a._).X.g..q....s..=..T;..M..l.B....Z[.o.\...c..z....a.-..{ ...S1f.t....y.nv...T.........>8I.|.Sb.......:...{C..._.Nq..H....Z8-...MT.F...X.<.jM.........Tuj.$.4..2..HPM$...Na...^.1....e9....*Z.8=...}.Y..?

<<< skipped >>>

GET /es/js/generated/7b1b9-727eb.js HTTP/1.1

Accept: */*

Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v2es.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 17 Dec 2015 14:56:18 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Length: 37900

Accept-Ranges: bytes

Date: Fri, 18 Dec 2015 06:49:07 GMT

Connection: keep-alive

Age: 0

X-Served-By: generated

X-Cache: HIT

X-Cache-Hits: 406817

Expires: Sun, 17 Jan 2016 06:49:07 GMT

.............V.H.(.~....)........NUn..Lg.@'d..A.=dK...d$.0......[?.....~..=...;.....d.j......:c.c..W.l..~..E.Z..._.^.....W.l.D.(....2........_D.(..e'.e.......Yg.O.|.%fi"..0_.E.9..... ..l4..Q^..._..t...A.....l.g..c..&....v.....,...E...B......U.L:.y...%I8*.....(..,.?c..f.b...}.D.8. .$.`....O.....1ph...8.........|..@a.v.E."...P%aj.YT..Q......(.......y...n........."M....F......6..`.0...hs....$..:.9.Q.0.(...t..../..@..FG...A...*...4...O...6..Yd7..$.e....>.....i.......i........3.'|../..A.~.....3wf...r....9..;..{......;g.' .bQ..m....."l.[..|.....q..Y.~f.x..m...7.Oggk...vzY..HZ.-k`m}Z...v....|.E.......^...~..i.P...dRLWa...q.7.~?."h.~...v..dC....j%..../.r....hn..z...g.qX....S....`?. V.\ ."..........V.<.. r..........)>.B...>Q7...QF...{s.Z....$.......g.. .Q.... ...7.........<.{w.}m.v..^..W........EzZd.....c.R..P .upp.<..{Q..*.gO...2......../.,.M...i.rT...n.G..........2........o..,..Y.l...~h.;......q..........D./...n...5;-.....gB.c7/.9=h.w..7....u...;t.$/.......@..;..W.(..<..Q.HT.ZQ.>.......].J.P!."J.lR.g..'....?...6'..!@..../....DD.._9.n.~6Y..s.... ..,.....x.FdtN.../F..........:r.mIR..@.m..m.R.a..C?.>.V%.^..?K.t~..j ...^...2.....I...gon...~.u.Y.4P.{. AP...,..<A...vz....v...... .....~.F92..U.G.`nf)D......B.T....Ap.4b.....^#...`U\5....}. H.&@.Y$...,....v.%.....5H`....z....3......a.....p....h...H............C..F.......`..@n.E>mk .=t.X..F....z...-........w....D..r...S.....~!f.l.%n.B.......l..*d....Fl.,!...{...A9...h....u...|..q...g..\ h.V..Y.R..I.......-G9,.6.G'...#..u..0;.0;...<.;........g

<<< skipped >>>

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_468:

`.rsrc

`.rsrc

j;j.htzR

j;j.htzR

j;j.hD}R

j;j.hD}R

G><.tn>

G><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

88888888888888888

%u$Vj%

%u$Vj%

t.Gj:W

t.Gj:W

.tMHtJH

.tMHtJH

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

j;j.hh

j;j.hh

hTCP

hTCP

%s:%d

%s:%d

WARNING: failed to save cookies in %s

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

malformed

:]://%[^

:]://%[^