Trojan.Win32.Swrort.3.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Worm, Virus, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 9c3e3cbe96ca691aa95706db7bbf8219
SHA1: 8936b6c7ea260e1c570583a987fb7e5e6f8b179a
SHA256: 61f23a3b7fecd4f33fbc4b3c080d7aa73b513ec50c9877f362d640d42828383b
SSDeep: 12288:TTHiFlkI9s6dRi7X4 C9rr5TLeqvkQmoSNvAjavZg878u:TTHEkBORij4 yrrlL 3QaRg23
Size: 476000 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-11-12 11:47:15
Analyzed on: WindowsXP SP3 32-bit
Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Virus creates the following process(es):No processes have been created.The Virus injects its code into the following process(es):
%original file name%.exe:468
Explorer.EXE:1140
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:468 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\universaldownloader-prefetch[1].htm (93 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=8777117 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[2].htm (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\OpenSans-CondBold-webfont[1].eot (2077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=6157950 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[3].htm (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\OpenSans-CondLight-webfont[1].eot (492 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2d9b4-fff45[1].css (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondLight-webfont[1].eot (974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_78[1].js (3472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\90f12-4a489[1].css (1391 bytes)
C:\illrd.pif (103 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\container[1].html (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\eaa2a-e6efe[1].js (2356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b5ae7-49f02[1].css (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bid[1].com/universaldownloader-prefetch&cb=2033782 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\font-icon[1].eot (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gpt[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (7961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondBold-webfont[1].eot (2783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\427b6-cd0ca[1].js (399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\font-icon[1].eot (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bid[1].com/universaldownloader-prefetch&cb=3057370 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\container[1].htm (4 bytes)
C:\autorun.inf (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windwiiww.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondBold-webfont[1].eot (1621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\4cd46-1a865[1].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\7b1b9-727eb[1].js (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1467b-931a2[1].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondLight-webfont[1].eot (1418 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\font-icon[1].eot (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[2].js (15 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondLight-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\OpenSans-CondBold-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondBold-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windwiiww.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\OpenSans-CondLight-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\font-icon[1].eot (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondLight-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondBold-webfont[1].eot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\font-icon[1].eot (0 bytes)
Registry activity
The process %original file name%.exe:468 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494852394"
"a2_349" = "2502017258"
"a2_346" = "2480520237"
"a2_347" = "2487687120"
"a2_344" = "2466184000"
"a2_345" = "2473353194"
"a2_342" = "2451833211"
"a2_343" = "2459002794"
"a2_340" = "2437499011"
"a2_341" = "2444662162"
"a2_180" = "1290439005"
"a2_181" = "1297603234"
"a2_182" = "1304772875"
"a2_183" = "1311955452"
"a2_184" = "1319124122"
"a2_185" = "1326295496"
"a2_186" = "1333448237"
"a2_187" = "1340623672"
"a2_188" = "1347788980"
"a2_189" = "1354971212"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a2_749" = "1074694922"
"a2_742" = "1024518441"
"a2_743" = "1031697984"
"a2_740" = "1010184633"
"a2_741" = "1017353628"
"a2_746" = "1053201850"
"a2_747" = "1060357994"
"a2_744" = "1038850527"
"a2_745" = "1046022438"
"a1_503" = "1289098190"
"a1_502" = "2775347331"
"a1_501" = "333007691"
"a1_500" = "2573676751"
"a1_507" = "2186630469"
"a1_506" = "2161527166"
"a1_505" = "1296232419"
"a1_504" = "2372508319"
"a1_509" = "3881996823"
"a1_508" = "2438879274"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "3629647296"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "1730366082"
"a1_434" = "2737588828"
"a1_433" = "1802007237"
"a1_432" = "1876476399"
"a1_431" = "3197684497"
"a1_430" = "2336003313"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a3_449" = "3202245640"
"a1_636" = "847710378"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "968066179"
"a1_728" = "1864324481"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "493978988"
"a2_748" = "1067542717"
"a1_593" = "2782795690"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_980" = "2825588505"
"a1_855" = "3273582252"
"a3_655" = "383827462"
"a1_857" = "3423790585"
"a1_856" = "3782902502"
"a1_851" = "1009752367"
"a1_850" = "1230931884"
"a1_853" = "4158345358"
"a3_654" = "376767975"
"a1_859" = "4100188110"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "1281675219"
"a1_184" = "4235810789"
"a1_183" = "2424927341"
"a1_182" = "1426679400"
"a1_181" = "3984378926"
"a1_180" = "3933629539"
"a1_963" = "3389375077"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "1574230759"
"a1_801" = "577756991"
"a4_824" = "1612388408"
"a4_393" = "2817464553"
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "2721776215"
"a4_866" = "1913491490"
"a1_933" = "2398753000"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "3739952026"
"a4_863" = "1891984127"
"a1_936" = "3199757047"
"a4_862" = "1884815006"
"a1_937" = "2738178384"
"a2_405" = "2903496130"
"a2_404" = "2896328597"
"a2_407" = "2917829974"
"a2_406" = "2910660841"
"a2_401" = "2874811094"
"a2_400" = "2867646442"
"a2_403" = "2889162261"
"a2_402" = "2881993649"
"a1_935" = "3282785785"
"a2_409" = "2932163738"
"a2_408" = "2924993401"
"a2_975" = "2694932645"
"a2_974" = "2687758881"
"a2_977" = "2709261238"
"a2_976" = "2702087189"
"a2_971" = "2666242258"
"a2_970" = "2659077042"
"a2_973" = "2680593719"
"a4_896" = "2128565120"
"a2_979" = "2723596267"
"a2_978" = "2716429629"
"a1_222" = "2489351844"
"a1_223" = "3451521042"
"a1_220" = "1074383877"
"a1_221" = "1020038004"
"a1_226" = "2019964972"
"a1_227" = "3466626249"
"a1_224" = "1899529148"
"a1_225" = "1716077079"
"a1_228" = "1788844246"
"a1_229" = "2409125531"
"a2_579" = "4150926086"
"a2_578" = "4143757861"
"a2_571" = "4093573407"
"a2_570" = "4086389803"
"a2_573" = "4107907472"
"a2_572" = "4100739469"
"a2_575" = "4122242137"
"a2_574" = "4115074157"
"a2_577" = "4136576123"
"a2_576" = "4129407405"
"a2_351" = "2516367898"
"a2_350" = "2509186813"
"a2_353" = "2530704734"
"a2_352" = "2523535827"
"a2_355" = "2545035828"
"a2_354" = "2537869477"
"a2_357" = "2559371130"
"a2_356" = "2552205245"
"a2_359" = "2573717963"
"a2_358" = "2566537718"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642486"
"a2_192" = "1376473649"
"a2_191" = "1369294624"
"a2_190" = "1362126336"
"a2_197" = "1412311042"
"a2_196" = "1405155846"
"a2_195" = "1397973552"
"a2_194" = "1390808356"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426662504"
"a2_198" = "1419493073"
"a3_625" = "168917752"
"a2_759" = "1146392093"
"a3_626" = "175906587"
"a2_755" = "1117724506"
"a2_754" = "1110542214"
"a2_757" = "1132055375"
"a3_627" = "183481274"
"a2_751" = "1089036947"
"a2_750" = "1081871784"
"a2_753" = "1103386870"
"a2_752" = "1096207315"
"a1_536" = "1685242734"
"a1_537" = "2702755620"
"a1_534" = "64504847"
"a1_535" = "3918041579"
"a1_89" = "933397518"
"a1_88" = "884484586"
"a1_530" = "2052196235"
"a1_531" = "3914111119"
"a1_85" = "2726509448"
"a1_84" = "2046411405"
"a1_87" = "3608648517"
"a1_86" = "3262699560"
"a1_81" = "772774026"
"a1_80" = "1900545131"
"a1_83" = "3989493309"
"a1_82" = "1265175629"
"a3_914" = "2274560123"
"a2_898" = "2142896883"
"a1_896" = "425862383"
"a1_890" = "2801433460"
"a2_899" = "2150080756"
"a1_67" = "1237487581"
"a1_66" = "2703271503"
"a1_65" = "2757074931"
"a3_133" = "970345548"
"a1_63" = "3903951862"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "463476838"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "3098909359"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "3173260404"
"a1_68" = "1665106448"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "3411785415"
"a1_409" = "2627109920"
"a1_402" = "1011609324"
"a1_403" = "1139811050"
"a1_400" = "1685364292"
"a1_401" = "1731085130"
"a1_406" = "2376808691"
"a1_407" = "1986396780"
"a1_404" = "679608651"
"a1_405" = "3319325628"
"a2_823" = "1605216692"
"a2_822" = "1598057892"
"a2_821" = "1590882892"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633902446"
"a1_628" = "3784207239"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "1242571615"
"a2_826" = "1626731888"
"a2_825" = "1619550369"
"a1_718" = "1878447796"
"a1_719" = "2228065354"
"a1_716" = "3747808645"
"a1_717" = "1219812883"
"a1_714" = "3804805845"
"a1_715" = "3927092919"
"a1_712" = "1325490550"
"a1_713" = "1446560612"
"a1_710" = "1056900168"
"a1_711" = "926792506"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "3362191855"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a2_941" = "2451167414"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "2434143285"
"a1_889" = "2281337189"
"a1_886" = "4132739873"
"a1_887" = "4074567018"
"a1_884" = "429184842"
"a1_885" = "3073641373"
"a1_882" = "235706989"
"a1_883" = "2950282954"
"a1_880" = "2093352798"
"a1_881" = "3914835821"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251294294"
"a3_444" = "3166269973"
"a3_445" = "3206813364"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Aas]
"a1_831" = "2602066283"
"a2_592" = "4244127379"
"a1_930" = "3100047064"
"a1_948" = "2919141485"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "3906977569"
"a1_723" = "3663901041"
"a1_722" = "389807918"
"a1_721" = "2027862068"
"a1_720" = "2923080172"
"a1_768" = "993062741"
"a1_727" = "4127948856"
"a1_726" = "1091345994"
"a2_643" = "314769916"
"a2_790" = "1368644111"
"a1_725" = "240836072"
"a2_642" = "307604541"
"a1_724" = "2630993898"
"a2_641" = "300437371"
"a2_640" = "293267879"
"a2_647" = "343452428"
"a2_646" = "336293653"
"a1_158" = "3183835783"
"a1_159" = "580588414"
"a2_645" = "329119111"
"a1_150" = "996678536"
"a1_151" = "4104351629"
"a1_152" = "2531653670"
"a1_153" = "1142198857"
"a1_154" = "2255005195"
"a1_155" = "3664357365"
"a1_156" = "2302662213"
"a1_157" = "2578994476"
"a1_235" = "3073116383"
"a1_234" = "1692768242"
"a1_237" = "2346742791"
"a1_236" = "3790733621"
"a1_231" = "1704926174"
"a1_230" = "1849330324"
"a1_233" = "2830009361"
"a1_232" = "1987975807"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Aas]
"a1_239" = "2305603294"
"a1_238" = "247112268"
"a2_210" = "1505512575"
"a2_211" = "1512680758"
"a2_212" = "1519861704"
"a2_213" = "1527028546"
"a2_214" = "1534183819"
"a2_215" = "1541361764"
"a2_216" = "1548527572"
"a2_217" = "1555695668"
"a2_218" = "1562861821"
"a2_219" = "1570030173"
"a1_966" = "4185437513"
"a2_508" = "3641911782"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Aas]
"a2_504" = "3613231567"
"a2_505" = "3620412025"
"a2_506" = "3627580363"
"a2_507" = "3634752748"
"a2_500" = "3584562446"
"a2_501" = "3591727351"
"a2_502" = "3598907255"
"a2_503" = "3606062177"
"a2_791" = "1375812550"
"a2_698" = "709078668"
"a2_699" = "716243476"
"a2_694" = "680395422"
"a2_695" = "687578458"
"a2_696" = "694746776"
"a2_697" = "701912598"
"a2_690" = "651727158"
"a2_691" = "658892808"
"a2_692" = "666061971"
"a2_693" = "673227898"
"a2_324" = "2322800479"
"a2_325" = "2329966952"
"a2_326" = "2337131101"
"a2_327" = "2344299374"
"a2_320" = "2294113254"
"a2_321" = "2301283873"
"a2_322" = "2308466271"
"a2_323" = "2315617832"
"a1_521" = "4154998587"
"a1_520" = "2416305939"
"a1_523" = "2378747291"
"a1_522" = "2555430044"
"a2_328" = "2351466243"
"a2_329" = "2358648222"
"a1_527" = "2251870707"
"a1_526" = "1364041855"
"a2_799" = "1433164820"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Aas]
"a2_798" = "1425982356"
"a4_962" = "2601727106"
"a1_98" = "912101749"
"a1_99" = "1294940661"
"a1_92" = "349526536"
"a1_93" = "1394749409"
"a1_90" = "1891469092"
"a1_91" = "45773323"
"a1_96" = "1142893348"
"a1_97" = "3312800135"
"a1_94" = "2909444900"
"a1_95" = "196413757"
"a1_74" = "2705637044"
"a1_75" = "2916885461"
"a1_76" = "586003609"
"a1_77" = "778492153"
"a1_70" = "779879387"
"a1_71" = "1618253490"
"a1_72" = "3154050064"
"a1_73" = "4066546870"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "726810716"
"a1_79" = "3443493554"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "579052213"
"a1_418" = "1711388463"
"a3_953" = "2520368944"
"a1_415" = "2180369295"
"a1_414" = "3609845889"
"a1_417" = "554236756"
"a1_416" = "1539077985"
"a1_411" = "883622913"
"a1_410" = "115325711"
"a1_413" = "2964702584"
"a1_412" = "2945086112"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "321832225"
"a1_700" = "1659642631"
"a1_703" = "2015464198"
"a1_702" = "1238511779"
"a1_705" = "3593067108"
"a1_704" = "959141147"
"a1_707" = "3909569452"
"a1_706" = "4237662780"
"a1_709" = "682361240"
"a1_708" = "2394127857"
"a2_360" = "2580885861"
"a4_838" = "1712756102"
"a2_361" = "2588061438"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595219965"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609552075"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616745338"
"a2_366" = "2623904963"
"a2_367" = "2631072260"
"a1_743" = "690298679"
"a2_168" = "1204404929"
"a2_169" = "1211585054"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a3_279" = "1983582110"
"a4_973" = "2680587437"
"a2_161" = "1154236116"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "1207603662"
"a3_776" = "1251683361"
"a1_893" = "2688615471"
"a1_892" = "1257582889"
"a1_895" = "751189163"
"a1_894" = "244479187"
"a1_897" = "1726457222"
"a3_777" = "1292288064"
"a1_899" = "105136424"
"a1_898" = "2509919988"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261952409"
"a1_617" = "1816816405"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "50325372"
"a2_459" = "3290618208"
"a3_678" = "548713167"
"a1_614" = "2847432733"
"a1_820" = "3968888770"
"a1_821" = "401118019"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Aas]
"a1_822" = "1272414664"
"a1_149" = "29037390"
"a1_148" = "471670861"
"a1_143" = "983945332"
"a1_142" = "2834666244"
"a1_141" = "3992598576"
"a1_140" = "2180223026"
"a1_147" = "2370850024"
"a1_146" = "2708738125"
"a1_145" = "882339242"
"a1_144" = "4019472875"
"a1_826" = "1036992663"
"a1_827" = "3552589061"
"a2_203" = "1455326420"
"a2_202" = "1448160528"
"a2_201" = "1440992889"
"a2_200" = "1433827441"
"a2_207" = "1483999468"
"a2_206" = "1476841758"
"a2_205" = "1469675585"
"a2_204" = "1462495779"
"a2_209" = "1498344866"
"a2_208" = "1491185243"
"a2_519" = "3720782807"
"a2_518" = "3713598317"
"a2_517" = "3706427044"
"a2_516" = "3699265057"
"a2_515" = "3692098171"
"a2_514" = "3684931981"
"a2_513" = "3677750694"
"a2_512" = "3670599171"
"a2_511" = "3663415045"
"a2_510" = "3656246619"
"a2_689" = "644562942"
"a2_688" = "637393032"
"a2_687" = "630226463"
"a2_686" = "623046441"
"a2_685" = "615878061"
"a2_684" = "608710189"
"a2_683" = "601543342"
"a2_682" = "594378513"
"a2_681" = "587207014"
"a2_680" = "580039905"
"a2_337" = "2416000588"
"a2_336" = "2408819258"
"a2_335" = "2401648720"
"a2_334" = "2394478543"
"a2_333" = "2387316316"
"a2_332" = "2380138502"
"a2_331" = "2372983809"
"a2_330" = "2365800713"
"a1_554" = "4031425104"
"a1_555" = "1698498578"
"a1_556" = "2861098768"
"a1_557" = "2164135600"
"a3_242" = "1718323611"
"a1_551" = "1678151561"
"a2_339" = "2430323129"
"a2_338" = "2423166113"
"a4_673" = "529851137"
"a1_918" = "1123228085"
"a1_919" = "2867921663"
"a3_243" = "1725243962"
"a1_852" = "237446941"
"a1_914" = "3459866953"
"a1_398" = "1523665848"
"a1_399" = "2094650216"
"a4_679" = "572865863"
"a1_392" = "2307672372"
"a1_393" = "1888171184"
"a1_390" = "609470111"
"a1_391" = "3797554814"
"a1_396" = "1056561746"
"a1_397" = "1106541476"
"a1_394" = "1586737012"
"a1_395" = "2492381206"
"a1_858" = "1745999822"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "2767232235"
"a1_48" = "3882507113"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "306999407"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "4073519669"
"a1_775" = "695504115"
"a1_776" = "3435740016"
"a1_777" = "4009788208"
"a1_191" = "3552991125"
"a1_771" = "3785988987"
"a1_772" = "1111807434"
"a1_773" = "834166987"
"a1_953" = "2485035852"
"a3_927" = "2367492374"
"a1_778" = "3800000423"
"a1_779" = "1345613551"
"a3_926" = "2326953207"
"a2_17" = "121877862"
"a2_16" = "114710827"
"a2_15" = "107542335"
"a2_14" = "100363250"
"a2_13" = "93193275"
"a2_12" = "86027344"
"a2_11" = "78869254"
"a2_10" = "71692661"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "1779819787"
"a2_19" = "136210630"
"a2_18" = "129046645"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "641591917"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "2782872778"
"a1_596" = "1656121629"
"a1_597" = "4071300104"
"a1_608" = "2029719518"
"a1_609" = "2019726764"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "689925315"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "229419654"
"a3_484" = "3486690637"
"a1_952" = "3794368368"
"a2_925" = "2336466090"
"a1_954" = "2749583040"
"a1_955" = "1767986857"
"a1_956" = "563585633"
"a3_485" = "3460055532"
"a1_958" = "874255917"
"a2_922" = "2314965157"
"a1_750" = "2243958423"
"a1_751" = "3137363930"
"a1_756" = "1957542189"
"a1_757" = "1164913387"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "2026911932"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "919282982"
"a4_903" = "2178748967"
"a1_188" = "2452082001"
"a4_900" = "2157241604"
"a1_187" = "2879860372"
"a4_901" = "2164410725"
"a1_186" = "1083904200"
"a2_929" = "2365149746"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "2786767918"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "1605072226"
"a1_558" = "763881015"
"a1_559" = "714817972"
"a1_606" = "4294900672"
"a3_925" = "2319505492"
"a1_178" = "2597114828"
"a1_179" = "108989342"
"a1_176" = "1096841446"
"a1_177" = "3064443053"
"a1_174" = "3912626986"
"a1_175" = "2644986132"
"a1_172" = "2114518869"
"a1_173" = "871798835"
"a1_170" = "2703951318"
"a1_171" = "2618883447"
"a1_550" = "4061667391"
"a2_236" = "1691914819"
"a2_237" = "1699084241"
"a2_234" = "1677580685"
"a2_235" = "1684749277"
"a2_232" = "1663227826"
"a2_233" = "1670398620"
"a2_230" = "1648900150"
"a2_231" = "1656063127"
"a1_553" = "2574213336"
"a2_238" = "1706247505"
"a2_239" = "1713410885"
"a2_522" = "3742284541"
"a2_523" = "3749447691"
"a2_520" = "3727947653"
"a2_521" = "3735114174"
"a2_526" = "3770951330"
"a2_527" = "3778131340"
"a2_524" = "3756610909"
"a2_525" = "3763785510"
"a2_838" = "1712764587"
"a2_839" = "1719918064"
"a2_528" = "3785299781"
"a2_529" = "3792466388"
"a3_688" = "620670617"
"a1_626" = "1368579320"
"a1_541" = "1559993000"
"a1_627" = "123251369"
"a1_624" = "2551796430"
"a1_549" = "2380962741"
"a1_548" = "1084823753"
"a1_547" = "1450125556"
"a1_546" = "3118788702"
"a1_545" = "3834770388"
"a1_544" = "311112822"
"a1_543" = "1754567658"
"a1_542" = "1756464597"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a1_540" = "3512102837"
"a2_658" = "422319701"
"a2_659" = "429488397"
"a2_308" = "2208095292"
"a2_309" = "2215250164"
"a2_302" = "2165079829"
"a2_303" = "2172251384"
"a2_300" = "2150742723"
"a2_301" = "2157910450"
"a2_306" = "2193742047"
"a2_307" = "2200928218"
"a2_304" = "2179410699"
"a2_305" = "2186579320"
"a2_786" = "1339959305"
"a2_787" = "1347128244"
"a2_784" = "1325626798"
"a2_785" = "1332794540"
"a2_782" = "1311293261"
"a2_783" = "1318462612"
"a2_780" = "1296944426"
"a2_781" = "1304109813"
"a2_788" = "1354291691"
"a2_789" = "1361464174"
"a1_389" = "3093162027"
"a1_388" = "1832181176"
"a1_385" = "1812276144"
"a1_384" = "1465773037"
"a1_387" = "428111864"
"a1_386" = "2504949531"
"a1_381" = "2087563891"
"a1_380" = "44326289"
"a1_383" = "3190492442"
"a1_382" = "3775943364"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Aas]
"a1_58" = "275986991"
"a1_59" = "1788717829"
"a1_56" = "4204613264"
"a1_57" = "3288152270"
"a1_54" = "4273674148"
"a1_55" = "3495093677"
"a1_52" = "313596130"
"a1_53" = "1801466665"
"a1_50" = "1308731706"
"a1_51" = "390918113"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "475298747"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a2_916" = "2271951995"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "3716559112"
"a1_764" = "643683113"
"a1_762" = "510142461"
"a1_761" = "1077202415"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257601473"
"a4_858" = "1856138522"
"a1_586" = "3700722261"
"a1_789" = "2259799102"
"a3_720" = "849951481"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "1328089437"
"a1_619" = "2031224533"
"a1_618" = "1699889937"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "857950011"
"a4_522" = "3742281162"
"a2_62" = "444488310"
"a4_523" = "3749450283"
"a2_63" = "451653384"
"a4_524" = "3756619404"
"a1_971" = "2648712066"
"a2_60" = "430155773"
"a4_525" = "3763788525"
"a1_943" = "1712121598"
"a1_942" = "2028349330"
"a1_941" = "390723208"
"a2_61" = "437307440"
"a1_947" = "3005121930"
"a4_526" = "3770957646"
"a1_945" = "1538657550"
"a1_944" = "263863564"
"a2_66" = "473168873"
"a1_949" = "618900427"
"a4_527" = "3778126767"
"a2_67" = "480337061"
"a2_64" = "458819027"
"a2_65" = "465986779"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "3318058007"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "2636385944"
"a1_41" = "3264452572"
"a1_40" = "3111120883"
"a1_43" = "1907532950"
"a3_819" = "1559971962"
"a1_42" = "750272212"
"a3_813" = "1516544548"
"a1_45" = "1518047315"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "2605895526"
"a1_47" = "872291218"
"a1_46" = "1434958100"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a1_783" = "2414964729"
"a3_757" = "1115339004"
"a1_959" = "3591306358"
"a2_907" = "2207430370"
"a1_161" = "2849728076"
"a1_160" = "876965737"
"a1_163" = "1131222356"
"a1_162" = "1853126929"
"a1_165" = "2205250557"
"a1_164" = "3801439637"
"a1_167" = "2631346698"
"a1_166" = "255094493"
"a1_169" = "1394997081"
"a1_168" = "3492356378"
"a3_727" = "933979486"
"a2_535" = "3835482941"
"a2_534" = "3828316155"
"a2_537" = "3849818888"
"a2_536" = "3842641726"
"a2_531" = "3806801880"
"a2_530" = "3799632439"
"a2_533" = "3821136666"
"a2_532" = "3813968996"
"a2_829" = "1648235519"
"a2_828" = "1641070389"
"a2_539" = "3864150660"
"a2_538" = "3856984720"
"a4_447" = "3204597087"
"a1_572" = "1169956337"
"a1_573" = "4138238515"
"a1_570" = "3369841982"
"a1_571" = "1080609794"
"a1_576" = "655867414"
"a1_577" = "441796381"
"a1_574" = "2120383016"
"a1_575" = "4240295567"
"a1_578" = "4101076059"
"a1_579" = "3200353581"
"a2_649" = "357786313"
"a2_648" = "350620423"
"a2_319" = "2286946621"
"a2_318" = "2279777885"
"a2_315" = "2258277564"
"a2_314" = "2251096108"
"a2_317" = "2272614132"
"a2_316" = "2265444395"
"a2_311" = "2229593718"
"a2_310" = "2222430445"
"a2_313" = "2243928197"
"a2_312" = "2236774315"
"a2_229" = "1641730468"
"a2_228" = "1634551221"
"a2_221" = "1584381146"
"a2_220" = "1577214900"
"a2_223" = "1598712180"
"a2_222" = "1591546446"
"a2_225" = "1613046582"
"a2_224" = "1605881147"
"a2_227" = "1627397402"
"a2_226" = "1620216389"
"a1_370" = "3662176879"
"a1_371" = "2805483461"
"a1_372" = "1394931418"
"a1_373" = "1845125870"
"a1_374" = "1557724936"
"a1_375" = "3240925017"
"a1_376" = "3408856262"
"a1_377" = "2169108116"
"a1_378" = "2395164948"
"a1_379" = "3820501985"
"a2_793" = "1390144630"
"a2_792" = "1382979383"
"a2_795" = "1404477538"
"a2_794" = "1397323767"
"a2_797" = "1418829706"
"a2_796" = "1411647290"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "390669480"
"a1_28" = "3728944565"
"a1_590" = "4041964247"
"a1_23" = "1807237385"
"a1_22" = "2705231736"
"a1_21" = "1149257862"
"a1_20" = "2257338338"
"a1_27" = "2459097974"
"a1_26" = "2915035876"
"a1_25" = "1063100174"
"a1_24" = "3060540112"
"a1_284" = "1472596932"
"a1_285" = "1269386886"
"a1_286" = "847787492"
"a1_287" = "875623797"
"a1_280" = "3815323279"
"a1_281" = "1640307239"
"a1_282" = "2412434419"
"a1_283" = "1854192484"
"a3_31" = "205278614"
"a1_288" = "1668491341"
"a1_289" = "2658207454"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746497"
"a1_591" = "120062266"
"a3_32" = "212854281"
"a2_972" = "2673426106"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "738874774"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "1763556140"
"a1_599" = "1918880335"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222248810"
"a2_30" = "215078269"
"a2_33" = "236580609"
"a2_32" = "229415886"
"a2_35" = "250913765"
"a2_34" = "243745145"
"a2_37" = "265265202"
"a2_36" = "258080782"
"a2_39" = "279598774"
"a2_38" = "272418653"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186758479"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193943374"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "3984217025"
"a1_625" = "2833212300"
"a1_622" = "1300569148"
"a1_623" = "2379153855"
"a1_620" = "1283151700"
"a1_621" = "12459835"
"a3_643" = "331380106"
[HKCU\Software\Aas\695404737]
"7169121" = "214"
[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "1496052142"
"a2_588" = "4215446075"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222610939"
"a1_976" = "1011201377"
"a1_977" = "2955171694"
"a1_974" = "2383164092"
"a1_975" = "1028747732"
"a1_972" = "3364050977"
"a1_973" = "2399111703"
"a1_970" = "3552079300"
"a3_827" = "1616916338"
"a1_770" = "3299539687"
"a1_978" = "2905269594"
"a1_979" = "1481901111"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Aas]
"a4_199" = "1426655079"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Aas]
"a3_504" = "3596547281"
"a2_363" = "2602389293"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157247272"
"a1_746" = "2418866319"
"a4_827" = "1633895771"
"a2_901" = "2164416010"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171583079"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185915879"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193080565"
"a2_906" = "2200248403"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "1204588851"
"a1_115" = "859258829"
"a1_116" = "1305412024"
"a1_117" = "2010487296"
"a1_110" = "1951869617"
"a1_111" = "3512983633"
"a1_112" = "3447712449"
"a1_113" = "3456119454"
"a1_824" = "622026853"
"a1_118" = "2886972403"
"a1_119" = "3817081210"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570225975"
"a2_499" = "3577395142"
"a2_492" = "3527209911"
"a2_493" = "3534384918"
"a2_490" = "3512875573"
"a2_491" = "3520041016"
"a2_496" = "3555875671"
"a2_497" = "3563058326"
"a2_494" = "3541543669"
"a2_495" = "3548722248"
"a2_816" = "1555026955"
"a2_817" = "1562199871"
"a2_814" = "1540700929"
"a2_815" = "1547875080"
"a2_812" = "1526364726"
"a3_740" = "1026900557"
"a2_810" = "1512014647"
"a2_811" = "1519180417"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569368763"
"a2_819" = "1576549235"
"a1_565" = "1704621223"
"a1_564" = "2047476973"
"a1_567" = "2051875210"
"a1_566" = "2861863481"
"a1_561" = "4129318606"
"a1_560" = "4247908205"
"a1_563" = "4062783767"
"a1_562" = "2129168699"
"a1_569" = "2273142223"
"a1_568" = "545782631"
"a1_525" = "1859277219"
"a2_678" = "565693741"
"a2_679" = "572859612"
"a2_676" = "551357535"
"a2_677" = "558526247"
"a2_674" = "537033791"
"a2_675" = "544191686"
"a2_672" = "522674205"
"a2_673" = "529856866"
"a2_670" = "508342009"
"a2_671" = "515506958"
"a2_258" = "1849625154"
"a2_259" = "1856804572"
"a2_254" = "1820953975"
"a2_255" = "1828119896"
"a2_256" = "1835287515"
"a2_257" = "1842470595"
"a2_250" = "1792285235"
"a2_251" = "1799452479"
"a2_252" = "1806621040"
"a2_253" = "1813783610"
"a1_363" = "3929826981"
"a1_362" = "3578035727"
"a1_361" = "4210573468"
"a1_360" = "3645961045"
"a1_367" = "2426777954"
"a1_366" = "3533831270"
"a1_365" = "1317892889"
"a1_364" = "230736769"
"a1_369" = "690866568"
"a1_368" = "2587574465"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2178691764"
"a1_39" = "447252861"
"a1_30" = "3536387328"
"a1_31" = "2636143858"
"a1_32" = "935179328"
"a1_33" = "2733324719"
"a1_34" = "2914623787"
"a1_35" = "3357584710"
"a1_36" = "1218146794"
"a1_37" = "83921754"
"a1_297" = "3693348820"
"a1_296" = "3517983414"
"a1_295" = "3425448345"
"a1_294" = "4015660972"
"a1_293" = "2024312529"
"a1_292" = "3090340861"
"a1_291" = "3618564758"
"a1_290" = "1551468972"
"a1_299" = "132094622"
"a1_298" = "1280336319"
"a3_769" = "1234824520"
"a1_600" = "2771061380"
"a2_668" = "493997867"
"a1_601" = "1471073175"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "1551136375"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774273985"
"a2_109" = "781427894"
"a4_878" = "1999520942"
"a1_603" = "2387259717"
"a2_100" = "716908850"
"a2_101" = "724075904"
"a2_102" = "731243002"
"a2_103" = "738426224"
"a2_104" = "745591077"
"a2_105" = "752761984"
"a2_106" = "759924893"
"a2_107" = "767090960"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "385361062"
"a1_589" = "280689970"
"a1_588" = "1852276450"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "129223837"
"a1_748" = "504012496"
"a2_28" = "200726995"
"a2_29" = "207912618"
"a2_26" = "186389520"
"a2_27" = "193561395"
"a2_24" = "172062536"
"a2_25" = "179236010"
"a2_22" = "157725405"
"a2_23" = "164895072"
"a2_20" = "143377339"
"a2_21" = "150546298"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139224299"
"a2_7" = "50178323"
"a2_6" = "43008421"
"a2_5" = "35844089"
"a2_4" = "28674263"
"a2_3" = "21509312"
"a2_2" = "14341778"
"a2_1" = "7161776"
"a2_0" = "7639"
"a1_639" = "466938188"
"a1_638" = "3979106934"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64526842"
"a2_8" = "57357655"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124890951"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "733436201"
"a1_533" = "2719011500"
"a4_845" = "1762939949"
"a2_853" = "1820290138"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 54 C4 C3 74 B2 FA 02 5E 39 E2 90 A3 B5 76 63"
[HKCU\Software\Aas]
"a1_968" = "3042047134"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "1188180203"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "3962845314"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "544216694"
"a2_911" = "2236099208"
"a1_957" = "2250530795"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"
[HKCU\Software\Aas\695404737]
"43014726" = "0A00687474703A2F2F696B686F7576616E6972616B657A656E2E6E6C2F6C6F676F2E67696600687474703A2F2F7777772E6E6F76656461646573323031332E756E6C756761722E636F6D2F6C6F676F2E67696600687474703A2F2F7777772E707573686B6172696E7465726E6174696F6E616C2E636F6D2F6C6F676F2E67696600687474703A2F2F6E67616F7363686F6F6C2E61632E74682F6C6F676F2E67696600687474703A2F2F7065646169737563686F612E636F6D2F6C6F676F732E67696600687474703A2F2F6D656E64657A6D6F72616C65732E636F6D2F6C6F676F2E67696600687474703A2F2F6C616E646D61726B67726F75702E636F6D2E61752F696D616765732F6C6F676F732F6C6F676F732E67696600687474703A2F2F647369676E2D73747564696F2E636F6D2F696D616765732F627574746F6E2E67696600687474703A2F2F62617272796D776172642E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E677265656E62656163682E64652F6C6F676F2E676966"
[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014706639"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "1091427079"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"
"a3_130" = "915379051"
"a1_923" = "2206832109"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013860427"
"a1_107" = "3061453263"
"a1_106" = "2570608499"
"a1_105" = "258626583"
"a1_104" = "2450501033"
"a1_103" = "1081101517"
"a1_102" = "437249733"
"a1_101" = "3651025019"
"a1_100" = "2595379899"
"a3_134" = "943841519"
"a1_109" = "1271588414"
"a1_62" = "1771924906"
"a1_61" = "759482180"
"a3_137" = "998890944"
"a2_883" = "2035360786"
"a3_686" = "606179783"
"a2_489" = "3505693465"
"a2_488" = "3498525639"
"a3_687" = "613616230"
"a2_485" = "3477028297"
"a2_484" = "3469859429"
"a2_487" = "3491359021"
"a2_486" = "3484192079"
"a2_481" = "3448340534"
"a2_480" = "3441173443"
"a2_483" = "3462689160"
"a2_482" = "3455509312"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028205280"
"a3_976" = "2685262841"
"a2_809" = "1504849318"
"a2_808" = "1497691711"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447496904"
"a2_800" = "1440331266"
"a2_803" = "1461831129"
"a3_681" = "570649632"
"a2_805" = "1476181671"
"a2_804" = "1469011765"
"a2_807" = "1490515167"
"a2_806" = "1483347723"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049710946"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443812929"
"a2_660" = "436655251"
"a2_663" = "458156455"
"a3_146" = "1063277947"
"a2_665" = "472491582"
"a2_664" = "465325671"
"a2_667" = "486838951"
"a2_666" = "479671077"
"a2_669" = "501171223"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021026406"
"a3_143" = "1008236550"
"a2_249" = "1785117612"
"a2_248" = "1777935715"
"a2_247" = "1770766867"
"a2_246" = "1763595383"
"a2_245" = "1756432723"
"a2_244" = "1749256376"
"a2_243" = "1742099960"
"a2_242" = "1734931723"
"a2_241" = "1727751753"
"a2_240" = "1720582967"
"a1_356" = "304444453"
"a1_357" = "1838665756"
"a1_354" = "1177810036"
"a1_355" = "434206941"
"a1_352" = "4171430866"
"a1_353" = "814559228"
"a1_350" = "1064656329"
"a1_351" = "1304529707"
"a2_855" = "1834624776"
"a3_639" = "269411382"
"a1_358" = "4210336879"
"a1_359" = "3329223448"
"a3_638" = "295912343"
"a2_887" = "2064046676"
"a2_886" = "2056878834"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583716767"
"a2_119" = "853117844"
"a2_118" = "845961661"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810112058"
"a2_112" = "802933085"
"a2_111" = "795777856"
"a2_110" = "788608196"
"a2_117" = "838792890"
"a2_116" = "831611332"
"a2_115" = "824445942"
"a2_114" = "817276036"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533530413"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422985448"
"a2_58" = "415802725"
"a2_53" = "379969335"
"a2_52" = "372786111"
"a2_51" = "365617524"
"a2_50" = "358463858"
"a2_57" = "408636642"
"a2_56" = "401465375"
"a2_55" = "394300441"
"a2_54" = "387124897"
"a4_842" = "1741432586"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "919255097"
"a1_645" = "170736300"
"a1_646" = "2859611002"
"a1_647" = "1102693502"
"a1_640" = "1576510940"
"a1_641" = "832353117"
"a1_642" = "904928795"
"a1_643" = "974469661"
"a1_648" = "2000575542"
"a1_649" = "1367805876"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\Aas]
"a2_953" = "2537195731"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "757431822"
"a1_829" = "3315653844"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "2207402094"
"a1_916" = "3138476105"
"a1_917" = "2481104731"
"a1_910" = "1843055218"
"a1_911" = "267246937"
"a1_912" = "254683342"
"a1_913" = "4133484580"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "2794327285"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "3016346935"
"a1_139" = "2946398182"
"a3_907" = "2190592386"
"a1_132" = "743388088"
"a1_133" = "2817992826"
"a1_130" = "3907838974"
"a1_131" = "2116582609"
"a1_136" = "1725491766"
"a1_137" = "3538535604"
"a1_134" = "2507850891"
"a1_135" = "2943864446"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369490364"
"a2_471" = "3376658852"
"a2_472" = "3383822637"
"a2_473" = "3390986072"
"a2_474" = "3398157037"
"a2_475" = "3405325545"
"a2_476" = "3412507755"
"a2_477" = "3419672680"
"a2_478" = "3426840777"
"a2_479" = "3434007245"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "3342890410"
"a2_878" = "1999529855"
"a2_879" = "2006694417"
"a2_874" = "1970843264"
"a2_875" = "1978011316"
"a2_876" = "1985207291"
"a2_877" = "1992357386"
"a2_870" = "1942174191"
"a2_871" = "1949343008"
"a2_872" = "1956508561"
"a2_873" = "1963679049"
"a1_349" = "2577191443"
"a1_348" = "3875067037"
"a2_586" = "4201109733"
"a2_587" = "4208276539"
"a2_580" = "4158094953"
"a2_581" = "4165258624"
"a2_582" = "4172425867"
"a2_583" = "4179594652"
"a1_341" = "2983315849"
"a1_340" = "3463134895"
"a1_343" = "3872788138"
"a1_342" = "2218668239"
"a1_345" = "1188774085"
"a1_344" = "1245525732"
"a1_347" = "3044752981"
"a1_346" = "3769030982"
"a2_614" = "106879622"
"a2_615" = "114047048"
"a2_616" = "121220258"
"a2_617" = "128382229"
"a2_610" = "78197975"
"a2_611" = "85373738"
"a2_612" = "92528656"
"a2_613" = "99697552"
"a2_618" = "135547889"
"a2_619" = "142713654"
"a2_272" = "1950003801"
"a2_273" = "1957173454"
"a2_270" = "1935670945"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a2_276" = "1978671743"
"a2_277" = "1985841848"
"a2_274" = "1964340757"
"a2_275" = "1971506732"
"a2_908" = "2214600459"
"a2_909" = "2221765549"
"a2_278" = "1993023088"
"a2_279" = "2000190228"
"a1_842" = "3239597919"
"a2_298" = "2136392048"
"a2_299" = "2143561305"
"a1_841" = "2619390204"
"a2_290" = "2079039624"
"a2_291" = "2086209062"
"a2_292" = "2093377407"
"a2_293" = "2100557936"
"a2_294" = "2107729171"
"a2_295" = "2114893258"
"a2_296" = "2122058959"
"a2_297" = "2129227498"
"a2_728" = "924151095"
"a2_729" = "931317230"
"a2_720" = "866797750"
"a2_721" = "873965967"
"a2_722" = "881132135"
"a2_723" = "888300451"
"a2_724" = "895482504"
"a2_725" = "902650834"
"a2_726" = "909805767"
"a2_727" = "916984588"
"a1_594" = "499217059"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917646179"
"a2_129" = "924814132"
"a2_126" = "903300453"
"a2_127" = "910481680"
"a2_124" = "888965086"
"a2_125" = "896143626"
"a2_122" = "874640873"
"a2_123" = "881798585"
"a2_120" = "860302493"
"a2_121" = "867462259"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612386262"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "267117368"
"a1_13" = "3569431491"
"a1_10" = "2231964582"
"a1_11" = "4005100951"
"a1_16" = "3065968206"
"a1_17" = "1394929738"
"a1_14" = "3206061176"
"a1_15" = "482705656"
"a1_18" = "1468002414"
"a1_19" = "1186779557"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563919"
"a2_48" = "344115543"
"a2_49" = "351279056"
"a1_846" = "58587611"
"a2_40" = "286765770"
"a2_41" = "293932420"
"a2_42" = "301099601"
"a2_43" = "308265588"
"a2_44" = "315448861"
"a2_45" = "322615586"
"a2_46" = "329782891"
"a2_47" = "336950466"
"a2_897" = "2135728218"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "2591158188"
"a1_656" = "1027425348"
"a1_655" = "1758626961"
"a1_632" = "2417557565"
"a1_653" = "1151433267"
"a1_652" = "946202945"
"a1_651" = "3976719325"
"a1_650" = "449513974"
"a3_796" = "1428649909"
"a1_659" = "3401311741"
"a1_658" = "397993993"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086305"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Aas]
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "585422229"
"a1_838" = "449895739"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "2418168343"
"a1_906" = "711243027"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "4256172443"
"a1_902" = "3820510483"
"a1_901" = "3037619834"
"a1_900" = "3615253688"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "4138069798"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "600296359"
"a2_644" = "321952131"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "1753413181"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "3676581678"
"a1_879" = "3727830614"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "3757503420"
"a1_128" = "1167423065"
"a1_125" = "4056149729"
"a1_124" = "1212936914"
"a1_127" = "3623440942"
"a1_126" = "3543607925"
"a1_121" = "3348584832"
"a1_120" = "207370276"
"a1_123" = "860731598"
"a1_122" = "1838544123"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "1364181275"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "140435403"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "2671516451"
"a4_793" = "1390145657"
"a1_836" = "1463688071"
"a1_835" = "2124659370"
"a1_754" = "2697534147"
"a1_834" = "1160976319"
"a1_634" = "708209761"
"a2_463" = "3319304405"
"a2_462" = "3312124612"
"a2_461" = "3304972672"
"a2_460" = "3297788279"
"a2_467" = "3347973257"
"a2_466" = "3340805445"
"a2_465" = "3333636602"
"a2_464" = "3326472345"
"a2_469" = "3362324054"
"a2_468" = "3355155272"
"a1_934" = "160547512"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934993110"
"a2_868" = "1927825043"
"a2_867" = "1920657469"
"a2_866" = "1913500400"
"a2_865" = "1906326737"
"a2_864" = "1899158407"
"a2_863" = "1891989904"
"a1_791" = "2749035781"
"a2_861" = "1877642259"
"a2_860" = "1870471335"
"a2_597" = "4279963050"
"a2_596" = "4272794768"
"a2_595" = "4265630459"
"a2_594" = "4258460749"
"a1_338" = "2607777839"
"a1_339" = "1745917857"
"a2_591" = "4236941784"
"a2_590" = "4229778791"
"a1_334" = "868025918"
"a1_335" = "1437299894"
"a1_336" = "1605796110"
"a1_337" = "2522630836"
"a1_330" = "2016123230"
"a1_331" = "789151963"
"a1_332" = "2205354271"
"a1_333" = "545328755"
"a2_607" = "56694920"
"a2_606" = "49512657"
"a3_30" = "231909751"
"a2_604" = "35177395"
"a1_64" = "1592635935"
"a2_602" = "20844976"
"a2_601" = "13678871"
"a2_600" = "6513605"
"a4_875" = "1978013579"
"a2_609" = "71035782"
"a2_608" = "63850273"
"a2_265" = "1899819238"
"a2_264" = "1892654775"
"a2_267" = "1914152001"
"a2_266" = "1906990077"
"a2_261" = "1871138500"
"a2_260" = "1863967851"
"a2_263" = "1885471593"
"a2_262" = "1878305953"
"a2_919" = "2293463781"
"a1_908" = "934236977"
"a2_269" = "1928488357"
"a2_268" = "1921319142"
"a1_905" = "1185779121"
"a2_884" = "2042529475"
"a1_482" = "3280492760"
"a1_483" = "430655178"
"a2_289" = "2071873484"
"a2_288" = "2064709439"
"a1_486" = "2681634708"
"a1_487" = "3201759984"
"a1_484" = "1590340617"
"a1_485" = "123158160"
"a2_283" = "2028855380"
"a2_282" = "2021688825"
"a2_281" = "2014525338"
"a2_280" = "2007359443"
"a2_287" = "2057545752"
"a2_286" = "2050375064"
"a2_285" = "2043192107"
"a2_284" = "2036038056"
"a2_739" = "1003018835"
"a2_738" = "995835909"
"a3_522" = "3725445091"
"a2_733" = "960000527"
"a2_732" = "952835248"
"a2_731" = "945667230"
"a2_730" = "938486441"
"a2_737" = "988669951"
"a2_736" = "981503436"
"a2_735" = "974334048"
"a2_734" = "967168429"
"a4_446" = "3197427966"
"a1_637" = "1074320358"
"a3_912" = "2226582457"
"a1_240" = "1185756841"
"a1_241" = "3680686829"
"a1_242" = "2706135773"
"a1_243" = "2138988874"
"a1_244" = "3884834601"
"a1_245" = "563655711"
"a1_246" = "594473326"
"a1_247" = "4201589193"
"a1_248" = "2896554966"
"a1_249" = "3218480738"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939149826"
"a2_130" = "931982376"
"a2_133" = "953495954"
"a2_132" = "946331273"
"a2_135" = "967833655"
"a2_134" = "960665977"
"a2_137" = "982166027"
"a2_136" = "974998969"
"a2_139" = "996513672"
"a2_138" = "989332281"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566355938"
"a2_78" = "559188813"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "3085882402"
"a1_583" = "3843744434"
"a1_794" = "282526085"
"a1_795" = "2288179573"
"a1_792" = "1645725352"
"a1_793" = "4244225588"
"a1_790" = "565076558"
"a1_582" = "1313135431"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "2044347006"
"a1_798" = "1563544833"
"a1_799" = "147319247"
"a1_580" = "587506298"
"a3_198" = "1436076335"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a1_585" = "2275747070"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "2868291044"
"a1_469" = "3026562053"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "3538101787"
"a1_461" = "2896710051"
"a1_462" = "652053856"
"a1_463" = "3623250094"
"a1_464" = "2998624622"
"a1_465" = "3407329404"
"a1_466" = "4188106287"
"a1_467" = "3461184701"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "1397694882"
"a1_669" = "3870222434"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655395135"
"a3_499" = "3560555322"
"a2_831" = "1662568591"
"a3_498" = "3587059355"
"a2_832" = "1669736339"
"a3_497" = "3579611768"
"a2_833" = "1676904698"
"a3_496" = "3539014105"
"a2_834" = "1684086367"
"a3_495" = "3532029350"
"a2_835" = "1691254123"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698418995"
"a3_493" = "3551077604"
"a2_837" = "1705586441"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a1_837" = "2508881563"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a3_869" = "1918293868"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "1234499540"
"a1_807" = "1639975056"
"a1_804" = "2527314154"
"a1_805" = "4183478215"
"a1_802" = "4125604307"
"a1_803" = "4231600179"
"a1_800" = "1771601934"
"a1_808" = "3694903573"
"a1_809" = "2878916405"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "488662329"
"a1_939" = "3332204875"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407971731"
"a1_875" = "1034565909"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "1775658096"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "1681521553"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269122648"
"a2_457" = "3276281318"
"a2_454" = "3254786215"
"a3_380" = "2741212629"
"a2_452" = "3240435879"
"a2_453" = "3247604136"
"a2_450" = "3226102801"
"a2_451" = "3233271247"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283454081"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "3585577025"
"a2_852" = "1813120323"
"a1_730" = "4206272223"
"a2_850" = "1798787132"
"a2_851" = "1805957097"
"a2_856" = "1841803783"
"a2_857" = "1848978093"
"a2_854" = "1827456411"
"a1_731" = "2695400866"
"a3_632" = "252486993"
"a2_858" = "1856142218"
"a2_859" = "1863305307"
"a1_732" = "1604987653"
"a2_714" = "823782357"
"a1_733" = "3917018595"
"a1_329" = "3203318908"
"a1_328" = "1680371188"
"a1_327" = "138115417"
"a1_326" = "3121425909"
"a1_325" = "516658964"
"a1_324" = "1486390753"
"a1_323" = "1107315924"
"a1_322" = "4094110797"
"a1_321" = "2102174310"
"a1_320" = "3961867550"
"a2_650" = "364954665"
"a1_436" = "107927917"
"a1_736" = "2633780318"
"a3_631" = "211878206"
"a1_737" = "3168421375"
"a2_652" = "379305827"
"a3_923" = "2339079058"
"a2_926" = "2343635721"
"a2_927" = "2350801539"
"a2_924" = "2329303283"
"a2_653" = "386473226"
"a4_887" = "2064043031"
"a2_923" = "2322134389"
"a2_920" = "2300619250"
"a2_921" = "2307799756"
"a2_654" = "393628899"
"a2_928" = "2357969392"
"a2_655" = "400815874"
"a3_630" = "204893343"
"a2_657" = "415140639"
"a3_922" = "2298015603"
"a1_495" = "434811738"
"a1_494" = "3386434674"
"a1_497" = "3732474599"
"a1_496" = "3472493376"
"a1_491" = "2922711086"
"a1_490" = "951928316"
"a1_493" = "1521011718"
"a1_492" = "708654247"
"a1_499" = "415448893"
"a1_498" = "3224440320"
"a3_637" = "288468852"
"a2_708" = "780764123"
"a2_709" = "787945790"
"a2_706" = "766430674"
"a2_707" = "773595566"
"a2_704" = "752096090"
"a2_705" = "759264450"
"a2_702" = "737761209"
"a2_703" = "744930853"
"a2_700" = "723412313"
"a2_701" = "730579154"
"a4_885" = "2049704789"
"a2_638" = "278924658"
"a2_639" = "286102107"
"a3_808" = "1481095169"
"a2_632" = "235919487"
"a2_633" = "243083843"
"a2_630" = "221585391"
"a2_631" = "228750430"
"a2_636" = "264598787"
"a2_637" = "271769393"
"a2_634" = "250264349"
"a2_635" = "257418372"
"a1_253" = "999514099"
"a1_252" = "3627056930"
"a1_251" = "4012812185"
"a1_250" = "897477268"
"a1_257" = "1083454685"
"a1_256" = "217354672"
"a1_255" = "433481425"
"a1_254" = "2402700140"
"a3_920" = "2284050097"
"a1_259" = "3371642988"
"a1_258" = "2342190747"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032345021"
"a2_145" = "1039519110"
"a2_146" = "1046685298"
"a2_147" = "1053866980"
"a2_140" = "1003682836"
"a2_141" = "1010848715"
"a2_142" = "1018016882"
"a2_143" = "1025182786"
"a1_781" = "700724712"
"a1_780" = "3281507663"
"a2_68" = "487505535"
"a2_69" = "494672202"
"a2_148" = "1061031993"
"a2_149" = "1068203834"
"a1_787" = "3078444386"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a1_904" = "2406594199"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "3295438867"
"a1_478" = "1311839648"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "3444812423"
"a1_472" = "431188357"
"a1_471" = "2715824168"
"a1_470" = "4036807757"
"a1_477" = "3478614785"
"a1_476" = "2739151890"
"a1_475" = "1114104480"
"a1_474" = "3587567775"
"a4_533" = "3821141493"
"a1_679" = "1162431514"
"a1_678" = "4082995542"
"a4_532" = "3813972372"
"a1_675" = "982219120"
"a1_674" = "1205695079"
"a1_677" = "281435339"
"a1_676" = "810836601"
"a1_671" = "1837742688"
"a4_531" = "3806803251"
"a1_673" = "2330041675"
"a1_672" = "1375000575"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a1_868" = "213451487"
"a4_535" = "3835479735"
"a3_980" = "2747738493"
"a4_534" = "3828310614"
"a2_151" = "1082534714"
"a2_150" = "1075366513"
"a1_869" = "1196530427"
"a2_271" = "1942838923"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "64917646"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139888108"
"a4_758" = "1139226422"
"a2_158" = "1132712525"
"a1_925" = "896369197"
"a1_924" = "3995923742"
"a1_927" = "1549250074"
"a1_926" = "2166775392"
"a1_921" = "2697633975"
"a1_920" = "128572149"
"a3_787" = "1363737626"
"a1_922" = "291893781"
"a3_80" = "590099577"
"a1_929" = "536420911"
"a1_928" = "925315717"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "1280363399"
"a1_818" = "1708692395"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "2183476169"
"a1_810" = "2215710643"
"a1_813" = "3400594067"
"a1_812" = "2719849317"
"a1_815" = "466600567"
"a1_814" = "1341341918"
"a1_817" = "319021351"
"a1_816" = "231062251"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454665653"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"
[HKCU\Software\Aas\695404737]
"50183847" = "38AC3BD32A37CB1E794E8CFABEEE28D872DF56445AE379304E9A3E6096C4F2440E36F058B7722A2403413887ED38CBE6100C4234F16B51D6B1B859E5DBAC9FBDAD8EB7A4872261631C4516E99ECAFEB5BFB9093B9BED484FE41D3FF7CCD4D496A5DFDC679F97617320B671F86B99C7448380C05CE71495D9FAB4B0F113CCC271"
[HKCU\Software\Aas]
"a2_845" = "1762937338"
"a2_844" = "1755773179"
"a2_847" = "1777272246"
"a2_846" = "1770104590"
"a2_841" = "1734268270"
"a2_840" = "1727087212"
"a2_843" = "1748604463"
"a2_842" = "1741423065"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791608272"
"a2_848" = "1784453756"
"a1_312" = "2257464437"
"a1_313" = "2562628136"
"a1_310" = "565341130"
"a1_311" = "1241515113"
"a1_316" = "4043792143"
"a1_317" = "4281334179"
"a1_314" = "743139284"
"a1_315" = "760684293"
"a3_620" = "166490309"
"a1_318" = "2172447659"
"a1_319" = "1124230753"
"a4_929" = "2365146113"
"a2_449" = "3218936708"
"a2_448" = "3211768556"
"a3_621" = "140449124"
"a2_441" = "3161583866"
"a2_440" = "3154418849"
"a2_443" = "3175919282"
"a2_442" = "3168752301"
"a2_445" = "3190252226"
"a2_444" = "3183083904"
"a2_447" = "3204601465"
"a2_446" = "3197435566"
"a2_939" = "2436840768"
"a2_938" = "2429671246"
"a4_893" = "2107057757"
"a2_931" = "2379485309"
"a2_930" = "2372318770"
"a2_933" = "2393820084"
"a2_932" = "2386653096"
"a2_935" = "2408154920"
"a2_934" = "2400985801"
"a2_937" = "2422504306"
"a2_936" = "2415336982"
"a3_818" = "1552537563"
"a2_711" = "802280088"
"a2_710" = "795114448"
"a2_713" = "816614116"
"a2_712" = "809438527"
"a2_715" = "830951297"
"a1_510" = "2482554720"
"a2_717" = "845298868"
"a2_716" = "838115995"
"a2_719" = "859633408"
"a2_718" = "852467232"
"a1_587" = "423467729"
"a3_623" = "187965990"
"a2_629" = "214401159"
"a2_628" = "207231038"
"a2_625" = "185732081"
"a2_624" = "178566316"
"a2_627" = "200066105"
"a2_626" = "192899279"
"a2_621" = "157049310"
"a2_620" = "149881283"
"a2_623" = "171398751"
"a2_622" = "164231017"
"a1_266" = "1271858554"
"a1_267" = "3410477943"
"a1_264" = "490997172"
"a1_265" = "149831990"
"a1_262" = "3124606973"
"a1_263" = "3258324152"
"a1_260" = "3551156189"
"a1_261" = "593405627"
"a3_363" = "2585673634"
"a1_268" = "3505516592"
"a1_269" = "1992518478"
"a2_157" = "1125558967"
"a2_156" = "1118385918"
"a2_155" = "1111219905"
"a2_154" = "1104050253"
"a2_153" = "1096868726"
"a2_152" = "1089714681"
"a2_99" = "709742368"
"a2_98" = "702564584"
"a2_97" = "695407979"
"a2_96" = "688226730"
"a2_95" = "681059405"
"a2_94" = "673905663"
"a2_93" = "666718967"
"a2_92" = "659558073"
"a2_91" = "652390664"
"a2_90" = "645222717"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "2183435524"
"a1_847" = "3483446843"
"a3_404" = "2913010493"
"a1_844" = "3127387762"
"a3_405" = "2886510428"
"a1_845" = "4007510167"
"a2_862" = "1884808060"
"a1_961" = "1655195720"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "2264434612"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "1414301536"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "160316292"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a1_448" = "1030931350"
"a1_449" = "1132606111"
"a1_446" = "3033162048"
"a3_408" = "2941554865"
"a1_444" = "3755102604"
"a1_445" = "3102865347"
"a1_442" = "1586278852"
"a1_443" = "1980336005"
"a1_440" = "1566437866"
"a3_409" = "2949002448"
"a1_680" = "2858392374"
"a1_681" = "1237609567"
"a1_682" = "3255411668"
"a1_683" = "526393564"
"a2_561" = "4021869542"
"a1_685" = "1432111923"
"a1_686" = "862320025"
"a1_687" = "2783093300"
"a1_688" = "2821963237"
"a1_689" = "487810223"
"a3_834" = "1700949547"
"a1_767" = "1923531472"
"a1_766" = "2614266145"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294296964"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "4001457830"
"a2_605" = "42342816"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "3797738865"
"a2_603" = "28010821"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "1279283707"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "1419836984"
"a1_441" = "628804160"
"a4_964" = "2616065348"
"a1_744" = "2685236526"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250432681"
"a1_747" = "3201114293"
"a2_912" = "2243278851"
"a2_651" = "372136900"
"a2_910" = "2228930900"
"a3_794" = "1380597491"
[HKCU\Software\Aas\695404737]
"35845605" = "394"
[HKCU\Software\Aas]
"a2_917" = "2279117340"
"a4_883" = "2035366547"
"a2_509" = "3649090613"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "3408775320"
"a1_867" = "3246827577"
"a1_860" = "2343180931"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Aas]
"a1_862" = "1543973975"
"a4_859" = "1863307643"
"a4_182" = "1304780022"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "1671209884"
"a2_918" = "2286284403"
"a4_168" = "1204412328"
"a1_194" = "2769467869"
"a1_195" = "3096637118"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287128395"
"a1_192" = "4224219654"
"a1_193" = "1542341877"
"a1_969" = "4055564076"
"a4_934" = "2400991718"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "3298729224"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a3_505" = "3603458416"
"a1_305" = "2081862191"
"a1_304" = "968919647"
"a1_307" = "3232126294"
"a1_306" = "2804912782"
"a1_301" = "1723803925"
"a1_300" = "602928589"
"a1_303" = "4221300417"
"a1_302" = "374812757"
"a3_792" = "1399711281"
"a1_309" = "1188767403"
"a1_308" = "159013382"
"a2_540" = "3871320871"
"a2_541" = "3878501266"
"a2_542" = "3885670361"
"a1_481" = "2780843544"
"a2_544" = "3900004791"
"a2_545" = "3907187808"
"a2_546" = "3914337616"
"a2_547" = "3921503172"
"a2_548" = "3928671893"
"a2_549" = "3935852930"
"a2_894" = "2114231689"
"a2_895" = "2121387058"
"a2_892" = "2099896509"
"a2_893" = "2107060570"
"a2_890" = "2085544913"
"a2_891" = "2092713420"
"a2_438" = "3140066005"
"a2_439" = "3147251238"
"a2_434" = "3111402141"
"a2_435" = "3118576921"
"a2_436" = "3125731481"
"a2_437" = "3132901046"
"a2_430" = "3082715481"
"a2_431" = "3089885480"
"a2_432" = "3097065750"
"a2_433" = "3104231462"
"a2_948" = "2501357548"
"a2_949" = "2508522067"
"a4_908" = "2214594572"
"a2_944" = "2472689619"
"a2_945" = "2479860935"
"a2_946" = "2487023461"
"a2_947" = "2494189390"
"a2_940" = "2444001767"
"a1_488" = "2563326385"
"a2_942" = "2458337982"
"a2_943" = "2465521678"
"a1_279" = "2743808452"
"a1_278" = "585824107"
"a1_489" = "916951824"
"a1_271" = "2280205305"
"a1_270" = "710257682"
"a1_273" = "173815343"
"a1_272" = "4011056453"
"a1_275" = "1613180276"
"a1_274" = "1045448860"
"a1_277" = "7162587"
"a1_276" = "2263271080"
"a2_764" = "1182239961"
"a2_765" = "1189406866"
"a2_766" = "1196573084"
"a2_767" = "1203741686"
"a2_760" = "1153556856"
"a2_761" = "1160738913"
"a2_762" = "1167908165"
"a2_763" = "1175073934"
"a2_768" = "1210923609"
"a2_769" = "1218089398"
"a2_382" = "2738606567"
"a2_383" = "2745765738"
"a2_380" = "2724260285"
"a2_381" = "2731440436"
"a2_386" = "2767274341"
"a2_387" = "2774445001"
"a2_384" = "2752940092"
"a2_385" = "2760103023"
"a2_388" = "2781624860"
"a2_389" = "2788790454"
"a1_613" = "2845324828"
"a1_612" = "3652740351"
"a1_611" = "2759360173"
"a2_368" = "2638238442"
"a2_369" = "2645397366"
"a1_610" = "3362367977"
"a2_88" = "630891666"
"a2_89" = "638042227"
"a2_84" = "602208325"
"a2_85" = "609373226"
"a2_86" = "616536903"
"a2_87" = "623706894"
"a2_80" = "573523129"
"a2_81" = "580703649"
"a2_82" = "587873395"
"a2_83" = "595044399"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161402897"
"a2_163" = "1168568572"
"a2_160" = "1147052407"
"a3_278" = "2009623423"
"a2_166" = "1190068560"
"a2_167" = "1197238260"
"a2_164" = "1175737231"
"a2_165" = "1182898158"
"a3_690" = "668723035"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "767349761"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "3932504469"
"a1_450" = "3910274005"
"a1_453" = "3888314763"
"a1_452" = "1130941176"
"a1_455" = "221688666"
"a1_454" = "3966907688"
"a1_457" = "469320564"
"a1_456" = "3063653527"
"a1_459" = "649479329"
"a1_458" = "768554203"
"a1_693" = "1644619357"
"a1_692" = "814183033"
"a1_691" = "1603442304"
"a1_690" = "2052895426"
"a1_697" = "422849448"
"a1_696" = "307566293"
"a1_695" = "1949026188"
"a1_694" = "1612831704"
"a1_699" = "2421278482"
"a1_698" = "1071200040"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "2883221981"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "2834758872"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "1016539884"
"a4_387" = "2774449827"
"a1_940" = "1686004464"
"a1_752" = "3327922762"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537676216"
"a2_74" = "530523943"
"a1_763" = "482213551"
"a2_77" = "552020113"
"a2_76" = "544854221"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Aas]
"a2_71" = "509003825"
"a2_70" = "501835257"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523340483"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "4109344508"
"a1_876" = "203988914"
"a4_759" = "1146395543"
"a2_72" = "516168315"
"a1_873" = "1826136734"
"a1_872" = "3240059981"
"a1_871" = "3092407074"
"a1_870" = "2400388007"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "1654974740"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "2429323164"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Aas]
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "1773306799"
"a1_437" = "3471592749"
"a3_960" = "2604335593"
"a2_553" = "3964518627"
"a2_552" = "3957353727"
"a2_551" = "3950188456"
"a2_550" = "3943008363"
"a2_557" = "3993205211"
"a2_556" = "3986035806"
"a2_555" = "3978870337"
"a2_554" = "3971688378"
"a2_889" = "2078379150"
"a2_888" = "2071210466"
"a2_559" = "4007540076"
"a2_558" = "4000373765"
"a4_980" = "2730771284"
"a2_429" = "3075576844"
"a2_428" = "3068381219"
"a2_427" = "3061216188"
"a2_426" = "3054048557"
"a2_425" = "3046879429"
"a2_424" = "3039714573"
"a2_423" = "3032533579"
"a2_422" = "3025366833"
"a2_421" = "3018196066"
"a2_420" = "3011031369"
"a1_758" = "2107391998"
"a2_565" = "4050556396"
"a2_959" = "2580224460"
"a2_958" = "2573044928"
"a2_957" = "2565874424"
"a2_956" = "2558709590"
"a2_955" = "2551540493"
"a2_954" = "2544371342"
"a1_785" = "470565817"
"a2_952" = "2530039249"
"a2_951" = "2522872592"
"a2_950" = "2515692073"
"a1_208" = "2891594730"
"a1_209" = "4121587587"
"a1_204" = "1790170133"
"a1_205" = "3527661159"
"a1_206" = "1676189380"
"a1_207" = "836784698"
"a1_200" = "1800700700"
"a1_201" = "119786135"
"a1_202" = "3573646804"
"a1_203" = "477788471"
"a2_777" = "1275441414"
"a2_776" = "1268275833"
"a2_775" = "1261107333"
"a2_774" = "1253926758"
"a2_773" = "1246757719"
"a2_772" = "1239589260"
"a2_771" = "1232434665"
"a2_770" = "1225257679"
"a2_779" = "1289776812"
"a2_778" = "1282610031"
"a2_395" = "2831810555"
"a2_394" = "2824627340"
"a2_397" = "2846145870"
"a2_396" = "2838978223"
"a2_391" = "2803126224"
"a2_390" = "2795958943"
"a2_393" = "2817458422"
"a2_392" = "2810293131"
"a2_399" = "2860470274"
"a2_398" = "2853318115"
"a2_568" = "4072057855"
"a2_569" = "4079224212"
"a2_379" = "2717090374"
"a2_378" = "2709925475"
"a2_373" = "2674088618"
"a2_372" = "2666907285"
"a2_371" = "2659738470"
"a2_370" = "2652573337"
"a2_377" = "2702755888"
"a2_376" = "2695591069"
"a2_375" = "2688423914"
"a2_374" = "2681256616"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283274728"
"a2_178" = "1276105009"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254590928"
"a2_174" = "1247420707"
"a2_177" = "1268940297"
"a2_176" = "1261771562"
"a2_171" = "1225922836"
"a2_170" = "1218753153"
"a2_173" = "1240255018"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKCU\Software\Aas]
"a1_511" = "761807313"
"a1_512" = "2842203229"
"a1_513" = "4025785873"
"a1_514" = "2686481534"
"a1_515" = "4121458438"
"a1_516" = "570349021"
"a1_517" = "756394847"
"a1_518" = "212694800"
"a1_519" = "1204377598"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "705686341"
"a3_514" = "3667976427"
"a2_543" = "3892834512"
"a1_424" = "3715860585"
"a1_425" = "4051810487"
"a1_426" = "1589257011"
"a1_427" = "3020028304"
"a1_420" = "1957214704"
"a1_421" = "1453655240"
"a1_422" = "3949417959"
"a1_423" = "2633114460"
"a3_199" = "1409969486"
"a1_428" = "2668571792"
"a1_429" = "3858963587"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623240444"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "2953376097"
"a1_739" = "1326620237"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "3115271470"
"a2_915" = "2264781172"
"a1_865" = "2809601399"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_861" = "3545365579"
"a1_863" = "4130937413"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"
"a4_871" = "1949337095"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "778504194"
"a1_849" = "751129604"
"a1_439" = "2097535570"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450988446"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "1533723464"
"a1_199" = "1662119121"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "366969086"
"a4_145" = "1039522545"
"a1_190" = "1024232883"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "1128400157"
"a1_663" = "2968572526"
"a3_965" = "2639793036"
"a1_660" = "2409302554"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"
"a1_667" = "826160750"
"a1_664" = "874450116"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a1_665" = "1669313766"
"a1_0" = "1964074070"
"a1_1" = "2501731546"
"a1_2" = "2690160784"
"a1_3" = "1334817149"
"a1_4" = "1663558974"
"a1_5" = "134958939"
"a1_6" = "2875123703"
"a1_7" = "3056108601"
"a1_8" = "30703174"
"a1_9" = "1372762677"
"a2_566" = "4057724321"
"a2_567" = "4064889710"
"a2_564" = "4043387019"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Aas]
"a2_562" = "4029041601"
"a2_563" = "4036222126"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953679058"
"a2_413" = "2960846526"
"a2_410" = "2939346186"
"a2_411" = "2946511034"
"a2_416" = "2982347693"
"a2_417" = "2989530327"
"a2_414" = "2968013065"
"a2_415" = "2975180172"
"a2_418" = "2996697809"
"a2_419" = "3003866404"
"a2_962" = "2601718997"
"a2_963" = "2608890925"
"a2_960" = "2587379949"
"a2_961" = "2594556546"
"a2_966" = "2630409319"
"a2_967" = "2637564666"
"a2_964" = "2616057125"
"a4_950" = "2515697654"
"a1_631" = "1388923814"
"a2_968" = "2644743339"
"a2_969" = "2651909078"
"a4_564" = "4043384244"
"a1_219" = "3975654822"
"a1_218" = "345841450"
"a1_217" = "4220043287"
"a1_216" = "1057316086"
"a1_215" = "1797371326"
"a1_214" = "513299567"
"a1_213" = "2354671367"
"a1_212" = "4170243554"
"a1_211" = "2222404"
"a1_210" = "1562147301"
"a4_567" = "4064891607"
"a1_630" = "3479712744"
"a2_980" = "2730777555"
"a4_560" = "4014707760"
"a4_956" = "2558712380"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "439451526"
"a4_442" = "3168751482"
"a4_441" = "3161582361"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
The Virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
The Virus deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
218741385c7e2273e2ca170ac1a4ce22 | c:\illrd.pif |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\universaldownloader-prefetch[1].htm (93 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=8777117 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[2].htm (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\OpenSans-CondBold-webfont[1].eot (2077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].com/universaldownloader-prefetch&cb=6157950 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[3].htm (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\OpenSans-CondLight-webfont[1].eot (492 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2d9b4-fff45[1].css (41 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondLight-webfont[1].eot (974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_78[1].js (3472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\90f12-4a489[1].css (1391 bytes)
C:\illrd.pif (103 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\container[1].html (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\eaa2a-e6efe[1].js (2356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b5ae7-49f02[1].css (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bid[1].com/universaldownloader-prefetch&cb=2033782 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\font-icon[1].eot (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gpt[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (7961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondBold-webfont[1].eot (2783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\427b6-cd0ca[1].js (399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\font-icon[1].eot (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bid[1].com/universaldownloader-prefetch&cb=3057370 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\container[1].htm (4 bytes)
C:\autorun.inf (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windwiiww.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OpenSans-CondBold-webfont[1].eot (1621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\4cd46-1a865[1].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\7b1b9-727eb[1].js (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1467b-931a2[1].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\OpenSans-CondLight-webfont[1].eot (1418 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\font-icon[1].eot (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[2].js (15 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1, 40, 1, 0
Legal Copyright: Copyright (C) 2013
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: Softonic Downloader
File Version: 1, 40, 1, 0
File Description: Softonic Downloader
Comments:
Language: English (United States)
Company Name: Softonic Product Name: Softonic Downloader Product Version: 1, 40, 1, 0Legal Copyright: Copyright (C) 2013Legal Trademarks: Original Filename: SoftonicDownloader.exe Internal Name: Softonic Downloader File Version: 1, 40, 1, 0File Description: Softonic Downloader Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
hC8i700F | 4096 | 1081344 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
E01D6Y47 | 1085440 | 360448 | 357376 | 5.54407 | 7deaa27994180637e04a27621751b75b |
.rsrc | 1445888 | 90112 | 90112 | 5.38012 | 3fb02e304f99c741041ac684b774b66b |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch | 46.28.209.1 |
hxxp://v1es.sftcdn.net/es/css/generated/90f12-4a489.css | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/css/generated/2d9b4-fff45.css | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/css/generated/b5ae7-49f02.css | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/js/generated/eaa2a-e6efe.js | 46.28.209.40 |
hxxp://v1es.sftcdn.net/shared/font/es/OpenSans-CondLight-webfont.eot? | 46.28.209.40 |
hxxp://v1es.sftcdn.net/shared/font/softonic/font-icon.eot? | 46.28.209.40 |
hxxp://v1es.sftcdn.net/shared/font/es/OpenSans-CondBold-webfont.eot? | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/js/generated/4cd46-1a865.js | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/js/generated/427b6-cd0ca.js | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/js/generated/1467b-931a2.js | 46.28.209.40 |
hxxp://v1es.sftcdn.net/es/js/generated/7b1b9-727eb.js | 46.28.209.40 |
hxxp://latency-optimizer.sd.softonic.com/shared/abp_detection/px.js?ch=1 | 46.28.209.1 |
hxxp://latency-optimizer.sd.softonic.com/shared/abp_detection/px.js?ch=2 | 46.28.209.1 |
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=94214117414&varName=crtg_content | 178.250.2.100 |
hxxp://d1ykf07e75w7ss.cloudfront.net/aax2/amzn_ads.js | |
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js | |
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=6157950 | |
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_78.js | |
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js | |
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-2/html/container.html | |
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=36197053729&varName=crtg_content | 178.250.2.100 |
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=2033782 | |
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=61759328311&varName=crtg_content | 178.250.2.100 |
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=8777117 | |
hxxp://rtax.criteo.com/delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=21779022559&varName=crtg_content | 178.250.2.100 |
hxxp://aax-eu.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=3057370 | |
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=8777117 | 178.236.4.159 |
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=3057370 | 178.236.4.159 |
hxxp://c.amazon-adsystem.com/aax2/amzn_ads.js | 54.192.202.224 |
hxxp://tpc.googlesyndication.com/safeframe/1-0-2/html/container.html | 216.58.209.193 |
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=2033782 | 178.236.4.159 |
hxxp://v2es.sftcdn.net/es/js/generated/7b1b9-727eb.js | 46.28.209.40 |
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=6157950 | 178.236.4.159 |
hxxp://www.googletagservices.com/tag/js/gpt.js | 173.194.113.218 |
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js | 173.194.113.218 |
hxxp://partner.googleadservices.com/gpt/pubads_impl_78.js | 173.194.113.217 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=6157950 HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: aax.amazon-adsystem.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 18 Dec 2015 06:49:08 GMT
Server: Server
Content-Type: text/javascript;charset=UTF-8
Content-Length: 8
Vary: User-Agent
Keep-Alive: timeout=2, max=6
Connection: Keep-Alive
void(0);HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:08 GMT..Server: Server..Content-Type: text/javascript;charset=UTF-8..Content-Length: 8..Vary: User-Agent..Keep-Alive: timeout=2, max=6..Connection: Keep-Alive..void(0);....
GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=2033782 HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: aax.amazon-adsystem.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 18 Dec 2015 06:49:10 GMT
Server: Server
Content-Type: text/javascript;charset=UTF-8
Content-Length: 8
Vary: User-Agent
nnCoection: close
void(0);HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:10 GMT..Server: Server..Content-Type: text/javascript;charset=UTF-8..Content-Length: 8..Vary: User-Agent..nnCoection: close..void(0);....
GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=8777117 HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: aax.amazon-adsystem.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 18 Dec 2015 06:49:11 GMT
Server: Server
Content-Type: text/javascript;charset=UTF-8
Content-Length: 8
Vary: User-Agent
Keep-Alive: timeout=2, max=1
Connection: Keep-Alive
void(0);HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:11 GMT..Server: Server..Content-Type: text/javascript;charset=UTF-8..Content-Length: 8..Vary: User-Agent..Keep-Alive: timeout=2, max=1..Connection: Keep-Alive..void(0);....
GET /e/dtb/bid?src=3177&u=http://latency-optimizer.sd.softonic.com/universaldownloader-prefetch&cb=3057370 HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: aax.amazon-adsystem.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 18 Dec 2015 06:49:12 GMT
Server: Server
Content-Type: text/javascript;charset=UTF-8
Content-Length: 8
Vary: User-Agent
Keep-Alive: timeout=2, max=16
Connection: Keep-Alive
void(0);..
GET /pagead/show_companion_ad.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pagead2.googlesyndication.com
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 15216135633433300900
Date: Fri, 18 Dec 2015 06:27:12 GMT
Expires: Fri, 18 Dec 2015 07:27:12 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 84768
X-XSS-Protection: 1; mode=block
Age: 1317
Cache-Control: public, max-age=3600
...........}g{....w..{N.3........l ....N[Y.g......D.....p.......9Yk.I..@....l.M...i.zt..={..N...*..~...l<X}.v....m;...9..<..c;......F.........S.5..U.^...s..x..h:..!.....f......._v..`..v..M.k.t[S....Z..8.kU......4...*Q....yZ_._..GG.M...e..[.N..2..{.xS..]......v...3.0[u<v^,.....Q....JD.U...x6.........N.7.qw..zN..mQ....._.......x.5..H6..........c..!)P........7..T.3/X__IO.......tR...... .Zz.i... ..........."4..._v...;$..X..I.*b.3.S......K ..;......^. m..h...@....V"..c.\.S.*.K.fy...-Oh.i.....QU........$.s..........f;08.....D/....Yg4...N.....q.f{0.@.z..0.k.5...O......m...*'`.{.....-:.%-..,..r.Vc8....V9.k6 .&..1_5..8..b.l5.M........r.j.#$..7.k...T..L .....v...v..Uo....<8........Nrd...9.7`c.e`wm....u.......8D......}.L..`.4.'@...O...`?..t....N..u.a{.6..Y.V=.I^8l......G..0#v..c.....x.M.c......z..kA....9.....X)X.c.....)w2..].l...J.w....}.{..IY..L.o.>.#g<.....4.|....saz.|.?.*.;.*@.a.~S...j`.\..^.G.(...7.,x......Ae-W.....1.#.%@Lc......=m42wY....U`... .s....Uy..&..8..q.N..L..9......k@[.e..C.4r.\.`9..T...<H.O...c...5..h.?....}.}.k.'.{..5-.m.M.}.a.....r..|!.g,.{.%. . o..D..D..D.Y".......}t.'.)=Y.P_..p....?....p....(.!;......T....#....Y^~.2...C(.........,>.W.6`Y.M.<7......=.../...s.u. ......].N0[.( ..A.b.......t.....n....h8.R5...`.......<6..F.V.J.5......l2..)...}..p...Vs.}. J.Nf..*3.\I}a.n..1.A.w...i...Z.R.a@=..........kd....f..8....DA.h...)...&5-...7..v.._...9.. .R~..7..\..J....f.;.Q..T....M......D}....a$.;F......Eq9..k.q. G.6...2R.'......fI_.x........#..0Qw8.x....xf}..._'.....}...%....$..|.g....t
<<< skipped >>>
GET /tag/js/gpt.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googletagservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Timing-Allow-Origin: *
Date: Fri, 18 Dec 2015 06:39:27 GMT
Expires: Fri, 18 Dec 2015 06:39:27 GMT
Last-Modified: Tue, 08 Dec 2015 11:45:39 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1489
X-XSS-Protection: 1; mode=block
Age: 581
Cache-Control: private, max-age=900
......n....Vmw.:.....o..#...]K......n-}.F.=Nl kH...1..~e;..v..}.G.,=.d Fo.z..B.O.iR.D.....#.:..Z.HL...........Q........gY.5.2{........]....l..|..}R............p.a...iu...n..=.....~....p......Tx.........m.\Y...@.eo ..fPHRP.a.`o*}.D........g....J.....k..RC;6GZ.].K....6...27.._s.%.'.......%x*...U.V.a.^..fIz.%-.[R.W..._.p.d.a..........4.g.)].>.'{...K.....zt5.....G.....l...>.jL.~....h?....Ls...O....;....d...(...@....q..c.1'..9..g.g.K.2q(.}N.F.'......oy..ae..`>r)K......p/..; ...l.-S....?./..$".IA.6....x..cKZ....".L{Qb..q.......:......|.P.t....ZAT.-N".yQ...My......j."Tlg...Z.....4..S...i>...c?d.X.}%...........NI.*.C.P....:k..r$4..x.............5V{.i....xG.7.h..[.....M......Dc....*...*.B.......D|.X...........jAE....@...a.|\~O..V.......xS..5n...TG..sl.[.....'XJ...')....n,z..r}.9..L.6a.7.B.....!...N..z4...Y.c.y..........HMN.$.Q..:.A..............0.4....$..b. *.....('.3G...!cZ":....-......@G3(_.f...6.Vp[2St.U..p4ty...HV....T.h.2..C.Pe.Mcx2...q.......'...j....@....s.@..(....ae2..R.....9....9L.r.*_6.....Z..Y..Z.Y.s..';........<#...@...pI.....j.3.....$.#..k.(.x.Y. Fc.....*.VB.=..Kw..YZ..W.{T ......o.\.&.._..hn..2...S.K&....>S..h0..q.. r..G.......-.h." ...r.Q . ..r....C.u....2..H&......s......{.%j...Z5.P6e.Jh......w.eg.)18-&Y.....KS,.=..b......k2.....!{.......j........_I..A,........1..C..-80...x-.....T/-...V.Z...W...A.|]F]G...."..q..n..NU....Z.}...r.x..........dw..K..e........Cf|..k.4..x%..[R.q...H.y~.....^..w@E.....LN._..\9F......m......[^....c..w.?`.w.<.T.o....~\*.......&S.......
<<< skipped >>>
GET /gpt/pubads_impl_78.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partner.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Date: Wed, 16 Dec 2015 05:29:58 GMT
Expires: Thu, 15 Dec 2016 05:29:58 GMT
Last-Modified: Thu, 03 Dec 2015 10:34:42 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 51142
X-XSS-Protection: 1; mode=block
Age: 177550
Cache-Control: public, max-age=31536000
......n.....i_...(...S.N.#..c.B........!.$.......".,......E-Y&.y...3.Rw.........p...m.....v...t{..{:.w~.|2M..W.^..X.<..|.3..../|.....v.G....b....<.X..8..0.w.7.&.0D..4.o.Q......a>P!.h5p......q:.....d.q...I=..}...p"Z...7.F.g..P.&.V.....lf........T..a2...[.a....G.Z....../....y:.=...`..A.`..3lK.f9.c...B..joe.8..&...m...........U.:...K).V..K...............R....C...U......0N....-..9.VU...3..,........a....p..s. K4.Rt....W.P.[.....y>..Y....g..Q6M.....[5.y...w..[O}.9..y..i.a..5X.l..X......?..om....c~....N2hqo.KX%k.3......4..6.....N...a...5.}..Enz..k.._-a..^.;n.j:...x"...HW..4..|.X...1 sv.0 7...F.8......e....N.^....}C......(.L.Y....Z..7.=.&.stQ.#5l..Ml.n9,..nx.8..W..l-....~...x2..o.._[5.v..f....j\js/......:ky....Nt.....?.......~.......VC<..|.. .v.../%..C~...).p.gQ:.'...!. 0k.Y....%bu.....r...r/.V.{Y.9...F...y'.g....9....b...:./.g..hXOF...'~2........^.._....z..>\.......J.O|...._^...........M.....$.........t..?..a.@....@1.%,.6.B..t...b.AE.....SY.O.......(}.......4S.. ....h99..Cs.$|..g.....b.D.K..K.l.W..U.2Be...m.......x..^...^.H4.........q.0w...h...F~..&.Zw5.0<.....l*... ._.4.@.z..4.`|.@v..[.6.`.<.)..o......X.y0M,f.....|..!....#.~_...o.. .@i...N!..-......5...r......w.j9'.0..g.>..>....,L...l..........A.x\.a..?..D.!\.?J.s......1..o...n..D~.H}...Y.....d;.^G.;.(,..Q.|...K......@I..q..2RQ.I....l..v."UgE..9..U....Y_..m.u....p......%.H.'.0..4W.$Q..>.%.`.,.YZ...n2.U.......}.q....-....._..t.i.-.M~....g..0..s`...:x;.....aA..VC.....q.O..............w.h....,..........,..n*/''V... ...s.....5.....7x.iK..
<<< skipped >>>
GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=94214117414&varName=crtg_content HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: rtax.criteo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Server: Microsoft-IIS/8.5
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
X-Powered-By: ASP.NET
Date: Fri, 18 Dec 2015 06:49:08 GMT
Content-Length: 165
crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text/javascript; charset=utf-8..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Server: Microsoft-IIS/8.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..X-Powered-By: ASP.NET..Date: Fri, 18 Dec 2015 06:49:08 GMT..Content-Length: 165..crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();....
GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=36197053729&varName=crtg_content HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: rtax.criteo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Server: Microsoft-IIS/8.5
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
X-Powered-By: ASP.NET
Date: Fri, 18 Dec 2015 06:49:09 GMT
Content-Length: 165
crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text/javascript; charset=utf-8..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Server: Microsoft-IIS/8.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..X-Powered-By: ASP.NET..Date: Fri, 18 Dec 2015 06:49:09 GMT..Content-Length: 165..crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();....
GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=61759328311&varName=crtg_content HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: rtax.criteo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Server: Microsoft-IIS/8.5
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
X-Powered-By: ASP.NET
Date: Fri, 18 Dec 2015 06:49:11 GMT
Content-Length: 165
crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text/javascript; charset=utf-8..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Server: Microsoft-IIS/8.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..X-Powered-By: ASP.NET..Date: Fri, 18 Dec 2015 06:49:11 GMT..Content-Length: 165..crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();....
GET /delivery/rta/rta.js?netId=1844&cookieName=crtg_rta_st&rnd=21779022559&varName=crtg_content HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: rtax.criteo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Server: Microsoft-IIS/8.5
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
X-Powered-By: ASP.NET
Date: Fri, 18 Dec 2015 06:49:11 GMT
Content-Length: 165
crtg_content = ''; (function(){document.cookie = 'crtg_rta_st=' escape(crtg_content) '; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=softonic.com';})();..
GET /es/css/generated/2d9b4-fff45.css HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 10 Nov 2015 11:00:44 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/css
Vary: Accept-Encoding
Content-Length: 8171
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:04 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 2991173
Expires: Sun, 17 Jan 2016 06:49:04 GMT
...........=k..8r..W..h.........e.n.....].9...,..nd.'..3kt~{...(.v... .;..T$..b.XU,.>..u.Z........7..9..P....U.C.vh.....!......@......vy(..m.2G5...............>......S...uY=..E....P5E[T.y...-..b...b.....v.`|..XW..]....2...........=..A.......?.EZ:...u.|7.%.......................h..j.......D.v.\..v>....4....b...w*0{F.f..W...T-{....y..X...j.[....[V8.x..Q.y.....3..MsL5\......*}.....~....0....A..;=K.?....t.J.O..:.s...>H..|"u..?....=....s....>.Q..........O...."...........S..O&...a...r..(..v...f.~4.T.6j...Y...{H...1KWMU.1..!.9......4...._.....yh..e..(..&3.P....~...[...E..PW.".....e.'./5..uU...-..j.u.m.4/.../>....>......G.J.........(..z7B..z.1..:.^.......~.B.R..x... ... RM.Ax...d.K...............W....~...._8..-Y(NT..(...>..r.U..'...<....!.T...Q&.>...9_A/..D.x.P...?tR.......R........].b.}b_...R.k..{....`6........ST..:;...q....Lh........W...?&. .:......L.!.......*UNLz..b#.BI.c.N.I..T.a=i..h]......8....,.].......q&J.,.(.l.......h.\.O..?.&S...Sgl..,q....]...v@R...>.9...F...f..l..>!...=.........q.W..]j!...hFV8N.`..T........rG..M.........../Q.W(.5..7.[...Ki..x.un..Z..116.A...a.7..b]s.W.....j2........x..R......J..P.K..\.6:..-.F.......o@Fv...T.C........7......y...r.6F...L.P...7.....v'VQ..D....-e....Wb=.,(#G.?z.2..=_V$.h.........)..83... .G).=..*..ol.&..<....7..... ..$.DW..EX.#..g..3.J.b.g...Z. ).f0y"._. ..D.H#Ld.f.....g:aV5J..>.V.8S..#\.M._...ihe@.&[.....g^.<h%..v.f....Wy.A../Z.}<OU.......t..}*.bU...1}.,H.X.y x>...:.a.p{.nok fp.T..E.AL{M$...1.....q...c......8.....[.e.6a6z9[.".
<<< skipped >>>
GET /es/css/generated/b5ae7-49f02.css HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 09 Sep 2015 10:13:15 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/css
Vary: Accept-Encoding
Content-Length: 3152
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:04 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 807805
Expires: Sun, 17 Jan 2016 06:49:04 GMT
............ko...{... ..]..g.8X..p@?\...(P...%.6/..#.89#..3....rr:...n$...79....".M..,.....?}..........w ....Q......DQ/!..K8..A......~........7e..]u.I.......>.&D.....J1..L.LMe..,.?./....A>..|u>.?L.w..T...?.....~.......^s..q<.sC6...........td.KC?b...W.....x...r(2.dBb..d....rk..........1.3.v....."7.8..(.....(.{..\.......!M.Y2.q.I........G.....5.*e./G5Mj.&..Z...,...0........4.Ot\...M.....fp.O....4..6.q.sn..LQ9.a \.".h<..7-..e...).(.G...DJq.3J..&.qM...,....4...c.....b:D~r.i..k..*....=B.....|.. ..p.D..$..gi*bU...e.`t......T8.a.Od..h.#>g*u83p"$.=.....D.%nA...os........Nn'd..tG2>@.....tU..@..7.L9.)..s.S..)!:i5._}..........f7.M.-..=..<PU|.TB..M.U........`;j.:*!........OG....j.<?x;.....no...y.K._.U.;a:=.8......r.....!.!I. 1.(..Q.S...O(.......!..!....O)}............ '...0"i..Nx........p......T)d...I'ZL.\..H...b/......)...."x< ..*.......1S.l................6s<.{...PP..........(...4!.>..I.9... ....Z.s....Ax... .......5......F{...6L.....$...9M1.n.%...q/E...L..W_..t.~a...b.._O%...1z;M...wN,.DK(I......L*!..`.B.. /5r_[........w........]?..l(pt..%.7#;....g..^...L...*.$y~...j..rM.!..b}...8J.$.......,."rn..*...q..I.^HFU C.......R...N....4......C...y&.Et_<....Q...v.Z-....t..V....s...q..!...w........c....8.5Up........;.X.2_...b`...6^;ZN:..'.2O...O.&...Qk..S'.F%%..\.U.q.r...p..._.x.....p'...L..J.,..s......E#.iA .0.R......Ji.9...Zix.....p.5".b.A.T............>.6.`.XR...bZm..E..Frh}sB>.IJ@.z}.z.%)..4..]..phpc4<c.9.V....;....,..1.7c.K1..7{....`.AE.A.A(?{.h...{.U.t..H...g...5..0..._,.v..
<<< skipped >>>
GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 13715
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:05 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 98
............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...
<<< skipped >>>
GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 14130
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:07 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 86
............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<
<<< skipped >>>
GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 14130
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:10 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 87
............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<
<<< skipped >>>
GET /shared/font/softonic/font-icon.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 17 Nov 2015 11:00:45 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 4997
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:10 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 68
...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K
<<< skipped >>>
GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 14130
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:11 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 89
............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<
<<< skipped >>>
GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 13715
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:12 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 100
............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...
<<< skipped >>>
GET /es/css/generated/90f12-4a489.css HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 15 Dec 2015 11:00:31 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/css
Vary: Accept-Encoding
Content-Length: 29552
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:04 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 1460649
Expires: Sun, 17 Jan 2016 06:49:04 GMT
............i....(.}~.. :.i...EkU.o.:....:.=.fb.\.%R%.)Q..^\Q..aG.H.T...}. .J"....H$r....8u.y..r.F.7.....F...M..........j..].....:..U....\...J?....Zx]t.yp....).k..:.w...?..o.......g.(......U..;..I....;.n..C{..............:..8t....:tU..)..Cw.._N..o..H....Z....F.G...%.....j.o.}a........7.H......T.uU.U.......z.n|%...v.0..."9.!...R}.1...;.. #...{..... F......c._4~N.[....KG....!4.......|.y...x..k...Po...&......t|.lWt'Rz.."E....cu(G^.....s...3..q.i..D.h...sWU.q|>......*.........,s_l..L...Ey.Ub...d.7.......O...!$...{.Pw..n....]M....oH.....s;....@..g..s.n..}qz....a...ISm....\<F....6..=D......~.H....=.o..hW.t .1H..!..rl#......`..u.y.xj/.2..M{..[..t.s.pj...Z......W=.b ... .v...c.CT.7.#BJ.j.....). .) Bv.N..4....T34HY8.N.....y$...!..4 [L....?.........!..cu.k..............Z!..4B C0..?.e..4...j..........u...T....^...,1hcUU.....i....r.Vm..jYU[..5.[.V.......a...O.'.s..c.y.~.F..#{....E..}.:c...D...9.:.q .F..;.....=a....y7b2...H.O...PEl3y.....-._u..~.fE....U....?..S]...._.....=...pr~^...qY.....<..r|i.m3n..........&..t.....jL............x9....3....q........y7>.....Hd.;.eY...'........g..=..SIw..i.cW......i..!x>J....Q..i.?.,..Tw..n.).t....P.i.j\n.......#....3..K.....=T...y.D{!*..9......?QO...>M..X%.._W.....-1.......4.6...y...T.D&R...*...].O..L.......\..h..%..a;v.}...e..-..OP..c.k....S]4...Neq(..................jo..,&.g>.gK....jF.c. ..yN{7...]j...=....aD...8...o..%6....R?I..L..L&VC&1.y&./h.^..........<^2.sIc..4f.Ac..6..<.-:.x.3B'..I...87.....s./..&c.3g.,2Zm...b.O.......m..Ap.....h..>G..i|......?..i7....
<<< skipped >>>
GET /es/js/generated/eaa2a-e6efe.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 08 Oct 2015 10:06:07 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Length: 46093
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:04 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 38005969
Expires: Sun, 17 Jan 2016 06:49:04 GMT
............y{.X.(...>....BA.v.'..u..*U.:NM..<B..6 ..C......'!...s.....#m.yX.^......M.t.......^s....m=Y..O.4o...a...8........Q.~.dQ..?..*q.....e:M.i6Y...n...~6..O.i......K..7.,....3...h.ov....f.@.7.D..|..6..(..r1.r..K.MRz..t.%...8u.g...=H.i.....f.F.......M.L`G...i..x.........~:..........L...h..^%....~..qc.m..d.5.U?5..t...j......~...............4........$.....Qm.....qck.k...p.R...Q<.%i.v...u...s {Ni..].$..O............<U]x..F0.........(.i.....:.wg....O. ..%kP.>C..wo>...1l.t....b.|../.i...w7.n...'.r>...|%z.D?...ZQ?....pz?N.....`.FOkI....h.Do....u...W.P.#>..D.,i....N......Do.h..f.%.(...,..Q..s.m...g.......k.E.iv.31..~..^....}.d.t2.....y.>...O..M.tw..I:.MFk..v..S.|.....-...A.8.jW7;.J.q.<9....../..U.>.......l.].......Ep.n..>..f._.~}vw.......A....A}.g.....:..~....'..T a......."...rv[...'g[..P.......9~....N.xX...'.t.nA.?..y.c..\...u.............h2..g..$.<?.|.y./|... ....b.......O'.t~...t>....M....Y..N.g..|...k..Y.f.v.[?x.b1......a.N`7Wp.~.........%....ko.9..t2..5..a.zx...|P..Qr.:.]..p.........T.&.8e.&...icE....8.nR'........".A.i.A...).........[....O.i..(o..F......gt.b....O..#i.F...x.M3...>..< .1.!.it..p.7.e...u>.p...M...T/......$..f5......5.........y..:)........C...7Nz...ww.6.. ....3...I-.KcXyl.......;..|...S...U.....>a..;.....kow..=..a:.H 8....q.......0....^m.%.g....e..V/....... .c..81.w.|*.C..j... ..>t/..W.w...r@.......^.)..............`j-.N..@}Y,.........t.j.bg_..I.gO;...>.o........ .F..0.|...k..]q..q^.p.I.....}...'.....R.........;......Na...j.B.u_.I...j..
<<< skipped >>>
GET /shared/font/softonic/font-icon.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 17 Nov 2015 11:00:35 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 4997
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:05 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 27
...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K
<<< skipped >>>
GET /es/js/generated/4cd46-1a865.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 17 Dec 2015 14:56:18 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Length: 6274
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:07 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 406972
Expires: Sun, 17 Jan 2016 06:49:07 GMT
...........\yw.:...>..;'.n..f..t.$m.lm...4.#..Imp..q..g.......V..........{.....,'EK..............1&..;....r%N............;?.x..PN..{....Q..K.(........-z..;...b...}o.\.......b...w.v.$$C...M.....V..w....=t.....3...Io .. 'I...~.V7m'P.......P...[q..&n...x..o].F.8#...9:...v...*.!A....Bd.m.....)H.".vs.2..u.dG....!......p.... .9...u...?f%.4 ......;..^.....y.FLEw,...N..a...J0.~...ph ..U.8...{..$.....8........95M...t.$.Q............@.......$\.........'.'..M....j.R....t2..d...w'q....Y{.......h...y....."fhZm%....... ..N...X....nU6...A:..S. E..#96.".D.W9J...Q...4.p.G..F.gG..'x]....q... 0-.1.b..(.......i...5.x...@..bC.Xl...C...].mYF.H....P/......s ...b.?.9.x.~.....d.^..V.*8..j.cFz..y.F<.F-....lA...#.1..:.m...D........4....p..0.uSqB.v .q..c..........a...........C`..U..L..&.c...^.pp.9....iF.U...~.!.v.(.u...,..:r.g@EUwp..0....N..I0/.d...h....kWh98..B...0K9r...&. ..4....g...65JG4u@...Vw..KrT...B..Lg.D...\.....C.Z..B."..J.qN...6<.......I.....".....D..U.C.D.^..A.AH9.,.......tt.*.Ji.."b.2>...6....u...w$..k..#.vj..-S..B.........U.x.jMk;J;...'..Q..$.ZB..y..('.'.!.k..~9..=............j.UB.8...#v.F.a_.@..`PD.....yH#...P.B,..U>.t..<...:.2...*Yw9OA.. 'E3=.\......N..D6.I...k...h.GI>..4F.:..!.3..tQ.V.9,.i..bB.i...}L.....Z.#.....`..!..ht..a..:.X5m9g.g.P. ..[..x...o..z....D......4 ..F..H."....D.5xE.<.....@uh.,..=-j.b.....7.4];..Ck... ........KX=.!N'ph1..^.8...@..]U.U....A.._..6..Zd.....x"...L .z.iD.......Q"7...b.5US..{.$rmO....U.{h..m`X&d\.cg.in=\.......Z....,..Y04.."..&......|Fb.mK.B.s.hC(.c."9..A.TL/.M...".(.@....A
<<< skipped >>>
GET /es/js/generated/427b6-cd0ca.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 15 Sep 2015 13:30:42 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Length: 8368
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:07 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 1919820
Expires: Sun, 17 Jan 2016 06:49:07 GMT
...........|iw.6.... d..EZ4-9MkSAt.g...Ic']$..\$1.H..d9..................$..l....<:..#.'~Z.f...Dk........>.]?.k........G.d.....?L.C7I....O.?.<..9.s..Ec..e..............(l....M.(...r.....V...........S?....4...1-r>.n.u..[.....YF?l.2..}...G.../..0/..."w.D......^........q.....d..U.....L....{34.{31.... ...Yv...gL.....|...;l.Z.....{..q..K{....{.A.@3g...u.6..wo..f:......z.A../5..L.i....?.iY.{S.........wot......n......lYvo. lYA..[V0(..n..p...^.....(|.6K>...c..:;v......o..f.n....{=....u:.t..._.....?....1.1.a4`.o0Lk...e..44....i....Z....Ck....5............/..'U..o&H.9}..~...:..);.q.1z.G.a....(G.,..U..l...|...[...Cf....1....".l..I...\=y.7.^. .).......Z.Gk...$......'......t.lj....C..w.....b..5.!>|S~.........2.v.n..a..z.......:aT.b|.`.*`......h....h?....D.i(D.W!...i.q...:.);...S`~..o..M..2`...Q....H."~..K.O.~....10]3rN....,4.c?..a-..p.q$.S...}.w...e.>N|.....K..O...............%..G..........._...'/..%.4.O......L..F1r.g.|. k.......4.O.....5.^....g....<Id.q..,.B.Y..o.c..........q....OV.../..~8LGZ;....io......D....#.O...m.W...:?.5&..S.l.......B.p.8cdy-.i|.....?..Y..........x......-...,....9O}...\c.n$.....5....B`....~..kO.m}.7<2..:...J..q...D1X.S...A.')...&&]ZU!#Wpl.O..O=.n.=. ......@.:^...A..Iy....y4..4#.fo.:o.1]...",.p.?...-.....z....M...Ik.......)..= )i.....``O..w......?...!..P./!......#!J.U.(.\RY. .K,.=v\b.36.[....,.2..2......sQB.....8..M{.qi. v......a.|.Y-.......A..E)u7JX4...M....z..l..b.Y..24..|m>3}...ES?.G...I....ka.S.H.;v..?E'..8..N.....B.x.Z-...d....a... p....g:...Mg$......A.t.7..u..Tv.3...
<<< skipped >>>
GET /es/js/generated/1467b-931a2.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 15 Sep 2015 13:30:37 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Length: 3783
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:07 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 42702117
Expires: Sun, 17 Jan 2016 06:49:07 GMT
............]s.6..~......))..zb.......q.q;w.....EZ...A....~..H...4..Cbb....{......c9....../.98....t.1.>.G.s.S..^r.<.....4.IN....@....NW......i.%.ej._.>.....o.>^.l.(FX.>...........s......Y{.@.-..q.VhQs.........l.6m................R.3".`.X....7.[..j|&......cs.G..H...,....'...Q.O..#...ss.(/XzPO.[<m..Y9...j.a:a....q...Y...f.......=...T..K........l....[..P|......-D.|.y1.}..@..0..`Nm.Q.Sb....o.PQ#.I...S.4.Gwat.....H.......[.Q.Om$.q...=.G.(....&....^.$.i..V$U3w@b...6.[Q.%|C)'..5.Ob.A.a.L...f...-q...og................,[...i.*g>..%`VH:t%.c...;%'...9G.%.t..\..([.........:...[F._2..^..........8.........)%..D>..Ec....>..G...)...F.onW....|..aB....5......rA...Io...CmF.nZ$I..EJs.[Q#..'f.H.....6..1_.I..#......"\7.v.g..}s[}.. ..nx.....v.G|/)X.%8^.h.. ...\.....{.3{.2....k.&.......>'.>.....T.-(a.@..n........MB.3?...... r..s....Nh:...p.K....Y...........??.'G?.M..p........d...4!..........'........kL|o...9.|.XC...i@W<B`P!fi:...X..h..|JSo.........x-......P..T.....R....j....,.h....4.o.U..o.i.o..'^:/ .aP. X.IA..nF.B.^.........aRFe.p.W@./=v7.....Vs5.hH...A....Y..t.Ub.X...,m..2..........X.V.....i..#.e". _p......r..r...R^....Tc .5....B..-...5.. h...Y*`..v.2....n.....4....(..8`............P.2.1O(...B.....8.8...4.a.....".v*...4.@..."a.$N.SH.,..`v..Pj!.....K..A..\y..pG..u............H....<.~..W.|.}.E....v......F...\..*..J.....5a.z..V.vv..l....*4...l........T.H..@..rVPGE../.!..D\.]...O.........F..c(.2&.o$.@.qs..wdDR.i.>.,..l...4.......)...V.....y.0..U....,..%..........^.p*.W..."Hu......h..>$....C a
<<< skipped >>>
GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 13715
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:10 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 71
............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...
<<< skipped >>>
GET /shared/font/es/OpenSans-CondLight-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:43 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 13715
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:11 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 72
............UT.L..g`...VVV...,.kpw.......-...........`....{.{.....<UoW.u.....(.. .7@..<&2........8....:....eB.............*.|..?..x....... ..X.........E6....[m.c..G.=..............\..x.GH.........GK...p.7y.........:....2..>?2.......[.PC..........L<UC.....8.9....Q.#~......>g..A..9u-...`.. .a ..l.inq ~.m..u.36.........1..%.7F..._.GE.......IB..b.Y...[j..\.8...RN....*.RP..87..p...W.)`.......A..p.......P.../V.ce.]W..*.......J $.t......Q...%.`a3..R..]e....r_t...^.z...0NW....3.... *.]........3.........C.sm.....5pa$.'>.....c..1.6W.i).Zc...nZV..`.uV4..O:......L.. .}.....^...I..t.....z1$y.@`.cz..iP}.........Dl......^../.w...?.J..60.......e./CN.....u..b...@.#..*#....L..b.....6 3....q.v@!"M....o.A .......s..Fd.5./...1.].Q.K]?....#) *..epx.........k,.$..7ZO.p....L].....".....pQNE..q....j.,&.....:.. A.6.c.M.....^O.......[Yr...!.L.bB.fV6]...;;.........G-............V..t.xoQcA....]. ....<"$q.......'.f../`......}....%...yq.....2.W..E=8..].%<X.|..'.:?.!...G....T.C...`..............,.y..qL...pnS..!.JY..G.e_.;.K0.....r..~<.C...w....u.b%.^...Xa^.J.4.d...`...F..|....2d.~C...[...e~Tt..!........C,jy".FG....6...i.....I.....D{...l.#EI;.....Y8...b'....@.n. .*.......p..c..GH....\P.1..9Y...|x.m..F<`Py..ih.M...J...c|P[.E%6.j.....#.^..=.".,.....%W.`.W/..|2..TG,K7.{U..| i...I..-.n...3mg....\.I(.c..d...).....G.=......;..T.1Z..dW...Di.....L."...'$=.p$.p...QQ.Pn.w..%#/K..4.1Y..x..}Z...*Q.....lTx.R".CD..%."H3.........P.G...T'..Dp.....E......Uc..-}&.3m.f..K.k.,i-..06..$..GI..}h-y.....D...` Y..|....L.#.g..b.U.'....G...
<<< skipped >>>
GET /shared/font/softonic/font-icon.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 17 Nov 2015 11:00:35 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 4997
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:11 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 29
...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K
<<< skipped >>>
GET /shared/font/es/OpenSans-CondBold-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 09 Apr 2015 09:12:46 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 14130
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:12 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 12
............UP.N.%<30...0..Kpww.4..VVV...KH.. ..ww.....I.........]}..sO...............o!..C.4.$02........i...@.=3(@....G.....p........@.......g..X....cr..........v.9........I....................x..;B..~.......y6$..).... .....>K..05.p4.R.......x........."G|Jz.{.A..N.~`.A1T..9.<F.C......Z...H....0>}./i>'8.Jg.e.k.P.vX.Z.._E...23F./M.) pJr.....7..Bi..r.h.hV.... ...e.i....AJ.'.0.r.....L.\L.oD.,..0...e............e...]<........S\.MJ.8....R..(w.?....o.....e.u.fs.....m....0..........f?..WsBmRR../.`.~...v.......(..6S......n_#.d6)..MVYEz-.2`:.....t.e.l[Xyq*M.n..ZTw..~y...N..6nC..x.3D.....OD[.K...UV.......#.d.;F.^ ....UH9I..Z~P...}H..I:.k.....AR...?7.kf.K..O 8...d..Mq....B.........M......|X...4....{....K0...~....`.w.;w...Ha.....E.J..rD?..nXr.9^:3.\T.9.s..Y..T.\I.lA?^........HagT...~mb....[..m...'B.I.......~m.....`.l.2:..5</i..m.b...`.......G.q9..yB(.X.......D.r.K"..E..-.r...s...ucK$.Q. ..B.V.b{....=c ..D...........~g...!...)...!.....K.....NA....:.yLWlg..2S........'....I..<......,z...1R..=.nz...Rv. .....S.b4..|...8{...1.)....?B.....`.M.....1.....~.EWV......a.. h....y......*'.I.D.....I..S......)...P..5gk.I.8.~.].M,....F.i..)..s...b..M.......y...T.1..F.f..}...;.........Z.b..b....k.klb..F.......E...H....L`.......a.)R.W...W...H.|$.2.....=<.........T..i....-..}...}.@......6.$e......~?. ..EU.\e.."..%..&d.)!.v.I02k...e.........8..e..MD.7/..`."!.=.V.........G>..........b...4..c.8f.._..B~..Un.5ZRP.H..........-T...4J.'j.}m.t..)..!.XU.Z2...NG..;...>....v*8@..lo..c..T..[...<..`.....P.$"0..$r..^"<
<<< skipped >>>
GET /shared/font/softonic/font-icon.eot? HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 17 Nov 2015 11:00:35 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Type: application/vnd.ms-fontobject
Vary: Accept-Encoding
Content-Length: 4997
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:12 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 31
...........Zk.\Ev...G.....3..qw....k..m...x.0.1.y....1.36.<V....$.8..I.n.!....*.....CVV~D2.<.*H.V.-.B"A....]e&.....clr....S.N.:..sn..8c..2....^.......}.G^......}.....4.c....0;...y..;.N.'.)v.=.H.....v.X.S`u6.j...M..y......jX..........;z...>.o ..}....gP&.~..u..7....}3h.36..C'.>...... .C..!.._)q..C{....=..?TH..#..>u.......k..w.}.cG.9.........sG.;...=.<......9}.......~.....LG.>. _../.0{.J.'...4c..|ie..8....5.G.'KU`.2......d...'.?5W.weE...}.D..|<...G.......@a,....1..0!.../@'E6.x.4.R..nu;.F.......@L=....1..Q.a1B.v......Ah..[.......CO..........q..4u.@s.4tU...vTt...5U.EXwY.^N8..$|z..u..`.:..M.@ n..$.Y.c ...(*\U.A.. ..B..........9.>......_.....././..k}..*T.|.rc..m1t..V..~.... e_........kS...v.P<...b[......r....Y...e.f...&.{....b..=......"t..7......-.../.... >AF... }.F[.(.N...6.P....#.G.#?.@....l...P=.......f..-......6`..j.\w|.O$b1.r.d".J%.D.3..........j.i;..7....U...k......P.m........d2..,..S..P.d..&.1k...|~"...3.3.^g...k.`,....T.,..'3.o..$...^.7.L:.....h..z..e&S.....r.A2.8..p,..i..9....VT,...g.A.......a..KS......z..)........2.Dv%.P.R.......}.#}..,EXHo.X...)...b,....*..)(....mT.B...j.....N.lUKf..).7=k0..Q.WB.^3...a..N.RmJd..v..,.-...R.&|..>&....-0R#6.ldV.2K...u...y...%f\5.&>..I.....j6............ .fs.h....!..F...YS...<uP....d..*...G...z.<&..O....A..jucu.....x....s.f...Z.4.h.6M.'\U|....9i.J:..FP...H.-...3..q..c....j6..z.M .l1[...J.$.8.mt..]H.cv*$...b...!.z.J...*..(.#..A@RI.j...W...H|h[.6....L=S...S....8..Y. u*.['....e...w4.....5.;.7.c...5.....s...::W5.5.k.S.J..*..|..... .K
<<< skipped >>>
GET /universaldownloader-prefetch HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: latency-optimizer.sd.softonic.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Fri, 18 Dec 2015 06:49:02 GMT
Server: Apache
Set-Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; path=/; domain=softonic.com; HttpOnly
Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:01 GMT; path=/; domain=softonic.com
Set-Cookie: blang=en_US; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com
Set-Cookie: country=UA; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com
Set-Cookie: ucountry=EU; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com
Set-Cookie: entry=Direct; expires=Sat, 17-Dec-2016 06:49:02 GMT; path=/; domain=softonic.com
Vary: User-Agent,Accept-Encoding
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Content-Length: 11322
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
...........}Y..I..3. ..;.U....>2.b.....]bUwc..&<#<3.*.......&..E..B.~...P.Z.... `...a!H.. 3w...##.j. ."f."#..>7777...../...szB......>1Mb....In......<!....F$...b..........E..<v.....,&...../..M&..<F...hDV...)...].F.E......q.;V.....MOP.&@Bd...lh0n.....s}.....W0.;.......t.}....L..&Ap)8.z...t........b..0:.......8s|J..0...8.6=.J.....)..4.,..I<5w..M?..cC.f...0v.. ...........,.5...".;.MlF.A...6K"JnI....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!....@......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;.;......Dg....rx.i.^BUi_..,r..R.@N...Z...@..1....(..GF..d...*.7.W...?.........Sf.=..%....3...h!...jd.8.ug..,...^o....tsw.#.....@.._-.'c<..&..t:..Z........1yuBv?.\X&[....{..`...'..o;....d......jswko......j.R..,.mL.c4..)(h$....4._~.l.Sp.J..W ..<aGP.........j*..^VF...l.MY........J...6-{s......j~...........i.=..X.k.A..7.w&..F....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv
<<< skipped >>>
GET /shared/abp_detection/px.js?ch=1 HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: latency-optimizer.sd.softonic.com
Connection: Keep-Alive
Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct
HTTP/1.1 200 OK
Date: Fri, 18 Dec 2015 06:49:08 GMT
Server: Apache
Last-Modified: Tue, 12 May 2015 12:57:02 GMT
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sun, 17 Jan 2016 06:49:08 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 236
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Content-Type: text/javascript
..........eP.j.!....aQ.1.^.,.z..7c.....&V.@H.....B...o..7......x..cP6..&(ho\...........,.cx.}..]M.Q.!....SQ;.p..i.If.\@r_..3.[...5.....wGq<..=....!B..&b.T#...../l.x."...y......-6...N.....V.......L.\..u...I.;......RF...gRSl....~..5..Z.......
GET /shared/abp_detection/px.js?ch=2 HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: latency-optimizer.sd.softonic.com
Connection: Keep-Alive
Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct
HTTP/1.1 200 OK
Date: Fri, 18 Dec 2015 06:49:08 GMT
Server: Apache
Last-Modified: Tue, 12 May 2015 12:57:02 GMT
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sun, 17 Jan 2016 06:49:08 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 236
Keep-Alive: timeout=3, max=99
Connection: Keep-Alive
Content-Type: text/javascript
..........eP.j.!....aQ.1.^.,.z..7c.....&V.@H.....B...o..7......x..cP6..&(ho\...........,.cx.}..]M.Q.!....SQ;.p..i.If.\@r_..3.[...5.....wGq<..=....!B..&b.T#...../l.x."...y......-6...N.....V.......L.\..u...I.;......RF...gRSl....~..5..Z...HTTP/1.1 200 OK..Date: Fri, 18 Dec 2015 06:49:08 GMT..Server: Apache..Last-Modified: Tue, 12 May 2015 12:57:02 GMT..Accept-Ranges: bytes..Cache-Control: max-age=2592000..Expires: Sun, 17 Jan 2016 06:49:08 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 236..Keep-Alive: timeout=3, max=99..Connection: Keep-Alive..Content-Type: text/javascript............eP.j.!....aQ.1.^.,.z..7c.....&V.@H.....B...o..7......x..cP6..&(ho\...........,.cx.}..]M.Q.!....SQ;.p..i.If.\@r_..3.[...5.....wGq<..=....!B..&b.T#...../l.x."...y......-6...N.....V.......L.\..u...I.;......RF...gRSl....~..5..Z.......
GET /universaldownloader-prefetch HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: latency-optimizer.sd.softonic.com
Connection: Keep-Alive
Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct
HTTP/1.1 404 Not Found
Date: Fri, 18 Dec 2015 06:49:10 GMT
Server: Apache
Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:09 GMT; path=/; domain=softonic.com
Vary: User-Agent,Accept-Encoding
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Content-Length: 11324
Keep-Alive: timeout=3, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
...........}[o.I.... B.;]....U,.Y%S....IM..n.4.BTfTU.y..L^.[o.._|yX....`.n..._.........=..>'"23.RYE.zm..L3 .D./N.8qN\.......7.'d.{......$......6H...9...<..gD...-.9q..>.~..YD,.c.=1...bB...w..>.d...c.,..FdEh...p...h.X.;...`...cu........i.$DF\........An<.....Py.......?K?N'.......Zl....C.cc.;.x...3j.......4 .$.w?....? ...?..M.......bJ.9.8..F.O.].t..>......"'...7.f.|.}.oi4..K~.. ....o...i.y......[.....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!.M..C......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;......^}.3@xd_9<..d/.../.k.9.~). .Q.]...u.K...@.A.[.#...2..t.... Q[...`.......)3..K....b...Sj..]..5.d...3.v...|oc....:......f...g.W..........N.......y.L...W'd....e.E..9..n..a9|....3..^O..P..l...[{[....Z..Jq....1..........J....|.U..O.U !F_......A-..G.2..#....zY..}j.m6e..n...2.(....X.`......j~...........i...-.(...2...w&..f....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv...(.E...:.
<<< skipped >>>
GET /universaldownloader-prefetch HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: latency-optimizer.sd.softonic.com
Connection: Keep-Alive
Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct
HTTP/1.1 404 Not Found
Date: Fri, 18 Dec 2015 06:49:11 GMT
Server: Apache
Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:10 GMT; path=/; domain=softonic.com
Vary: User-Agent,Accept-Encoding
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Content-Length: 11321
Keep-Alive: timeout=3, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
...........}Y..I..3. ..;.U....>2.b.....]bUwc..&<#<3.*.......&..E..B.~...P.Z.... `...a!H.. 3w...##.j. ."f."#..>7777...../...szB......>1Mb....In......<!....F$...b..........E..<v.....,&...../..M&..<F...hDV...)...].F.E......q.;V.....MOP.&@Bd...lh0n.....s}.....W0.;.......t.}....L..&Ap)8.z...t........b..0:.......8s|J..0...8.6=.J.....)..4.,..I<5w..M?..cC.f...0v.. ...........,.5...".;.MlF.A...6K"JnI....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!....@......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;.;......Dg....rx.i.^BUi_..,r..R.@N...Z...@..1....(..GF..d...*.7.W...?.........Sf.=..%....3...h!...jd.8.ug..,...^o....tsw.#.....@.._-.'c<..&..t:..Z........1yuBv?.\X&[....{..`...'..o;....d......jswko......j.R..,.mL.c4..)(h$....4._~.l.Sp.J..W ..<aGP.........j*..^VF...l.MY........J...6-{s......j~...........i.=..X.k.A..7.w&..F....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv
<<< skipped >>>
GET /universaldownloader-prefetch HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: latency-optimizer.sd.softonic.com
Connection: Keep-Alive
Cookie: PHPSESSID=41db52a0dbd9a856f42d48644a9e9147; blang=en_US; country=UA; ucountry=EU; entry=Direct
HTTP/1.1 404 Not Found
Date: Fri, 18 Dec 2015 06:49:12 GMT
Server: Apache
Set-Cookie: softonic_es-admin=deleted; expires=Thu, 18-Dec-2014 06:49:11 GMT; path=/; domain=softonic.com
Vary: User-Agent,Accept-Encoding
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: max-age=0, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Content-Length: 11319
Keep-Alive: timeout=3, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
...........}Y..I..3. ..;.U....>2.b.....]bUwc..&<#<3.*.......&..E..B.~...P.Z.... `...a!H.. 3w...##.j. ."f."#..>7777...../...szB......>1Mb....In......<!....F$...b..........E..<v.....,&...../..M&..<F...hDV...)...].F.E......q.;V.....MOP.&@Bd...lh0n.....s}.....W0.;.......t.}....L..&Ap)8.z...t........b..0:.......8s|J..0...8.6=.J.....)..4.,..I<5w..M?..cC.f...0v.. ...........,.5...".;.MlF.A...6K"JnI....q..... 'J8<px..../A.,..B.o....!.7.j..0...?^9...o.._../.....~...9q.w./.f.bE .@.Fo..F1....>...F..%.....uG...?].Q0.b....n-.%..."['Msn...f.q..#.R.y..(.3...6(`..i....../.w.......S...M.\$l..1....!5 ...\E....l.'.$..m.\;.wN(.R..zNd...G./d3.A. %..N....-.e%y.r|.o....F|.c.go...0.....B...l....a.....Ib.....Cy8...b...!....@......q. P..c.rT....|Lb.._M.u.@:.^...H.=.../^..q..dB(....u..\s.......... ....l_.5M.Vi.".....m.u..e...U....x.Oc..;..]............s...`..:.?[.&..*..3....,*........h!.................(..PA.i..'.N......[;.;.;......Dg....rx.i.^BUi_..,r..R.@N...Z...@..1....(..GF..d...*.7.W...?.........Sf.=..%....3...h!...jd.8.ug..,...^o....tsw.#.....@.._-.'c<..&..t:..Z........1yuBv?.\X&[....{..`...'..o;....d......jswko......j.R..,.mL.c4..)(h$....4._~.l.Sp.J..W ..<aGP.........j*..^VF...l.MY........J...6-{s......j~...........i.=..X.k.A..7.w&..F....s..z.w!..i....t;..Z..?..`N....IKD..E~..$......6.x.].XX.>.......V)qC*(j1..<..r6.LK....VK.c....t..[..<..]...1K.....Mb.eUQ....8.....-.(v,..u..o...eie...K.v'.4t...B..X....$.U9.'..R._...<s...".i....%..)..-.....;S=.....8. .t.......4..7.a(>.oy._U .hRv
<<< skipped >>>
GET /aax2/amzn_ads.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.amazon-adsystem.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 4756
Connection: keep-alive
Content-Encoding: gzip
Accept-Ranges: bytes
Cache-Control: public, max-age=86400
ETag: 684fe64613a5f767675bcef1070025ee
Date: Sat, 12 Dec 2015 23:29:50 GMT
Server: Server
Age: 26357
X-Cache: Hit from cloudfront
Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
X-Amz-Cf-Id: SFDRPxfKUqCO-y7gGPqX-eQsvPj-gqC5qZR3bjC5xARYN4ts_Ar4SQ==
...........[{s.8..*4.J...j.....'.w...Y?2u... ...P.. e ..._7.$HQ.3..u..X..F..._7.I..E.r....w$.^.?....(x......G....r.....Q.......#..Y.XF..M=..:p.>5....^.'.z.........i..A..............@.9L'^....c...9-J.;K.&..............-.whT."c.u.........$.a.l<\N<.....:D9FY.So..?`......4r....{R.B..<...._.&..6.|......t...:i.......:.iR...ckF....&...q.~!K"b...._v.....,.."7g.#I....F..u..O.\....2t..1.....3....l.F.....V..D.=fE..u.........,.z.#..pJ.....7...K.0...T..... ...S.q...Dh..z.........`.z..#..<....8I."# .VN].....z.5=2.........z...@..G..b...{..........Z......r...-.*.a..\.R.."..I.4..,.t.[..X.cz.DD.Wy.Q.{....~g...x.f.p.Y......p{.-.N`v..{0..d.P.\...S....../.i.........,.qCz..O......M<..I.q.t..6......|.5.......v...8....p.|t.6.>Xl..-((L"..[.>l..?\...y^.C....|.........~2.........(2~sg....v..v....p8..F...6D...m...Q.v"{....:........=p.b....E...oh98....J...q&`.8#.._..F.8a^w.I@.z7 .Y...Q...0Q.....X.}..O..G^N...9.R?D?M...zy.... .. ..C..4f...`..j......\\T.5(.e..7....X..,.d.1.%.l... .z'.>.....Dw...5...L'......Y$..t.1d......'.\}...D..L4.,...ey..5.. ..&`....x..!...=.;f...?.?C.&H..{N......h.8.T.&..<.sn7!.[.~..s;..=o...*.._..P)T...-....m....A.Zx>....CT...I..;.,.g.......c$T..e$.|N. .r?..v.{.......,....Y=r..TD..}Y........A.g~...{.....R.o...U.....*..Z.....f..!Q...u3Xj<p..T.a.Z....A.....H<....wG...AR.......f....R..~.m5.......Hq.\.Y..^..pw....]7y!.y..&5l.........g. ....x!....md.....m.t......._{..x-.U.A.J..o..........^..e.. =......kg^.H.^.........t.).....y..H..!.4K..{....:..8...]_^.*QH' ......;...rJ.9{.t......Y.6^
<<< skipped >>>
GET /safeframe/1-0-2/html/container.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tpc.googlesyndication.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 16 Dec 2015 18:25:20 GMT
Expires: Thu, 15 Dec 2016 18:25:20 GMT
Last-Modified: Fri, 16 Jan 2015 15:36:52 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1877
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 131029
......n....W{s....?..0.........X.....i...h.v;.dC....Wc..=..Wr.wwv.u.<..yR.=.l.|.jj..D.;......F}..."..;l..;.t..F........%..B..&.<..{J!..o.$.G..p.R...e.K....7-.._...<bD...0....'1s.i......3G.X..D.....L3G2.x8.......8.D...?M(.<".pd.dI...%b>dIO.N.Cz..`...q1......x$h.I.#...s&.<..|..m.Ke$..\G.a$.ZC..D..D..<...G..|)....v..~2...Vx..m.)8Jj.....e.^.#Y..."0.}....!.....n:......!.b~:j.a.........g.t..n.`O../...V^...I.Z.*"..,.1-..c.qv.Ib]JA.l. ....R.;U...<.k......}..U.....L...<..o...3..ni.|ze.M]..._.k.]....~.J..z.Z............$.S.p..AV.1.X...G}..I..S@b...>h<M.....!......\e.K..K....b.M......-~.C....p.:m....x...D..._!@...d.x.... .)s.B!.v..t..q........1...O<.?..".u...'>.N.....9}.... .{h..%...-DZV.k...t..<.!a...*uD.%6.t......n...^8..>JN.E..<..Op..u.......=s.B..Q.U.6v...%.o....y(...].V!...>*....{8.|.N......Y5 .0.......?.....`c..]..\Rvz.GY......c....-....C79_.9..5.3..Vh^....`......8.T.@|%.....t.OrU<RJ.Y.9.".u:..\X.x.....G._q.?Q......}..k.Q..kF....n0.m...v..l.......I.%.L.R0.....i,.$..26..."Q...sK..X..|...>.|SRq:.Bh...q....k.M.....V..G.O.x.C.,.Ho.Z.F2.R9r.Z.z.uR_b.J`.?p^9...e.rDv...#.".NR..G....m.x.9".......H.Xo....Q...'..S"...b...JFm...y...r....$......-.}..)K~O......j..q....xF*nS.n.g......aJ'L;..(.lhBy.....|..;..0....c.......ws.8-..Jq........K......D[.C..P..........8...0N,..a._).X.g..q....s..=..T;..M..l.B....Z[.o.\...c..z....a.-..{ ...S1f.t....y.nv...T.........>8I.|.Sb.......:...{C..._.Nq..H....Z8-...MT.F...X.<.jM.........Tuj.$.4..2..HPM$...Na...^.1....e9....*Z.8=...}.Y..?
<<< skipped >>>
GET /es/js/generated/7b1b9-727eb.js HTTP/1.1
Accept: */*
Referer: hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v2es.sftcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 17 Dec 2015 14:56:18 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Length: 37900
Accept-Ranges: bytes
Date: Fri, 18 Dec 2015 06:49:07 GMT
Connection: keep-alive
Age: 0
X-Served-By: generated
X-Cache: HIT
X-Cache-Hits: 406817
Expires: Sun, 17 Jan 2016 06:49:07 GMT
.............V.H.(.~....)........NUn..Lg.@'d..A.=dK...d$.0......[?.....~..=...;.....d.j......:c.c..W.l..~..E.Z..._.^.....W.l.D.(....2........_D.(..e'.e.......Yg.O.|.%fi"..0_.E.9..... ..l4..Q^..._..t...A.....l.g..c..&....v.....,...E...B......U.L:.y...%I8*.....(..,.?c..f.b...}.D.8. .$.`....O.....1ph...8.........|..@a.v.E."...P%aj.YT..Q......(.......y...n........."M....F......6..`.0...hs....$..:.9.Q.0.(...t..../..@..FG...A...*...4...O...6..Yd7..$.e....>.....i.......i........3.'|../..A.~.....3wf...r....9..;..{......;g.' .bQ..m....."l.[..|.....q..Y.~f.x..m...7.Oggk...vzY..HZ.-k`m}Z...v....|.E.......^...~..i.P...dRLWa...q.7.~?."h.~...v..dC....j%..../.r....hn..z...g.qX....S....`?. V.\ ."..........V.<.. r..........)>.B...>Q7...QF...{s.Z....$.......g.. .Q.... ...7.........<.{w.}m.v..^..W........EzZd.....c.R..P .upp.<..{Q..*.gO...2......../.,.M...i.rT...n.G..........2........o..,..Y.l...~h.;......q..........D./...n...5;-.....gB.c7/.9=h.w..7....u...;t.$/.......@..;..W.(..<..Q.HT.ZQ.>.......].J.P!."J.lR.g..'....?...6'..!@..../....DD.._9.n.~6Y..s.... ..,.....x.FdtN.../F..........:r.mIR..@.m..m.R.a..C?.>.V%.^..?K.t~..j ...^...2.....I...gon...~.u.Y.4P.{. AP...,..<A...vz....v...... .....~.F92..U.G.`nf)D......B.T....Ap.4b.....^#...`U\5....}. H.&@.Y$...,....v.%.....5H`....z....3......a.....p....h...H............C..F.......`..@n.E>mk .=t.X..F....z...-........w....D..r...S.....~!f.l.%n.B.......l..*d....Fl.,!...{...A9...h....u...|..q...g..\ h.V..Y.R..I.......-G9,.6.G'...#..u..0;.0;...<.;........g
<<< skipped >>>
Map
The Virus connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_468:
`.rsrc
`.rsrc
j;j.htzR
j;j.htzR
j;j.hD}R
j;j.hD}R
G><.tn>
G><.tn>
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH
88888888888888888
88888888888888888
%u$Vj%
%u$Vj%
t.Gj:W
t.Gj:W
.tMHtJH
.tMHtJH
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
j;j.hh
j;j.hh
hTCP
hTCP
%s:%d
%s:%d
WARNING: failed to save cookies in %s
WARNING: failed to save cookies in %s
About to connect() to %s%s port %d (#%d)
About to connect() to %s%s port %d (#%d)
Connected to %s (%s) port %d (#%d)
Connected to %s (%s) port %d (#%d)
malformed
malformed
:]://%[^
:]://%[^
[^:]:%[^
[^:]:%[^
Protocol %s not supported or disabled in libcurl
Protocol %s not supported or disabled in libcurl
http_proxy
http_proxy
%5[^:@]:%5[^@]
%5[^:@]:%5[^@]
%5[^:]:%5[^
%5[^:]:%5[^
:%5[^@]
:%5[^@]
Port number too large: %lu
Port number too large: %lu
%s://%s%s%s:%d%s%s
%s://%s%s%s:%d%s%s
ftps
ftps
[%*39[0123456789abcdefABCDEF:.%]%c
[%*39[0123456789abcdefABCDEF:.%]%c
Couldn't find host %s in the _netrc file; using defaults
Couldn't find host %s in the _netrc file; using defaults
PTF@example.com
PTF@example.com
Couldn't resolve host '%s'
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
Couldn't resolve proxy '%s'
User-Agent: %s
User-Agent: %s
Connection #%d seems to be dead!
Connection #%d seems to be dead!
Connection (#%d) was killed to make room (holds %d)
Connection (#%d) was killed to make room (holds %d)
Re-using existing connection! (#%ld) with host %s
Re-using existing connection! (#%ld) with host %s
%s://%s
%s://%s
Connection #%ld to host %s left intact
Connection #%ld to host %s left intact
operation aborted by callback
operation aborted by callback
HTTP/
HTTP/
ioctl callback returned error %d
ioctl callback returned error %d
the ioctl callback returned %d
the ioctl callback returned %d
seek callback returned error %d
seek callback returned error %d
The requested URL returned error: %d
The requested URL returned error: %d
HTTP/1.0 connection set to keep alive!
HTTP/1.0 connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.1 proxy connection set close!
HTTP/1.0 proxy connection set to keep alive!
HTTP/1.0 proxy connection set to keep alive!
HTTP 1.0, assume close after body
HTTP 1.0, assume close after body
HTTP =
HTTP =
HTTP/%d.%d =
HTTP/%d.%d =
No URL set!
No URL set!
[^?&/:]://%c
[^?&/:]://%c
Violate RFC 2616/10.3.2 and switch from POST to GET
Violate RFC 2616/10.3.2 and switch from POST to GET
Disables POST, goes with %s
Disables POST, goes with %s
Issue another request to this URL: '%s'
Issue another request to this URL: '%s'
Maximum (%d) redirects followed
Maximum (%d) redirects followed
Received problem %d in the chunky parser
Received problem %d in the chunky parser
HTTP server doesn't seem to support byte ranges. Cannot resume.
HTTP server doesn't seem to support byte ranges. Cannot resume.
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Leftovers after chunking. Rewinding %d bytes
Leftovers after chunking. Rewinding %d bytes
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
unspecified error %d
unspecified error %d
%s cookie %s="%s" for domain %s, path %s, expire %d
%s cookie %s="%s" for domain %s, path %s, expire %d
#HttpOnly_
#HttpOnly_
httponly
httponly
I99[^;
I99[^;
skipped cookie with bad tailmatch domain: %s
skipped cookie with bad tailmatch domain: %s
skipped cookie with illegal dotcount domain: %s
skipped cookie with illegal dotcount domain: %s
23[^;=]=I99[^;
23[^;=]=I99[^;
%s%s%s
%s%s%s
# Fatal libcurl error
# Fatal libcurl error
# Netscape HTTP Cookie File
# Netscape HTTP Cookie File
# hXXp://curl.haxx.se/rfc/cookie_spec.html
# hXXp://curl.haxx.se/rfc/cookie_spec.html
# This file was generated by libcurl! Edit at your own risk.
# This file was generated by libcurl! Edit at your own risk.
[%s %s %s]
[%s %s %s]
Send failure: %s
Send failure: %s
Failed writing body (%d != %d)
Failed writing body (%d != %d)
bind failure: %s
bind failure: %s
Local port: %d
Local port: %d
Bind to local port %d failed, trying next
Bind to local port %d failed, trying next
couldn't find my own IP address (%s)
couldn't find my own IP address (%s)
Bind local address to %s
Bind local address to %s
Couldn't bind to '%s'
Couldn't bind to '%s'
TCP_NODELAY set
TCP_NODELAY set
Could not set TCP_NODELAY: %s
Could not set TCP_NODELAY: %s
Failed to connect to %s: %s
Failed to connect to %s: %s
Trying %s...
Trying %s...
Resolving host timed out: %s
Resolving host timed out: %s
Could not resolve host: %s; %s
Could not resolve host: %s; %s
Could not resolve proxy: %s; %s
Could not resolve proxy: %s; %s
Could not resolve host: %s
Could not resolve host: %s
gethostbyname(2) failed for %s:%d; %s
gethostbyname(2) failed for %s:%d; %s
init_resolve_thread() failed for %s; %s
init_resolve_thread() failed for %s; %s
TFTP
TFTP
set timeouts for state %d; Total %d, retry %d maxtry %d
set timeouts for state %d; Total %d, retry %d maxtry %d
tftp_rx: giving up waiting for block %d
tftp_rx: giving up waiting for block %d
Received unexpected DATA packet block %d
Received unexpected DATA packet block %d
Timeout waiting for block %d ACK. Retries = %d
Timeout waiting for block %d ACK. Retries = %d
tftp_rx: internal error
tftp_rx: internal error
tftp_tx: giving up waiting for block %d ack
tftp_tx: giving up waiting for block %d ack
Received ACK for block %d, expecting %d
Received ACK for block %d, expecting %d
tftp_tx: internal error
tftp_tx: internal error
bind() failed; %s
bind() failed; %s
tftp_send_first: internal error
tftp_send_first: internal error
%s%c%s%c
%s%c%s%c
TFTP finished
TFTP finished
Can't get the size of %s
Can't get the size of %s
Can't open %s for writing
Can't open %s for writing
Last-Modified: %s, d %s M d:d:d GMT
Last-Modified: %s, d %s M d:d:d GMT
Couldn't open file %s
Couldn't open file %s
There are more than %d entries
There are more than %d entries
LDAP remote: %s
LDAP remote: %s
LDAP local: ldap_simple_bind_s %s
LDAP local: ldap_simple_bind_s %s
LDAP local: Cannot connect to %s:%d
LDAP local: Cannot connect to %s:%d
LDAP local: trying to establish %s connection
LDAP local: trying to establish %s connection
LDAP local: %s
LDAP local: %s
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
CLIENT libcurl 7.19.0
CLIENT libcurl 7.19.0
MATCH %s %s %s
MATCH %s %s %s
DEFINE %s %s
DEFINE %s %s
insufficient winsock version to support telnet
insufficient winsock version to support telnet
WSAStartup failed (%d)
WSAStartup failed (%d)
%s %d %d
%s %d %d
%s %s %d
%s %s %d
%s %s %s
%s %s %s
%s IAC %d
%s IAC %d
%s IAC %s
%s IAC %s
Sending data failed (%d)
Sending data failed (%d)
%d (unknown)
%d (unknown)
%s (unsupported)
%s (unsupported)
%s IAC SB
%s IAC SB
Syntax error in telnet option: %s
Syntax error in telnet option: %s
Unknown telnet option %s
Unknown telnet option %s
7[^= ]%*[ =]%5s
7[^= ]%*[ =]%5s
USER,%s
USER,%s
%c%c%c%c%s%c%c
%c%c%c%c%s%c%c
%c%s%c%s
%c%s%c%s
7[^,],7s
7[^,],7s
%c%c%c%c
%c%c%c%c
FreeLibrary(wsock2) failed (%d)
FreeLibrary(wsock2) failed (%d)
WSACloseEvent failed (%d)
WSACloseEvent failed (%d)
WSACreateEvent failed (%d)
WSACreateEvent failed (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to load WS2_32.DLL (%d)
failed to load WS2_32.DLL (%d)
WS2_32.DLL
WS2_32.DLL
Excessive FTP response line length received, %zd bytes. Stripping
Excessive FTP response line length received, %zd bytes. Stripping
FTP response reading failed
FTP response reading failed
FTP response aborted due to select/poll error: %d
FTP response aborted due to select/poll error: %d
FTP response timeout
FTP response timeout
Failed FTP upload:
Failed FTP upload:
RETR response: d
RETR response: d
Connecting to %s (%s) port %d
Connecting to %s (%s) port %d
Uploading to a URL without a file name!
Uploading to a URL without a file name!
FTPS not supported!
FTPS not supported!
USER %s
USER %s
socket(2) failed (%s)
socket(2) failed (%s)
PORT %d,%d,%d,%d,%d,%d
PORT %d,%d,%d,%d,%d,%d
Telling server to connect to %d.%d.%d.%d:%d
Telling server to connect to %d.%d.%d.%d:%d
Failed to resolve host name %s
Failed to resolve host name %s
getsockname() failed: %s
getsockname() failed: %s
Connect data stream passively
Connect data stream passively
REST %d
REST %d
SIZE %s
SIZE %s
STOR %s
STOR %s
APPE %s
APPE %s
Bad PASV/EPSV response: d
Bad PASV/EPSV response: d
Can't resolve new host %s:%d
Can't resolve new host %s:%d
%d.%d.%d.%d
%d.%d.%d.%d
Skips %d.%d.%d.%d for data connection, uses %s instead
Skips %d.%d.%d.%d for data connection, uses %s instead
%d,%d,%d,%d,%d,%d
%d,%d,%d,%d,%d,%d
%c%c%c%u%c
%c%c%c%u%c
Failed to do PORT
Failed to do PORT
Got a d response code instead of the assumed 200
Got a d response code instead of the assumed 200
RETR %s
RETR %s
ftp server doesn't support SIZE
ftp server doesn't support SIZE
PBSZ %d
PBSZ %d
Access denied: d
Access denied: d
ACCT %s
ACCT %s
PASS %s
PASS %s
ACCT rejected by server: d
ACCT rejected by server: d
QUOT string not accepted: %s
QUOT string not accepted: %s
TYPE %c
TYPE %c
MDTM %s
MDTM %s
ddd d:d:d GMT
ddd d:d:d GMT
dddddd
dddddd
unsupported MDTM reply format
unsupported MDTM reply format
server did not report OK, got %d
server did not report OK, got %d
Remembering we are in dir "%s"
Remembering we are in dir "%s"
CWD %s
CWD %s
Failed to MKD dir: d
Failed to MKD dir: d
MKD %s
MKD %s
QUOT command failed with d
QUOT command failed with d
Entry path is '%s'
Entry path is '%s'
PROT %c
PROT %c
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
AUTH %s
AUTH %s
Got a d ftp-server response when 220 was expected
Got a d ftp-server response when 220 was expected
%sAuthorization: Basic %s
%sAuthorization: Basic %s
%s:%s
%s:%s
Server auth using %s with user '%s'
Server auth using %s with user '%s'
Proxy auth using %s with user '%s'
Proxy auth using %s with user '%s'
Failed sending HTTP POST request
Failed sending HTTP POST request
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Internal HTTP POST error!
Internal HTTP POST error!
Failed sending HTTP request
Failed sending HTTP request
If-Unmodified-Since: %s
If-Unmodified-Since: %s
Last-Modified: %s
Last-Modified: %s
If-Modified-Since: %s
If-Modified-Since: %s
%s, d %s M d:d:d GMT
%s, d %s M d:d:d GMT
%s%s=%s
%s%s=%s
%s %s%s HTTP/%s
%s %s%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
%s%s%s%s%s%s%s%s%s%s%s
Content-Range: bytes %s/%lld
Content-Range: bytes %s/%lld
Content-Range: bytes %s%lld/%lld
Content-Range: bytes %s%lld/%lld
Range: bytes=%s
Range: bytes=%s
;type=%c
;type=%c
ftps://
ftps://
PTF://
PTF://
Host: %s%s%s:%d
Host: %s%s%s:%d
Host: %s%s%s
Host: %s%s%s
Accept-Encoding: %s
Accept-Encoding: %s
Referer: %s
Referer: %s
Received HTTP code %d from proxy after CONNECT
Received HTTP code %d from proxy after CONNECT
%d bytes of chunk left
%d bytes of chunk left
HTTP/1.%d %d
HTTP/1.%d %d
Read %d bytes of chunk, continue
Read %d bytes of chunk, continue
CONNECT %s:%d HTTP/1.0
CONNECT %s:%d HTTP/1.0
%s%s%s%s
%s%s%s%s
Host: %s
Host: %s
Establish HTTP proxy tunnel to %s:%d
Establish HTTP proxy tunnel to %s:%d
Internal error removing splay node = %d
Internal error removing splay node = %d
Internal error clearing splay node = %d
Internal error clearing splay node = %d
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Failed to resolve "%s" for SOCKS4 connect.
Failed to resolve "%s" for SOCKS4 connect.
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
SOCKS5 GSSAPI per-message authentication is not supported.
SOCKS5 GSSAPI per-message authentication is not supported.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Failed to resolve "%s" for SOCKS5 connect.
Failed to resolve "%s" for SOCKS5 connect.
User was rejected by the SOCKS5 server (%d %d).
User was rejected by the SOCKS5 server (%d %d).
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
--:--:--
--:--:--
= %s = %s = %s %s %s %s %s %s %s
= %s = %s = %s %s %s %s %s %s %s
password
password
login
login
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
%s, algorithm="%s"
%s, algorithm="%s"
%s, opaque="%s"
%s, opaque="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%s:%s:x:%s:%s:%s
%s:%s:x:%s:%s:%s
%s:%s:%s
%s:%s:%s
%5[^=]=23[^
%5[^=]=23[^
%5[^=]="23[^"]"
%5[^=]="23[^"]"
d:d:d
d:d:d
Error in the SSH layer
Error in the SSH layer
Caller must register CURLOPT_CONV_ callback options
Caller must register CURLOPT_CONV_ callback options
TFTP: No such user
TFTP: No such user
TFTP: Unknown transfer ID
TFTP: Unknown transfer ID
TFTP: Illegal operation
TFTP: Illegal operation
TFTP: Access Violation
TFTP: Access Violation
TFTP: File Not Found
TFTP: File Not Found
Login denied
Login denied
Issuer check against peer certificate failed
Issuer check against peer certificate failed
Invalid LDAP URL
Invalid LDAP URL
Unrecognized HTTP Content-Encoding
Unrecognized HTTP Content-Encoding
Problem with the SSL CA cert (path? access rights?)
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with known CA certificates
Peer certificate cannot be authenticated with known CA certificates
Problem with the local SSL certificate
Problem with the local SSL certificate
SSL peer certificate or SSH md5 fingerprint was not OK
SSL peer certificate or SSH md5 fingerprint was not OK
A libcurl function was given a bad argument
A libcurl function was given a bad argument
Operation was aborted by an application callback
Operation was aborted by an application callback
FTP: command REST failed
FTP: command REST failed
FTP: command PORT failed
FTP: command PORT failed
HTTP response code said error
HTTP response code said error
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't set file type
FTP: couldn't set file type
FTP: can't figure out the host in the PASV response
FTP: can't figure out the host in the PASV response
FTP: unknown 227 response format
FTP: unknown 227 response format
FTP: unknown PASV reply
FTP: unknown PASV reply
FTP: unknown PASS reply
FTP: unknown PASS reply
FTP: weird server reply
FTP: weird server reply
URL using bad/illegal format or missing URL
URL using bad/illegal format or missing URL
Unsupported protocol
Unsupported protocol
Winsock version not supported
Winsock version not supported
Protocol family not supported
Protocol family not supported
Address family not supported
Address family not supported
Operation not supported
Operation not supported
Socket is unsupported
Socket is unsupported
Protocol is unsupported
Protocol is unsupported
Protocol option is unsupported
Protocol option is unsupported
Unknown error %d (%#x)
Unknown error %d (%#x)
%c%c==
%c%c==
%c%c%c=
%c%c%c=
.html
.html
.jpeg
.jpeg
--%s--
--%s--
Content-Type: %s
Content-Type: %s
; filename="%s"
; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Type: multipart/mixed, boundary=%s
Content-Type: multipart/mixed, boundary=%s
%s; boundary=%s
%s; boundary=%s
Kernel32.DLL
Kernel32.DLL
()$^.* ?[]|\-{},:=!
()$^.* ?[]|\-{},:=!
:/-_.!~*'()
:/-_.!~*'()
xxxxx
xxxxx
Writing %u bytes to 0xX...
Writing %u bytes to 0xX...
Error: can't add tag '%s', tag section is full.
Error: can't add tag '%s', tag section is full.
Target location is offset %u (X)
Target location is offset %u (X)
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
GetProcessWindowStation
GetProcessWindowStation
portuguese-brazilian
portuguese-brazilian
operator
operator
NOINT_MSG
NOINT_MSG
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
-1.1.3
-1.1.3
1.1.3
1.1.3
Downloading... [%lld/%lld] (%f%%) @%d KBps
Downloading... [%lld/%lld] (%f%%) @%d KBps
http/
http/
waOnMsgFromAnotherInstance
waOnMsgFromAnotherInstance
WAIT_WEB
WAIT_WEB
urls_to_restore_on_startup
urls_to_restore_on_startup
keyword
keyword
search_url
search_url
zcÃ
zcÃ
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AVWindowsAPI@@
.?AVWindowsAPI@@
.?AUDWebBrowserEvents2@@
.?AUDWebBrowserEvents2@@
.?AUIHttpNegotiate@@
.?AUIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AVCurlMultiDownloadJob@@
.?AVCurlMultiDownloadJob@@
c:\%original file name%.exe
c:\%original file name%.exe
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
PeekNamedPipe
PeekNamedPipe
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegCloseKey
RegCloseKey
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
UrlMkSetSessionOption
UrlMkSetSessionOption
URLDownloadToFileW
URLDownloadToFileW
GetAsyncKeyState
GetAsyncKeyState
GetKeyState
GetKeyState
EnumDesktopWindows
EnumDesktopWindows
EnumChildWindows
EnumChildWindows
InternetOpenUrlA
InternetOpenUrlA
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
Universal Downloader Download Helper.
Universal Downloader Download Helper.
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
gdiplus.dll
gdiplus.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
RPCRT4.dll
RPCRT4.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
urlmon.dll
urlmon.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WLDAP32.dll
WLDAP32.dll
WSOCK32.dll
WSOCK32.dll
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi
n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi
n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi
ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]STAR#
ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]STAR#
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
%original file name%.exe
%original file name%.exe
.fE/Y
.fE/Y
hXXp://ikhouvanirakezen.nl/logo.gif
hXXp://ikhouvanirakezen.nl/logo.gif
hXXp://VVV.novedades2013.unlugar.com/logo.gif
hXXp://VVV.novedades2013.unlugar.com/logo.gif
hXXp://VVV.pushkarinternational.com/logo.gif
hXXp://VVV.pushkarinternational.com/logo.gif
hXXp://ngaoschool.ac.th/logo.gif
hXXp://ngaoschool.ac.th/logo.gif
hXXp://pedaisuchoa.com/logos.gif
hXXp://pedaisuchoa.com/logos.gif
hXXp://mendezmorales.com/logo.gif
hXXp://mendezmorales.com/logo.gif
hXXp://landmarkgroup.com.au/images/logos/logos.gif
hXXp://landmarkgroup.com.au/images/logos/logos.gif
hXXp://dsign-studio.com/images/button.gif
hXXp://dsign-studio.com/images/button.gif
hXXp://barrymward.com/images/logo.gif
hXXp://barrymward.com/images/logo.gif
hXXp://VVV.greenbeach.de/logo.gif
hXXp://VVV.greenbeach.de/logo.gif
://veddagroup.twomini.com/img/logo_bgg.gif
://veddagroup.twomini.com/img/logo_bgg.gif
ages/logo.gif
ages/logo.gif
cc/images/logo.gif
cc/images/logo.gif
et/imagens/logof.gif
et/imagens/logof.gif
hXXp://68.168.222.206/logos.gif
hXXp://68.168.222.206/logos.gif
.info/J
.info/J
home.gifI888
home.gifI888
KERNEL32.dll
KERNEL32.dll
h.rata
h.rata
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
MSVCRT.dll
MSVCRT.dll
WS2_32.dll
WS2_32.dll
SHFileOperationA
SHFileOperationA
xxxxxxxxxxx
xxxxxxxxxxx
%s\*.*
%s\*.*
.temp
.temp
Pd-d-d
Pd-d-d
%cd:00
%cd:00
d-d-d d:d:d
d-d-d d:d:d
Pd:d:d
Pd:d:d
[%s] %s
[%s] %s
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
log.txt
log.txt
yKERNEL32.DLL
yKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
mscoree.dll
mscoree.dll
WUSER32.DLL
WUSER32.DLL
ParentKeyName
ParentKeyName
*.exe
*.exe
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Microsoft Visual Studio Web Authoring
Microsoft Visual Studio Web Authoring
Microsoft SQL Server
Microsoft SQL Server
Microsoft Windows SDK for
Microsoft Windows SDK for
Microsoft .NET Framework
Microsoft .NET Framework
Microsoft .NET ([\s\S])* Framework
Microsoft .NET ([\s\S])* Framework
Received message %s
Received message %s
1.40.2
1.40.2
Correct password required
Correct password required
Hash check OK [%s]
Hash check OK [%s]
Downloading [%s]...
Downloading [%s]...
result: [%s]
result: [%s]
expected: [%s]
expected: [%s]
**Downloading to temporary file [%s]
**Downloading to temporary file [%s]
CurlDownloadJob::Start
CurlDownloadJob::Start
Encoding URL
Encoding URL
- URL:
- URL:
URL won't be encoded
URL won't be encoded
%d - [%d][%lld/%lld][%lld]
%d - [%d][%lld/%lld][%lld]
[%d] Starting thread...
[%d] Starting thread...
[%d] Thread Creation OK!
[%d] Thread Creation OK!
[%d] Error creating thread! trying again...
[%d] Error creating thread! trying again...
[%d] Thread started...
[%d] Thread started...
explorer.exe "
explorer.exe "
[%d %d]
[%d %d]
%s\%s
%s\%s
Proxy by URL are not supported.
Proxy by URL are not supported.
Automatic proxy discovery are not supported.
Automatic proxy discovery are not supported.
http=
http=
https=
https=
-1.40.2
-1.40.2
%d%d%d%d%d%d%d%d
%d%d%d%d%d%d%d%d
.swf?
.swf?
.jpg?
.jpg?
.gif?
.gif?
.png?
.png?
Value: %d
Value: %d
%s(%s)
%s(%s)
%s --> (%s)
%s --> (%s)
errorUrl
errorUrl
Web View
Web View
Web Host
Web Host
%d|%d|%d
%d|%d|%d
firefox
firefox
chrome
chrome
.desklink\PersistentHandler
.desklink\PersistentHandler
.DEFAULT\EUDC\949
.DEFAULT\EUDC\949
.DEFAULT\Policies\Microsoft\Office\12.0
.DEFAULT\Policies\Microsoft\Office\12.0
.DVR-MS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
.DVR-MS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
BCD00000000\Objects\{1afa9c49-16ab-4a5c-901b-212802da9460}\Description
BCD00000000\Objects\{1afa9c49-16ab-4a5c-901b-212802da9460}\Description
CAPICOM.Settings.1\CLSID
CAPICOM.Settings.1\CLSID
Keyboard Layout\Substitutes
Keyboard Layout\Substitutes
COMPONENTS\DerivedData\Components\amd64_.netframework_31bf3856ad364e35_6.1.7600.16385_none_34b78d5c105d8b49
COMPONENTS\DerivedData\Components\amd64_.netframework_31bf3856ad364e35_6.1.7600.16385_none_34b78d5c105d8b49
.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
DSRefObject8.Simple\CLSID
DSRefObject8.Simple\CLSID
00000000
00000000
COMPONENTS\Installers\RegKeySDTable
COMPONENTS\Installers\RegKeySDTable
.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
System\CurrentControlSet\Control\VIDEO\{2D5BA881-99A8-4757-A06E-CB5493B97A39}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{2D5BA881-99A8-4757-A06E-CB5493B97A39}\0000\Mon12345678
FBiblio.Factoid
FBiblio.Factoid
Printers\Connections\,,172.20.60.249,P12_NRG_B&W_4ALL
Printers\Connections\,,172.20.60.249,P12_NRG_B&W_4ALL
.DEFAULT\Software\Microsoft\ADs\Providers\LDAP\CN=Aggregate,CN=Schema,CN=Configuration,DC=domino,DC=softonic,DC=com
.DEFAULT\Software\Microsoft\ADs\Providers\LDAP\CN=Aggregate,CN=Schema,CN=Configuration,DC=domino,DC=softonic,DC=com
DefaultSettings.FixedOutput
DefaultSettings.FixedOutput
System\CurrentControlSet\Control\VIDEO\{4245DE9B-6B89-4598-9438-882C0E0E93FB}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{4245DE9B-6B89-4598-9438-882C0E0E93FB}\0000\Mon12345678
ftp\shell\open\ddeexec
ftp\shell\open\ddeexec
font.size
font.size
.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks
.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks
DefaultSettings.YPanning
DefaultSettings.YPanning
URL Protocol
URL Protocol
System\CurrentControlSet\Control\VIDEO\{795890FD-41FC-48B6-B402-BA484E0B82EC}\0000
System\CurrentControlSet\Control\VIDEO\{795890FD-41FC-48B6-B402-BA484E0B82EC}\0000
asl.log
asl.log
Attach.ToDesktop
Attach.ToDesktop
.DEFAULT\Software\Microsoft\Office\11.0\Common\PersonaMenu
.DEFAULT\Software\Microsoft\Office\11.0\Common\PersonaMenu
System\CurrentControlSet\Control\VIDEO\{B55EA300-EECB-4201-9CC2-E88DC80A835F}\0000
System\CurrentControlSet\Control\VIDEO\{B55EA300-EECB-4201-9CC2-E88DC80A835F}\0000
QuickTime.kar
QuickTime.kar
.KAR\OpenWithProgIds
.KAR\OpenWithProgIds
SOFTWARE\Google\Chrome\Extensions\bboaafafoijjpegaghkniifdlapncebg
SOFTWARE\Google\Chrome\Extensions\bboaafafoijjpegaghkniifdlapncebg
.DEFAULT\Software\Microsoft\SBE\SAL
.DEFAULT\Software\Microsoft\SBE\SAL
DefaultSettings.BitsPerPel
DefaultSettings.BitsPerPel
System\CurrentControlSet\Control\VIDEO\{CF088C39-60FF-4B54-9C0F-80345F8AE401}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{CF088C39-60FF-4B54-9C0F-80345F8AE401}\0000\Mon12345678
DefaultSettings.XResolution
DefaultSettings.XResolution
\172.20.60.249\P13_Tech_B&W
\172.20.60.249\P13_Tech_B&W
System\CurrentControlSet\Control\VIDEO\{F92BFB9B-59E9-4B65-8AA3-D004C26BA193}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{F92BFB9B-59E9-4B65-8AA3-D004C26BA193}\0000\Mon12345678
{B8BF51A6-0AB3-48F2-A38E-4E36CADC41AD}
{B8BF51A6-0AB3-48F2-A38E-4E36CADC41AD}
SYSTEM\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\Control
SYSTEM\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\Control
rsa2@22:base.mmartos.coretonic
rsa2@22:base.mmartos.coretonic
Software\SimonTatham\PuTTY\SshHostKeys
Software\SimonTatham\PuTTY\SshHostKeys
LGot Elevation URL. [%s]
LGot Elevation URL. [%s]
New URL was not valid.
New URL was not valid.
D0.0.0.0
D0.0.0.0
C[%d] [%lld|%lld]
C[%d] [%lld|%lld]
Software\Classes\http\shell\open\command\
Software\Classes\http\shell\open\command\
http\shell\open\command\
http\shell\open\command\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
chrome.exe
chrome.exe
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
opera.exe
opera.exe
opera
opera
safari.ex
safari.ex
browser.startup.homepage
browser.startup.homepage
prefs.js
prefs.js
user.js
user.js
user_pref("browser.startup.homepage", "
user_pref("browser.startup.homepage", "
"browser.startup.homepage", "
"browser.startup.homepage", "
\"browser.startup.homepage\". \"(.)*\"
\"browser.startup.homepage\". \"(.)*\"
browser.search.order.1
browser.search.order.1
browser.search.order.2
browser.search.order.2
browser.search.order.3
browser.search.order.3
\"(.)*.;
\"(.)*.;
browser.search.selectedEngine
browser.search.selectedEngine
browser.search.defaultenginename
browser.search.defaultenginename
browser.search.useDBForOrder
browser.search.useDBForOrder
user_pref("browser.search.useDBForOrder", "false");
user_pref("browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder.*
browser.search.useDBForOrder.*
%s*.*
%s*.*
Software\Mozilla\Mozilla Firefox\
Software\Mozilla\Mozilla Firefox\
\Google\Chrome
\Google\Chrome
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Mozilla\Mozilla Firefox\
PathToExe
PathToExe
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
\Mozilla\Firefox\
\search-metadata.json
\search-metadata.json
json_value.cpp
json_value.cpp
ljson_reader.cpp
ljson_reader.cpp
Applications\iexplore.exe\shell\open\command
Applications\iexplore.exe\shell\open\command
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall
Assertion failed: %s, file %s, line %d
Assertion failed: %s, file %s, line %d
1, 40, 1, 0
1, 40, 1, 0
SoftonicDownloader.exe
SoftonicDownloader.exe
%original file name%.exe_468_rwx_00401000_0015F000:
j;j.htzR
j;j.htzR
j;j.hD}R
j;j.hD}R
G><.tn>
G><.tn>
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH
88888888888888888
88888888888888888
%u$Vj%
%u$Vj%
t.Gj:W
t.Gj:W
.tMHtJH
.tMHtJH
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
j;j.hh
j;j.hh
hTCP
hTCP
%s:%d
%s:%d
WARNING: failed to save cookies in %s
WARNING: failed to save cookies in %s
About to connect() to %s%s port %d (#%d)
About to connect() to %s%s port %d (#%d)
Connected to %s (%s) port %d (#%d)
Connected to %s (%s) port %d (#%d)
malformed
malformed
:]://%[^
:]://%[^
[^:]:%[^
[^:]:%[^
Protocol %s not supported or disabled in libcurl
Protocol %s not supported or disabled in libcurl
http_proxy
http_proxy
%5[^:@]:%5[^@]
%5[^:@]:%5[^@]
%5[^:]:%5[^
%5[^:]:%5[^
:%5[^@]
:%5[^@]
Port number too large: %lu
Port number too large: %lu
%s://%s%s%s:%d%s%s
%s://%s%s%s:%d%s%s
ftps
ftps
[%*39[0123456789abcdefABCDEF:.%]%c
[%*39[0123456789abcdefABCDEF:.%]%c
Couldn't find host %s in the _netrc file; using defaults
Couldn't find host %s in the _netrc file; using defaults
PTF@example.com
PTF@example.com
Couldn't resolve host '%s'
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
Couldn't resolve proxy '%s'
User-Agent: %s
User-Agent: %s
Connection #%d seems to be dead!
Connection #%d seems to be dead!
Connection (#%d) was killed to make room (holds %d)
Connection (#%d) was killed to make room (holds %d)
Re-using existing connection! (#%ld) with host %s
Re-using existing connection! (#%ld) with host %s
%s://%s
%s://%s
Connection #%ld to host %s left intact
Connection #%ld to host %s left intact
operation aborted by callback
operation aborted by callback
HTTP/
HTTP/
ioctl callback returned error %d
ioctl callback returned error %d
the ioctl callback returned %d
the ioctl callback returned %d
seek callback returned error %d
seek callback returned error %d
The requested URL returned error: %d
The requested URL returned error: %d
HTTP/1.0 connection set to keep alive!
HTTP/1.0 connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.1 proxy connection set close!
HTTP/1.0 proxy connection set to keep alive!
HTTP/1.0 proxy connection set to keep alive!
HTTP 1.0, assume close after body
HTTP 1.0, assume close after body
HTTP =
HTTP =
HTTP/%d.%d =
HTTP/%d.%d =
No URL set!
No URL set!
[^?&/:]://%c
[^?&/:]://%c
Violate RFC 2616/10.3.2 and switch from POST to GET
Violate RFC 2616/10.3.2 and switch from POST to GET
Disables POST, goes with %s
Disables POST, goes with %s
Issue another request to this URL: '%s'
Issue another request to this URL: '%s'
Maximum (%d) redirects followed
Maximum (%d) redirects followed
Received problem %d in the chunky parser
Received problem %d in the chunky parser
HTTP server doesn't seem to support byte ranges. Cannot resume.
HTTP server doesn't seem to support byte ranges. Cannot resume.
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Leftovers after chunking. Rewinding %d bytes
Leftovers after chunking. Rewinding %d bytes
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
unspecified error %d
unspecified error %d
%s cookie %s="%s" for domain %s, path %s, expire %d
%s cookie %s="%s" for domain %s, path %s, expire %d
#HttpOnly_
#HttpOnly_
httponly
httponly
I99[^;
I99[^;
skipped cookie with bad tailmatch domain: %s
skipped cookie with bad tailmatch domain: %s
skipped cookie with illegal dotcount domain: %s
skipped cookie with illegal dotcount domain: %s
23[^;=]=I99[^;
23[^;=]=I99[^;
%s%s%s
%s%s%s
# Fatal libcurl error
# Fatal libcurl error
# Netscape HTTP Cookie File
# Netscape HTTP Cookie File
# hXXp://curl.haxx.se/rfc/cookie_spec.html
# hXXp://curl.haxx.se/rfc/cookie_spec.html
# This file was generated by libcurl! Edit at your own risk.
# This file was generated by libcurl! Edit at your own risk.
[%s %s %s]
[%s %s %s]
Send failure: %s
Send failure: %s
Failed writing body (%d != %d)
Failed writing body (%d != %d)
bind failure: %s
bind failure: %s
Local port: %d
Local port: %d
Bind to local port %d failed, trying next
Bind to local port %d failed, trying next
couldn't find my own IP address (%s)
couldn't find my own IP address (%s)
Bind local address to %s
Bind local address to %s
Couldn't bind to '%s'
Couldn't bind to '%s'
TCP_NODELAY set
TCP_NODELAY set
Could not set TCP_NODELAY: %s
Could not set TCP_NODELAY: %s
Failed to connect to %s: %s
Failed to connect to %s: %s
Trying %s...
Trying %s...
Resolving host timed out: %s
Resolving host timed out: %s
Could not resolve host: %s; %s
Could not resolve host: %s; %s
Could not resolve proxy: %s; %s
Could not resolve proxy: %s; %s
Could not resolve host: %s
Could not resolve host: %s
gethostbyname(2) failed for %s:%d; %s
gethostbyname(2) failed for %s:%d; %s
init_resolve_thread() failed for %s; %s
init_resolve_thread() failed for %s; %s
TFTP
TFTP
set timeouts for state %d; Total %d, retry %d maxtry %d
set timeouts for state %d; Total %d, retry %d maxtry %d
tftp_rx: giving up waiting for block %d
tftp_rx: giving up waiting for block %d
Received unexpected DATA packet block %d
Received unexpected DATA packet block %d
Timeout waiting for block %d ACK. Retries = %d
Timeout waiting for block %d ACK. Retries = %d
tftp_rx: internal error
tftp_rx: internal error
tftp_tx: giving up waiting for block %d ack
tftp_tx: giving up waiting for block %d ack
Received ACK for block %d, expecting %d
Received ACK for block %d, expecting %d
tftp_tx: internal error
tftp_tx: internal error
bind() failed; %s
bind() failed; %s
tftp_send_first: internal error
tftp_send_first: internal error
%s%c%s%c
%s%c%s%c
TFTP finished
TFTP finished
Can't get the size of %s
Can't get the size of %s
Can't open %s for writing
Can't open %s for writing
Last-Modified: %s, d %s M d:d:d GMT
Last-Modified: %s, d %s M d:d:d GMT
Couldn't open file %s
Couldn't open file %s
There are more than %d entries
There are more than %d entries
LDAP remote: %s
LDAP remote: %s
LDAP local: ldap_simple_bind_s %s
LDAP local: ldap_simple_bind_s %s
LDAP local: Cannot connect to %s:%d
LDAP local: Cannot connect to %s:%d
LDAP local: trying to establish %s connection
LDAP local: trying to establish %s connection
LDAP local: %s
LDAP local: %s
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
CLIENT libcurl 7.19.0
CLIENT libcurl 7.19.0
MATCH %s %s %s
MATCH %s %s %s
DEFINE %s %s
DEFINE %s %s
insufficient winsock version to support telnet
insufficient winsock version to support telnet
WSAStartup failed (%d)
WSAStartup failed (%d)
%s %d %d
%s %d %d
%s %s %d
%s %s %d
%s %s %s
%s %s %s
%s IAC %d
%s IAC %d
%s IAC %s
%s IAC %s
Sending data failed (%d)
Sending data failed (%d)
%d (unknown)
%d (unknown)
%s (unsupported)
%s (unsupported)
%s IAC SB
%s IAC SB
Syntax error in telnet option: %s
Syntax error in telnet option: %s
Unknown telnet option %s
Unknown telnet option %s
7[^= ]%*[ =]%5s
7[^= ]%*[ =]%5s
USER,%s
USER,%s
%c%c%c%c%s%c%c
%c%c%c%c%s%c%c
%c%s%c%s
%c%s%c%s
7[^,],7s
7[^,],7s
%c%c%c%c
%c%c%c%c
FreeLibrary(wsock2) failed (%d)
FreeLibrary(wsock2) failed (%d)
WSACloseEvent failed (%d)
WSACloseEvent failed (%d)
WSACreateEvent failed (%d)
WSACreateEvent failed (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to load WS2_32.DLL (%d)
failed to load WS2_32.DLL (%d)
WS2_32.DLL
WS2_32.DLL
Excessive FTP response line length received, %zd bytes. Stripping
Excessive FTP response line length received, %zd bytes. Stripping
FTP response reading failed
FTP response reading failed
FTP response aborted due to select/poll error: %d
FTP response aborted due to select/poll error: %d
FTP response timeout
FTP response timeout
Failed FTP upload:
Failed FTP upload:
RETR response: d
RETR response: d
Connecting to %s (%s) port %d
Connecting to %s (%s) port %d
Uploading to a URL without a file name!
Uploading to a URL without a file name!
FTPS not supported!
FTPS not supported!
USER %s
USER %s
socket(2) failed (%s)
socket(2) failed (%s)
PORT %d,%d,%d,%d,%d,%d
PORT %d,%d,%d,%d,%d,%d
Telling server to connect to %d.%d.%d.%d:%d
Telling server to connect to %d.%d.%d.%d:%d
Failed to resolve host name %s
Failed to resolve host name %s
getsockname() failed: %s
getsockname() failed: %s
Connect data stream passively
Connect data stream passively
REST %d
REST %d
SIZE %s
SIZE %s
STOR %s
STOR %s
APPE %s
APPE %s
Bad PASV/EPSV response: d
Bad PASV/EPSV response: d
Can't resolve new host %s:%d
Can't resolve new host %s:%d
%d.%d.%d.%d
%d.%d.%d.%d
Skips %d.%d.%d.%d for data connection, uses %s instead
Skips %d.%d.%d.%d for data connection, uses %s instead
%d,%d,%d,%d,%d,%d
%d,%d,%d,%d,%d,%d
%c%c%c%u%c
%c%c%c%u%c
Failed to do PORT
Failed to do PORT
Got a d response code instead of the assumed 200
Got a d response code instead of the assumed 200
RETR %s
RETR %s
ftp server doesn't support SIZE
ftp server doesn't support SIZE
PBSZ %d
PBSZ %d
Access denied: d
Access denied: d
ACCT %s
ACCT %s
PASS %s
PASS %s
ACCT rejected by server: d
ACCT rejected by server: d
QUOT string not accepted: %s
QUOT string not accepted: %s
TYPE %c
TYPE %c
MDTM %s
MDTM %s
ddd d:d:d GMT
ddd d:d:d GMT
dddddd
dddddd
unsupported MDTM reply format
unsupported MDTM reply format
server did not report OK, got %d
server did not report OK, got %d
Remembering we are in dir "%s"
Remembering we are in dir "%s"
CWD %s
CWD %s
Failed to MKD dir: d
Failed to MKD dir: d
MKD %s
MKD %s
QUOT command failed with d
QUOT command failed with d
Entry path is '%s'
Entry path is '%s'
PROT %c
PROT %c
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
AUTH %s
AUTH %s
Got a d ftp-server response when 220 was expected
Got a d ftp-server response when 220 was expected
%sAuthorization: Basic %s
%sAuthorization: Basic %s
%s:%s
%s:%s
Server auth using %s with user '%s'
Server auth using %s with user '%s'
Proxy auth using %s with user '%s'
Proxy auth using %s with user '%s'
Failed sending HTTP POST request
Failed sending HTTP POST request
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Internal HTTP POST error!
Internal HTTP POST error!
Failed sending HTTP request
Failed sending HTTP request
If-Unmodified-Since: %s
If-Unmodified-Since: %s
Last-Modified: %s
Last-Modified: %s
If-Modified-Since: %s
If-Modified-Since: %s
%s, d %s M d:d:d GMT
%s, d %s M d:d:d GMT
%s%s=%s
%s%s=%s
%s %s%s HTTP/%s
%s %s%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
%s%s%s%s%s%s%s%s%s%s%s
Content-Range: bytes %s/%lld
Content-Range: bytes %s/%lld
Content-Range: bytes %s%lld/%lld
Content-Range: bytes %s%lld/%lld
Range: bytes=%s
Range: bytes=%s
;type=%c
;type=%c
ftps://
ftps://
PTF://
PTF://
Host: %s%s%s:%d
Host: %s%s%s:%d
Host: %s%s%s
Host: %s%s%s
Accept-Encoding: %s
Accept-Encoding: %s
Referer: %s
Referer: %s
Received HTTP code %d from proxy after CONNECT
Received HTTP code %d from proxy after CONNECT
%d bytes of chunk left
%d bytes of chunk left
HTTP/1.%d %d
HTTP/1.%d %d
Read %d bytes of chunk, continue
Read %d bytes of chunk, continue
CONNECT %s:%d HTTP/1.0
CONNECT %s:%d HTTP/1.0
%s%s%s%s
%s%s%s%s
Host: %s
Host: %s
Establish HTTP proxy tunnel to %s:%d
Establish HTTP proxy tunnel to %s:%d
Internal error removing splay node = %d
Internal error removing splay node = %d
Internal error clearing splay node = %d
Internal error clearing splay node = %d
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Failed to resolve "%s" for SOCKS4 connect.
Failed to resolve "%s" for SOCKS4 connect.
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
SOCKS5 GSSAPI per-message authentication is not supported.
SOCKS5 GSSAPI per-message authentication is not supported.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Failed to resolve "%s" for SOCKS5 connect.
Failed to resolve "%s" for SOCKS5 connect.
User was rejected by the SOCKS5 server (%d %d).
User was rejected by the SOCKS5 server (%d %d).
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
--:--:--
--:--:--
= %s = %s = %s %s %s %s %s %s %s
= %s = %s = %s %s %s %s %s %s %s
password
password
login
login
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
%s, algorithm="%s"
%s, algorithm="%s"
%s, opaque="%s"
%s, opaque="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%s:%s:x:%s:%s:%s
%s:%s:x:%s:%s:%s
%s:%s:%s
%s:%s:%s
%5[^=]=23[^
%5[^=]=23[^
%5[^=]="23[^"]"
%5[^=]="23[^"]"
d:d:d
d:d:d
Error in the SSH layer
Error in the SSH layer
Caller must register CURLOPT_CONV_ callback options
Caller must register CURLOPT_CONV_ callback options
TFTP: No such user
TFTP: No such user
TFTP: Unknown transfer ID
TFTP: Unknown transfer ID
TFTP: Illegal operation
TFTP: Illegal operation
TFTP: Access Violation
TFTP: Access Violation
TFTP: File Not Found
TFTP: File Not Found
Login denied
Login denied
Issuer check against peer certificate failed
Issuer check against peer certificate failed
Invalid LDAP URL
Invalid LDAP URL
Unrecognized HTTP Content-Encoding
Unrecognized HTTP Content-Encoding
Problem with the SSL CA cert (path? access rights?)
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with known CA certificates
Peer certificate cannot be authenticated with known CA certificates
Problem with the local SSL certificate
Problem with the local SSL certificate
SSL peer certificate or SSH md5 fingerprint was not OK
SSL peer certificate or SSH md5 fingerprint was not OK
A libcurl function was given a bad argument
A libcurl function was given a bad argument
Operation was aborted by an application callback
Operation was aborted by an application callback
FTP: command REST failed
FTP: command REST failed
FTP: command PORT failed
FTP: command PORT failed
HTTP response code said error
HTTP response code said error
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't set file type
FTP: couldn't set file type
FTP: can't figure out the host in the PASV response
FTP: can't figure out the host in the PASV response
FTP: unknown 227 response format
FTP: unknown 227 response format
FTP: unknown PASV reply
FTP: unknown PASV reply
FTP: unknown PASS reply
FTP: unknown PASS reply
FTP: weird server reply
FTP: weird server reply
URL using bad/illegal format or missing URL
URL using bad/illegal format or missing URL
Unsupported protocol
Unsupported protocol
Winsock version not supported
Winsock version not supported
Protocol family not supported
Protocol family not supported
Address family not supported
Address family not supported
Operation not supported
Operation not supported
Socket is unsupported
Socket is unsupported
Protocol is unsupported
Protocol is unsupported
Protocol option is unsupported
Protocol option is unsupported
Unknown error %d (%#x)
Unknown error %d (%#x)
%c%c==
%c%c==
%c%c%c=
%c%c%c=
.html
.html
.jpeg
.jpeg
--%s--
--%s--
Content-Type: %s
Content-Type: %s
; filename="%s"
; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Type: multipart/mixed, boundary=%s
Content-Type: multipart/mixed, boundary=%s
%s; boundary=%s
%s; boundary=%s
Kernel32.DLL
Kernel32.DLL
()$^.* ?[]|\-{},:=!
()$^.* ?[]|\-{},:=!
:/-_.!~*'()
:/-_.!~*'()
xxxxx
xxxxx
Writing %u bytes to 0xX...
Writing %u bytes to 0xX...
Error: can't add tag '%s', tag section is full.
Error: can't add tag '%s', tag section is full.
Target location is offset %u (X)
Target location is offset %u (X)
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
GetProcessWindowStation
GetProcessWindowStation
portuguese-brazilian
portuguese-brazilian
operator
operator
NOINT_MSG
NOINT_MSG
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
-1.1.3
-1.1.3
1.1.3
1.1.3
Downloading... [%lld/%lld] (%f%%) @%d KBps
Downloading... [%lld/%lld] (%f%%) @%d KBps
http/
http/
waOnMsgFromAnotherInstance
waOnMsgFromAnotherInstance
WAIT_WEB
WAIT_WEB
urls_to_restore_on_startup
urls_to_restore_on_startup
keyword
keyword
search_url
search_url
zcÃ
zcÃ
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AVWindowsAPI@@
.?AVWindowsAPI@@
.?AUDWebBrowserEvents2@@
.?AUDWebBrowserEvents2@@
.?AUIHttpNegotiate@@
.?AUIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AVCurlMultiDownloadJob@@
.?AVCurlMultiDownloadJob@@
c:\%original file name%.exe
c:\%original file name%.exe
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
PeekNamedPipe
PeekNamedPipe
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegCloseKey
RegCloseKey
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
UrlMkSetSessionOption
UrlMkSetSessionOption
URLDownloadToFileW
URLDownloadToFileW
GetAsyncKeyState
GetAsyncKeyState
GetKeyState
GetKeyState
EnumDesktopWindows
EnumDesktopWindows
EnumChildWindows
EnumChildWindows
InternetOpenUrlA
InternetOpenUrlA
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
xxxxxxxxxxx
xxxxxxxxxxx
%s\*.*
%s\*.*
.temp
.temp
Pd-d-d
Pd-d-d
%cd:00
%cd:00
d-d-d d:d:d
d-d-d d:d:d
Pd:d:d
Pd:d:d
[%s] %s
[%s] %s
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
log.txt
log.txt
yKERNEL32.DLL
yKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
mscoree.dll
mscoree.dll
WUSER32.DLL
WUSER32.DLL
ParentKeyName
ParentKeyName
*.exe
*.exe
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Microsoft Visual Studio Web Authoring
Microsoft Visual Studio Web Authoring
Microsoft SQL Server
Microsoft SQL Server
Microsoft Windows SDK for
Microsoft Windows SDK for
Microsoft .NET Framework
Microsoft .NET Framework
Microsoft .NET ([\s\S])* Framework
Microsoft .NET ([\s\S])* Framework
Received message %s
Received message %s
1.40.2
1.40.2
Correct password required
Correct password required
Hash check OK [%s]
Hash check OK [%s]
Downloading [%s]...
Downloading [%s]...
result: [%s]
result: [%s]
expected: [%s]
expected: [%s]
**Downloading to temporary file [%s]
**Downloading to temporary file [%s]
CurlDownloadJob::Start
CurlDownloadJob::Start
Encoding URL
Encoding URL
- URL:
- URL:
URL won't be encoded
URL won't be encoded
%d - [%d][%lld/%lld][%lld]
%d - [%d][%lld/%lld][%lld]
[%d] Starting thread...
[%d] Starting thread...
[%d] Thread Creation OK!
[%d] Thread Creation OK!
[%d] Error creating thread! trying again...
[%d] Error creating thread! trying again...
[%d] Thread started...
[%d] Thread started...
explorer.exe "
explorer.exe "
[%d %d]
[%d %d]
%s\%s
%s\%s
Proxy by URL are not supported.
Proxy by URL are not supported.
Automatic proxy discovery are not supported.
Automatic proxy discovery are not supported.
http=
http=
https=
https=
-1.40.2
-1.40.2
%d%d%d%d%d%d%d%d
%d%d%d%d%d%d%d%d
.swf?
.swf?
.jpg?
.jpg?
.gif?
.gif?
.png?
.png?
Value: %d
Value: %d
%s(%s)
%s(%s)
%s --> (%s)
%s --> (%s)
errorUrl
errorUrl
Web View
Web View
Web Host
Web Host
%d|%d|%d
%d|%d|%d
firefox
firefox
chrome
chrome
.desklink\PersistentHandler
.desklink\PersistentHandler
.DEFAULT\EUDC\949
.DEFAULT\EUDC\949
.DEFAULT\Policies\Microsoft\Office\12.0
.DEFAULT\Policies\Microsoft\Office\12.0
.DVR-MS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
.DVR-MS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
BCD00000000\Objects\{1afa9c49-16ab-4a5c-901b-212802da9460}\Description
BCD00000000\Objects\{1afa9c49-16ab-4a5c-901b-212802da9460}\Description
CAPICOM.Settings.1\CLSID
CAPICOM.Settings.1\CLSID
Keyboard Layout\Substitutes
Keyboard Layout\Substitutes
COMPONENTS\DerivedData\Components\amd64_.netframework_31bf3856ad364e35_6.1.7600.16385_none_34b78d5c105d8b49
COMPONENTS\DerivedData\Components\amd64_.netframework_31bf3856ad364e35_6.1.7600.16385_none_34b78d5c105d8b49
.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
DSRefObject8.Simple\CLSID
DSRefObject8.Simple\CLSID
00000000
00000000
COMPONENTS\Installers\RegKeySDTable
COMPONENTS\Installers\RegKeySDTable
.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
System\CurrentControlSet\Control\VIDEO\{2D5BA881-99A8-4757-A06E-CB5493B97A39}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{2D5BA881-99A8-4757-A06E-CB5493B97A39}\0000\Mon12345678
FBiblio.Factoid
FBiblio.Factoid
Printers\Connections\,,172.20.60.249,P12_NRG_B&W_4ALL
Printers\Connections\,,172.20.60.249,P12_NRG_B&W_4ALL
.DEFAULT\Software\Microsoft\ADs\Providers\LDAP\CN=Aggregate,CN=Schema,CN=Configuration,DC=domino,DC=softonic,DC=com
.DEFAULT\Software\Microsoft\ADs\Providers\LDAP\CN=Aggregate,CN=Schema,CN=Configuration,DC=domino,DC=softonic,DC=com
DefaultSettings.FixedOutput
DefaultSettings.FixedOutput
System\CurrentControlSet\Control\VIDEO\{4245DE9B-6B89-4598-9438-882C0E0E93FB}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{4245DE9B-6B89-4598-9438-882C0E0E93FB}\0000\Mon12345678
ftp\shell\open\ddeexec
ftp\shell\open\ddeexec
font.size
font.size
.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks
.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks
DefaultSettings.YPanning
DefaultSettings.YPanning
URL Protocol
URL Protocol
System\CurrentControlSet\Control\VIDEO\{795890FD-41FC-48B6-B402-BA484E0B82EC}\0000
System\CurrentControlSet\Control\VIDEO\{795890FD-41FC-48B6-B402-BA484E0B82EC}\0000
asl.log
asl.log
Attach.ToDesktop
Attach.ToDesktop
.DEFAULT\Software\Microsoft\Office\11.0\Common\PersonaMenu
.DEFAULT\Software\Microsoft\Office\11.0\Common\PersonaMenu
System\CurrentControlSet\Control\VIDEO\{B55EA300-EECB-4201-9CC2-E88DC80A835F}\0000
System\CurrentControlSet\Control\VIDEO\{B55EA300-EECB-4201-9CC2-E88DC80A835F}\0000
QuickTime.kar
QuickTime.kar
.KAR\OpenWithProgIds
.KAR\OpenWithProgIds
SOFTWARE\Google\Chrome\Extensions\bboaafafoijjpegaghkniifdlapncebg
SOFTWARE\Google\Chrome\Extensions\bboaafafoijjpegaghkniifdlapncebg
.DEFAULT\Software\Microsoft\SBE\SAL
.DEFAULT\Software\Microsoft\SBE\SAL
DefaultSettings.BitsPerPel
DefaultSettings.BitsPerPel
System\CurrentControlSet\Control\VIDEO\{CF088C39-60FF-4B54-9C0F-80345F8AE401}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{CF088C39-60FF-4B54-9C0F-80345F8AE401}\0000\Mon12345678
DefaultSettings.XResolution
DefaultSettings.XResolution
\172.20.60.249\P13_Tech_B&W
\172.20.60.249\P13_Tech_B&W
System\CurrentControlSet\Control\VIDEO\{F92BFB9B-59E9-4B65-8AA3-D004C26BA193}\0000\Mon12345678
System\CurrentControlSet\Control\VIDEO\{F92BFB9B-59E9-4B65-8AA3-D004C26BA193}\0000\Mon12345678
{B8BF51A6-0AB3-48F2-A38E-4E36CADC41AD}
{B8BF51A6-0AB3-48F2-A38E-4E36CADC41AD}
SYSTEM\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\Control
SYSTEM\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\Control
rsa2@22:base.mmartos.coretonic
rsa2@22:base.mmartos.coretonic
Software\SimonTatham\PuTTY\SshHostKeys
Software\SimonTatham\PuTTY\SshHostKeys
LGot Elevation URL. [%s]
LGot Elevation URL. [%s]
New URL was not valid.
New URL was not valid.
D0.0.0.0
D0.0.0.0
C[%d] [%lld|%lld]
C[%d] [%lld|%lld]
Software\Classes\http\shell\open\command\
Software\Classes\http\shell\open\command\
http\shell\open\command\
http\shell\open\command\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
chrome.exe
chrome.exe
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
opera.exe
opera.exe
opera
opera
safari.ex
safari.ex
browser.startup.homepage
browser.startup.homepage
prefs.js
prefs.js
user.js
user.js
user_pref("browser.startup.homepage", "
user_pref("browser.startup.homepage", "
"browser.startup.homepage", "
"browser.startup.homepage", "
\"browser.startup.homepage\". \"(.)*\"
\"browser.startup.homepage\". \"(.)*\"
browser.search.order.1
browser.search.order.1
browser.search.order.2
browser.search.order.2
browser.search.order.3
browser.search.order.3
\"(.)*.;
\"(.)*.;
browser.search.selectedEngine
browser.search.selectedEngine
browser.search.defaultenginename
browser.search.defaultenginename
browser.search.useDBForOrder
browser.search.useDBForOrder
user_pref("browser.search.useDBForOrder", "false");
user_pref("browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder.*
browser.search.useDBForOrder.*
%s*.*
%s*.*
Software\Mozilla\Mozilla Firefox\
Software\Mozilla\Mozilla Firefox\
\Google\Chrome
\Google\Chrome
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Mozilla\Mozilla Firefox\
PathToExe
PathToExe
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
\Mozilla\Firefox\
\search-metadata.json
\search-metadata.json
json_value.cpp
json_value.cpp
ljson_reader.cpp
ljson_reader.cpp
Applications\iexplore.exe\shell\open\command
Applications\iexplore.exe\shell\open\command
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall
Assertion failed: %s, file %s, line %d
Assertion failed: %s, file %s, line %d
%original file name%.exe_468_rwx_00564000_00001000:
Universal Downloader Download Helper.
Universal Downloader Download Helper.
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
gdiplus.dll
gdiplus.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
RPCRT4.dll
RPCRT4.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
urlmon.dll
urlmon.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WLDAP32.dll
WLDAP32.dll
WSOCK32.dll
WSOCK32.dll
URLDownloadToFileW
URLDownloadToFileW
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://latency-optimizer.sd.softonic.com/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No se ha detectado conexi
n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi
n a Internet[ENDVALUE][KEY]NOINT_MSG[VALUE]Se necesita conexi
ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]STAR
ntalo de nuevo. [ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]STAR
1, 40, 1, 0
1, 40, 1, 0
SoftonicDownloader.exe
SoftonicDownloader.exe
%original file name%.exe_468_rwx_00566000_00010000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
%original file name%.exe
%original file name%.exe
.rsrc
.rsrc
c:\%original file name%.exe
c:\%original file name%.exe
.fE/Y
.fE/Y
hXXp://ikhouvanirakezen.nl/logo.gif
hXXp://ikhouvanirakezen.nl/logo.gif
hXXp://VVV.novedades2013.unlugar.com/logo.gif
hXXp://VVV.novedades2013.unlugar.com/logo.gif
hXXp://VVV.pushkarinternational.com/logo.gif
hXXp://VVV.pushkarinternational.com/logo.gif
hXXp://ngaoschool.ac.th/logo.gif
hXXp://ngaoschool.ac.th/logo.gif
hXXp://pedaisuchoa.com/logos.gif
hXXp://pedaisuchoa.com/logos.gif
hXXp://mendezmorales.com/logo.gif
hXXp://mendezmorales.com/logo.gif
hXXp://landmarkgroup.com.au/images/logos/logos.gif
hXXp://landmarkgroup.com.au/images/logos/logos.gif
hXXp://dsign-studio.com/images/button.gif
hXXp://dsign-studio.com/images/button.gif
hXXp://barrymward.com/images/logo.gif
hXXp://barrymward.com/images/logo.gif
hXXp://VVV.greenbeach.de/logo.gif
hXXp://VVV.greenbeach.de/logo.gif
://veddagroup.twomini.com/img/logo_bgg.gif
://veddagroup.twomini.com/img/logo_bgg.gif
ages/logo.gif
ages/logo.gif
cc/images/logo.gif
cc/images/logo.gif
et/imagens/logof.gif
et/imagens/logof.gif
hXXp://68.168.222.206/logos.gif
hXXp://68.168.222.206/logos.gif
.info/J
.info/J
home.gifI888
home.gifI888
.text
.text
KERNEL32.dll
KERNEL32.dll
h.rata
h.rata
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
ADVAPI32.dll
ADVAPI32.dll
MSVCRT.dll
MSVCRT.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
WS2_32.dll
WS2_32.dll
RegCloseKey
RegCloseKey
SHFileOperationA
SHFileOperationA
%original file name%.exe_468_rwx_00B80000_0108E000:
c:\windows
c:\windows
hXXp://ikhouvanirakezen.nl/logo.gif
hXXp://ikhouvanirakezen.nl/logo.gif
hXXp://VVV.novedades2013.unlugar.com/logo.gif
hXXp://VVV.novedades2013.unlugar.com/logo.gif
hXXp://VVV.pushkarinternational.com/logo.gif
hXXp://VVV.pushkarinternational.com/logo.gif
hXXp://ngaoschool.ac.th/logo.gif
hXXp://ngaoschool.ac.th/logo.gif
hXXp://pedaisuchoa.com/logos.gif
hXXp://pedaisuchoa.com/logos.gif
hXXp://mendezmorales.com/logo.gif
hXXp://mendezmorales.com/logo.gif
hXXp://landmarkgroup.com.au/images/logos/logos.gif
hXXp://landmarkgroup.com.au/images/logos/logos.gif
hXXp://dsign-studio.com/images/button.gif
hXXp://dsign-studio.com/images/button.gif
hXXp://barrymward.com/images/logo.gif
hXXp://barrymward.com/images/logo.gif
hXXp://VVV.greenbeach.de/logo.gif
hXXp://VVV.greenbeach.de/logo.gif
%System%\drivers\jpmrm.sys
%System%\drivers\jpmrm.sys
.fE/Y
.fE/Y
5193906827
5193906827
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
hXXp://89.119.67.154/testo5/
hXXp://89.119.67.154/testo5/
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet987.info/home.gif
hXXp://kukutrustnet987.info/home.gif
.text
.text
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
h.rdata
h.rdata
H.data
H.data
.reloc
.reloc
ntoskrnl.exe
ntoskrnl.exe
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://kukutrustnet777888.info/
hXXp://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
GdiPlus.dll
hXXp://
hXXp://
ipfltdrv.sys
ipfltdrv.sys
VVV.microsoft.com
VVV.microsoft.com
?%x=%d
?%x=%d
&%x=%d
&%x=%d
SYSTEM.INI
SYSTEM.INI
USER32.DLL
USER32.DLL
.%c%s
.%c%s
\\.\amsint32
\\.\amsint32
NTDLL.DLL
NTDLL.DLL
autorun.inf
autorun.inf
ADVAPI32.DLL
ADVAPI32.DLL
win%s.exe
win%s.exe
%s.exe
%s.exe
WININET.DLL
WININET.DLL
InternetOpenUrlA
InternetOpenUrlA
avast! Web Scanner
avast! Web Scanner
Avira AntiVir Premium WebGuard
Avira AntiVir Premium WebGuard
cmdGuard
cmdGuard
cmdAgent
cmdAgent
Eset HTTP Server
Eset HTTP Server
ProtoPort Firewall service
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
SpIDer FS Monitor for Windows NT
Symantec Password Validation
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootDesktopFirewallDataService
WebrootFirewall
WebrootFirewall
%d%d.tmp
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Explorer.exe
Explorer.exe
A2CMD.
A2CMD.
ASHWEBSV.
ASHWEBSV.
AVGCC.AVGCHSVX.
AVGCC.AVGCHSVX.
DRWEB
DRWEB
DWEBLLIO
DWEBLLIO
DWEBIO
DWEBIO
FSGUIEXE.
FSGUIEXE.
MCVSSHLD.
MCVSSHLD.
NPFMSG.
NPFMSG.
SYMSPORT.
SYMSPORT.
WEBSCANX.
WEBSCANX.
.adata
.adata
M_%d_
M_%d_
%c%d_%d
%c%d_%d
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryA
GetWindowsDirectoryA
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SHFileOperationA
SHFileOperationA
&3&3&3&389
&3&3&3&389
.rdata
.rdata
.data
.data
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
ADVAPI32.dll
ADVAPI32.dll
MSVCRT.dll
MSVCRT.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll
%original file name%.exe_468_rwx_02510000_00002000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
Explorer.EXE_1140_rwx_00FF0000_00002000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
%original file name%.exe_468_rwx_02620000_00001000:
|%original file name%.exeM_468_
|%original file name%.exeM_468_
Explorer.EXE_1140_rwx_01E00000_00001000:
|explorer.exeM_1140_
|explorer.exeM_1140_