Trojan.Win32.IEDummy_ad2c6c09ae – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:464

Mutexes

The following mutexes were created/opened:

__DDrawExclMode__DDrawWindowListMutex__DDrawCheckExclMode__DDrawDriverObjectListMutexCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003_!MSFTHISTORY!_DBWinMutexRasPbFilec:!documents and settings!adm!local settings!temporary internet files!content.ie5!c:!documents and settings!adm!cookies!WininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!WininetProxyRegistryMutexWininetConnectionMutexShimCacheMutexZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexoleacc-msaa-loaded

File activity

The process %original file name%.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (5083 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loading-install[1].gif (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-bar[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loadingBar[1].gif (12238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fee4f78b3a596f8b96508dd983dd008b09d524c1e0cea09cb192e6f4260b9ce04a67fcb5da87779c91728dd9d476cb0bd123b95fc368348f[1].txt (0 bytes)

Registry activity

The process %original file name%.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1435157821"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 C5 34 5E 88 C6 72 10 2E FD 0A B7 67 34 2D 58"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
67986ec074b86590e110a76480f7da99	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (5083 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loading-install[1].gif (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-bar[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loadingBar[1].gif (12238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1187840	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1191936	655360	651776	5.47601	2fbbb0c73dd5e58834af61f226dfd2ba
.rsrc	1847296	36864	36864	3.88597	3cdb2723fc610cf9e91904c1892f517c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://api.4magno.com/	54.186.54.150
hxxp://api.4magno.com/d5/msjava.dll	54.186.54.150
hxxp://api.4magno.com/8c8fe64176c097c7ef6654f6bb91bd2a602a294f9a8edd2f9d54c066eba7486d705d172a6cbb63e6bece3d4064a134ba60deee00e47d9caebe75e6fca2d4d7bcd9ad7fa53c73ff0242726ad7f3bb524611dbc319e9d47525d6230ce5e72733955c7b20868351e23a	54.186.54.150
hxxp://api.4magno.com/fee4f78b3a596f8b96508dd983dd008b09d524c1e0cea09cb192e6f4260b9ce04a67fcb5da87779c91728dd9d476cb0bd123b95fc368348f	54.186.54.150
hxxp://api.4magno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css	54.186.54.150
hxxp://api.4magno.com/__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en	54.186.54.150
hxxp://api.4magno.com/maxpower-static/apps/34/68794/css/style.css	54.186.54.150
hxxp://api.4magno.com/__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater	54.186.54.150
hxxp://api.4magno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png	54.186.54.150
hxxp://api.4magno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif	54.186.54.150
hxxp://www.4magno.com/BesH3gE9/pop-up/	54.213.71.128
hxxp://api.4magno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png	54.186.54.150
hxxp://api.4magno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif	54.186.54.150
hxxp://www.4magno.com/lpresources/js/linkv2.js	54.213.71.128
hxxp://www.4magno.com/lpresources/js/ainj.js	54.213.71.128
hxxp://www.4magno.com/lpresources/js/dlStoragev1.js	54.213.71.128
hxxp://www.4magno.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js	54.213.71.128
hxxp://n149adserv.com/js/show_ads.js	204.155.152.38
hxxp://n149adserv.com/ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1435379102497&requestUrl=http://www.4magno.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds=	204.155.152.38
hxxp://n149adserv.com/impression.gif?b=578&p=27&ch=&ap=&cps=&c=62&l=UA&h=f06adb393bb490dc4c52810f86c8f01c&t=1435379102887&s=fb90a4d1d6191bad073684ee1cf6f749	204.155.152.38
hxxp://network.adsmarket.com/click/jGJunWecqZmPY2mWYcp6w4iQa5tnnH6Wi2SYmGakfZSJkGqaYKOBl7dia5Vmon2X?dp=Mjd8NTc4fFVBfDF8MXx8\|34ee69d9819b5a94df7268d81470e3f3-17-62\|7601abf1-1c84-11e5-9d25-f8bc125381b8	193.169.104.1
hxxp://5efl2.x.incapdns.net/?page=ec&a_aid=51ccedn87de7&pubid=415891&prgid=152873&cpnid=1208733&clickid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.&ce_cid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.
hxxp://wsf13-1390884529.us-east-1.elb.amazonaws.com/?s1=&s2=&s3=
hxxp://qbmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.10.2/jquery.min.js
hxxp://qbmzz.exclusiverewards.7001.info/templates/_common/_templates/browser_survey_SMARTKEYS_MASTER_lightbox_UA/css/style.css
hxxp://qbmzz.exclusiverewards.7001.info/templates/_common/_templates/browser_survey_SMARTKEYS_MASTER_lightbox_UA/css/style-ie.css
hxxp://qbmzz.exclusiverewards.7001.info/templates/_common/_templates/browser_survey_SMARTKEYS_MASTER_lightbox_UA/js/script.js
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js	216.58.209.202
hxxp://www.webtrackerplus.com/?page=ec&a_aid=51ccedn87de7&pubid=415891&prgid=152873&cpnid=1208733&clickid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.&ce_cid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.	192.230.78.223
hxxp://3p6.popularfastchannel.com/?s1=&s2=&s3=	23.21.45.1
hxxp://static.4magno.com/d5/msjava.dll	52.26.100.223
staticrr.mixvideoplayer.com	85.12.5.27
ssl.google-analytics.com	216.58.209.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://qbmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Tue, 09 Jul 2013 11:31:25 GMT

Date: Wed, 24 Jun 2015 12:45:37 GMT

Expires: Thu, 23 Jun 2016 12:45:37 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 32822

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 229159

Alternate-Protocol: 80:quic,p=0

.............{...0.{....U.sD.N...3.u.4i.8....h?..J.A..@-....;.lX(......i-b..z.ls....._.......d4.....G.28z2......S..e..VQ...8.:[.......Q^\...2.......}T..b...m.Iv....HUn.d.M.....?..]....XT..uT.e......q.>.D..Q./...nV.r...J.227/....P..)vp.H,..^l.|!....yb%..e.A.......J\.E.....J.U|..Z....._W..@\..UT~...*.m\Tw.B.G.r#nes$E\...(.o.nG..*L*|#.`/n..|x.....|..|T...!.....z..up:...o.......x&O......../_..>./.u.......a..c.........Y0.{.x\....'..A..T..r_..7........./.O.'g5.~A.-Dx.?/....ky.E..a-.n.|.`..B..q.......: .E.................U.z..X.8.....*vq...2..]..'<%..Sr).C.N6....F.......x.........i...,*c...7.\p.G.h.zq...MRVq..u..y.....BH...|.M.*.........*.............4..6..w...X.&....}....>....A.......$.q.q.#..B.s.W.....^.Q.J...*..c(.U.J.J..S.Ty;..y....=o.p-`...X.*/.[...:s.[..n".i...q...*)..W....S..&..'...g..X<..1L.w.x..?........7g....AF@...........T....$....8S..du..x43.n.`..=..C.......w.s......(.RQ.......x.f......}..n.QQ._.....Rd..Q...70.Y6.o`.. ....#1...x?.......oGI.*....._.e.].....:p......}lv.,....3..QEU...z2uVd...../c.8...z..?Y."?>.q...;.7.=.%...T@.S.I..xY.DP7......q~........q..\...u......LW.....ac>.`V..........W.W[..K.h0.W..7...iQDw>..[\..z....cQ.T,tv....h..)5..............Vr....p|.........x./.....\.|....c%].l@9.......k.5.kQ5.^..j/b@.a/....;...|/h..F..%..M.H..y...%p.D.{..:c.._...H......ME..N..:TA.....H.........3..:.L...OK......gv&....Y6.5.g.E8_@....MO.s..-....Df...........lup..J.u......P..(...~..W.[Z.....0|.C1....X.....v...HDC....2rz.`..5pl)l..}.g{)..)bB."..8.,A)ao/e..l. {../.A;..u.q.A].%....,e.....NN.`.;K

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Sat, 27 Jun 2015 04:24:41 GMT

ETag: "5452135d-38"

Last-Modified: Thu, 30 Oct 2014 10:30:53 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive

<html><head><title>ok</title></head><body></body></html>HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/html..Date: Sat, 27 Jun 2015 04:24:41 GMT..ETag: "5452135d-38"..Last-Modified: Thu, 30 Oct 2014 10:30:53 GMT..Server: nginx..Content-Length: 56..Connection: keep-alive..<html><head><title>ok</title></head><body></body></html>....

GET /8c8fe64176c097c7ef6654f6bb91bd2a602a294f9a8edd2f9d54c066eba7486d705d172a6cbb63e6bece3d4064a134ba60deee00e47d9caebe75e6fca2d4d7bcd9ad7fa53c73ff0242726ad7f3bb524611dbc319e9d47525d6230ce5e72733955c7b20868351e23a HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Sat, 27 Jun 2015 04:24:47 GMT

Server: nginx

transfer-encoding: chunked

Connection: keep-alive

2253..8c72b626ce80ad74e7dc13dbab1182ce4c9bcb93867c1bd39d6fa903097decaec3a1bbb3dc7d861838b95662af353e9ec2a3a16d20e785a760878191014dc9139305feac09ce20222b3ba02039987d59cf8b748d1535ecdb89df82430b2f485dc60d733c950136f2ec25f2565327e757d698168c4df778db930e1dd5e0d466db064f998baedc19a4338f39172f2f751733f783c33f8e59688c612da24bcf8fd5e5ee9c2a66a2ebf690f32621076c89b4caad9efb67f2e218daf44e2868028296c6f12ab29e8e5b5bc52df1152d3441cc838ce421c551c17333669808e0f941f9abfd47dec7a676677d237cebc7ae9c25c22b9b568a564501793c34eee6500640df619edb2c99deefaeca4c167b7848327594c11a9766959e630f9667091b302a7d4b7618d192bb362e2663861afa0f37ad399d5cd864b76e3877581b94ceb06faadc8ebb734719532b841b43c069ff96e9c8d531991d288379dec4002fb07bcc11f8bade0ed91322860b4601c94593803a44b36fa82e7dcba07219e48984bb91dfcd6034ec8211214c42f23e9d43d6ffc600dad9592426a2c3af6a8e2e6ea430f3b87d1f33d9988e8b8e6dba1d949019ef97b02b9fed4efeaaabf8a959258426fc735dc0b588184ecc8a3784e344763dc8d30ed60421d7cf3fdaea3612ed3100be40655d859d6f8a563e31f28ddaae3207c965763b4c13d1db9927009cbfbac9c7f185c36f74c195f0354bc281e8061d191177bcb6dc0cc8eb307f99d92b5ee27c69e717843d3bdb73de37113e7e23b3f17e4578469e8af62961ece08515b33df83881865a7476e45f5dd70ec2a09c5f2df0b30c98c9e1b16eba1d4a94d2837d880333e573fcc1685548c857bc78cf77bb19cf9efc801598617f5656bbe6a431793e04b6a511772c1c32062a434b7f84bb3388a8cffb65ff9682221c69a38a78eac94196f2447f7e0220a7357fc205678e01ed874a3c34a532ed1593c378510fef54bf48bb7d52b27bb2e62c10f04a1e8f028ac0d89d6cb88f1b52c773d73022345c86e1fe775be1de69faef094e18943cd76be15105bbf6cd23ecba47

<<< skipped >>>

POST /fee4f78b3a596f8b96508dd983dd008b09d524c1e0cea09cb192e6f4260b9ce04a67fcb5da87779c91728dd9d476cb0bd123b95fc368348f HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 1 R:-842150450

Host: api.4magno.com

Content-Length: 3142

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6C29F5997166EF97A418F915F82A9AD7FC77F5FC74ED02F99799278738B97993DFA484DED0643C147AF1F76E6047AAC12B04F4D1B9014C49B2B9206253F7B816F613C3C2381141BF9CF3270815E833E217C84153888AF84AD3B25072B7234318ADB6B796AA64B779F2A2FFAABF95EFDC11241AEEFDE629155B76CCA2A4F117755C06DE1498E9C37CD98B521F0FD403F13CB01AF0E4FBF71138F6A88730187FF335D1D49628715144B0C70D3E9EFE7F238A0BD4DC3850AA17491D1411F679F649D153C8BB58D807D75C71D684597E3C53158883877E2B2DF5F9835210215BF8B4E424D54C9DC1B0382804C82DF6DE430D6286F4EC32EFA9C0879E0B5195F873EC93EFD9028384F794BA8001AAD0EFD2F57163951F48C0543140FA71C2CC25B1E684F083496E91153CD0189459D14D516740D975556EED463D549149C64F7817B04107DF3BD3AADB9D05FF4CA61C16FFA52B0B03FC804758BA2BBFE11F6894C15F67736AE213BCEFDF4413BB9970F70654B7C300116460FAB905A38A5DA3C219D77E5831422B475F8B98F771450C586E4A98C88422A4D2D55FEBEE8C1F50ED3ADDFD386B54BF360ED09327D06513E427FC52942CDABED860F111BDC58F37DAE1E5804B1D324B29777FFAC9632ED0D917F4E2946F6770B48CACED65284414A0C6474B822F9F408D2C90856DBF16EC64796FF36885F3B72C81CDD380DE08636AF2F3C2AED38D082A433DEC7F4410C47C75A54BFDCA73553D061A90ACDBBBB1CAF19F13F1039236A470429F74D36870776844693D9CC153EFC1050FE016EF2B070585A29C361BB

HTTP/1.1 200 OK

Content-Type: text/plain

Date: Sat, 27 Jun 2015 04:24:49 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive

MAXTHX.....

GET /__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 27 Jun 2015 04:24:49 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 2403

Connection: keep-alive

....<div class="container">.<div class="videupdater">. <div class="minimize">. <ul>. <li><span id="_Bminimize" onclick="minimizeWindow();" class="button-min">-</span></li>. <li><span id="_Bexit" onclick="onExit()" class="button-min">x</span></li>. </ul>.</div>..<div id="_frameContainer" class="content">.. ..</div>....<div class="buttons">.. . . <input id="_Bnext" class="_Bnext grey right" buttonText="Next" tabindex="0" type="submit" value="Next »" onclick='onAccept();'>. .. .. . <input id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type="submit" name="nombre" value="Skip All" onclick='onOmit();'>. . . <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" tabindex="1" type="submit" name="nombre" value="Decline" onclick='onDecline();'>. .. <div class="clear"></div>.</div>.. ..<div class="contact">. <div class="contact-in" style="height: 20px;">.. <ul>. <li><a target='_blank' class="first _TitPrivacy">Privacy Policy</a></li>. <li><a target='_blank' class="_TitSetup">Setup info</a></li>. <li><a target='_blank' class="_TitFree">Why is this free?</a></li>. <li><a target='_blank' class="_Ti

<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Sat, 27 Jun 2015 04:24:49 GMT

ETag: "54f6e242-4a5a"

Last-Modified: Wed, 04 Mar 2015 10:45:22 GMT

Server: nginx

Content-Length: 19034

Connection: keep-alive

/* Template Template Videoupdater */...article,aside,details,figcaption,figure,.footer,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}.body {..margin:0 auto;..background-color:#323333;..width: 555px;..height: 458px;..color:#b5b5b5;..font-family:Arial, Helvetica, sans-serif;..scrollbar-face-color: #666666;..scrollbar-highlight-color: #999999;..scrollbar-3dlight-color: #333333;..scrollbar-shadow-color: #333333;..scrollbar-darkshadow-color: #333333;..scrollbar-arrow-color: #CCCCCC;..scrollbar-track-color: #333333;.}...videupdater a, .videupdater span {..color:#b5b5b5;.}...clear {..clear:both;..height:0px;..overflow:inherit;..display: none;.}..li {..list-style: none;.}./*********************//*********************//*********************//*********************//********./* estilo para poner los botones del box.html todos en display none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:none;*/.}./**************************************************/..container {..float:left;..width:555px;..height: 458px;..background-color:#323333;..margin: 0 auto;.}../*****************Template Win_Link*****************/......minimize {..float: right;..width: 45px;..position: relative;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index: 9999;.}....minimize ul li {..display: inline;..float: left;.}...minimize li {....float: left;..} ....minimize .button-min {..color: #636363;..text-decoration: none;..border: none;..font-size: 17

<<< skipped >>>

GET /?s1=&s2=&s3= HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 3p6.popularfastchannel.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Date: Sat, 27 Jun 2015 04:24:55 GMT

Location: hXXp://QBmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68

Server: nginx/1.2.8

X-Powered-By: PHP/5.3.23

Content-Length: 0

Connection: keep-alive

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Date: Sat, 27 Jun 2015 04:24:55 GMT..Location: hXXp://QBmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68..Server: nginx/1.2.8..X-Powered-By: PHP/5.3.23..Content-Length: 0..Connection: keep-alive..

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4magno.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"7614-1432285206000"

Last-Modified: Fri, 22 May 2015 09:00:06 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Sat, 27 Jun 2015 04:24:53 GMT

a..............200...Ymo.8.. 6.....8=...U.4.^.H[\.......h..,jE.......I..,{.......G....g...;,....l..A4.i... b.u*..UF@c.u..}...=..R*.......=.X..p..ln.).....c..Q).i....w..|...',_.<l.6....).i._.EF.,....2......'>u.2....,&a.......s.G...6.!..D....O.2I.0e...6{.=s....s......G............!.`.......r..hl.{...o..=..u.r..y.w.....;\.y.......t.gT.._J._.X.|%..#./.d..s......)..T|'n..".~..b....j!....Us?.i,.`P...y:s......^..y..b.-...G4.._f.....^......y...M...........U....~.;..l..{.....X..9Ob.....A........B<p&..bq-".L.AtV;.....T..O;../...!..ah.....200..V9.*....U ...4|.;V...;O..N>.GOA.... #8.Ft...e~..sG.HH..V..~..!.....|LH@z.l.....Cwk/.w..fA Z.....l^...qg.>b....G...P..F.. G..j.0?..#.....$..G..P<.A......{..,....Y......K.*.H.N$..@...ICnO.r6J...(=91..C~....c.a.'...t..!.S.'...v..^..?.d.....1.....`...Ng..Dd^w>.....G.9..[..>/..|O.f.hd..L.V1[...1..E.T,...qS.......2G7i.GC.gBr....E......U..xZ1|t.g...V.....XH.R...R..."..D.>.0U...z..[GU1.(.y.L......|.)...@.U].-..c..`....C.|.G o..|..hb..2iL......T#p.bV.)b.z).....AZ.k.v..o.......n /"..|.".........3...]^...u.1....1..\.P..200..H.b-......z......r\p....L..H].Q._Y.W..v..DA.R..:..I=.C..Jg{W.....#.e.......O.#.....................\.0Q..7s......i..S@V..........C..X..,AK!...H#...."...$..:p...S.R.k..Y:..<...U....m6\..@.<.`...3.f......p.r.9....U.*]..f.b..k.i_..U..z..n1....&C|.6.X.1*X...k......P]...^k....U.=~..mrc......Jc.aASj,.|...B.f.l.........*.1..^[d....Fe.m7J.PW.v..C/d...E..l.....f5..v.D...B...'.&T....&E.D....h.O.......M.R.4..h......sb{.YQ..Nm=%..d.....zO.{....9.*s.H..d

<<< skipped >>>

GET /ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1435379102497&requestUrl=http://VVV.4magno.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4magno.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: epomUUID=7601abf1-1c84-11e5-9d25-f8bc125381b8; Domain=.n149adserv.com; Expires=Fri, 22-Jun-2035 04:24:54 GMT; Path=/

Content-Type: text/javascript;charset=UTF-8

Content-Length: 579

Date: Sat, 27 Jun 2015 04:24:54 GMT

document.write("<meta http-equiv=\"refresh\" content=\"0; url=http:\/\/network.adsmarket.com\/click\/jGJunWecqZmPY2mWYcp6w4iQa5tnnH6Wi2SYmGakfZSJkGqaYKOBl7dia5Vmon2X?dp=Mjd8NTc4fFVBfDF8MXx8|34ee69d9819b5a94df7268d81470e3f3-17-62|7601abf1-1c84-11e5-9d25-f8bc125381b8\" \/><script type=\"text\/javascript\">new Image().src = \"http:\/\/n149adserv.com\" \"\/im\" \"pressi\" \"on.gif?b=578\" \"&p=27&ch=&ap=&cps=&c\" \"=62&l=UA\" \"&h=f06adb393bb490dc4c52810f86c8f01c&t=\" new Date().getTime() \"&s=fb90a4d1d6191bad073684ee1cf6f749\";<\/script>");.CustomWLAdServer.addCampaignId(62);....

GET /maxpower-static/apps/34/68794/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Sat, 27 Jun 2015 04:24:50 GMT

ETag: "5506bcbe-72"

Last-Modified: Mon, 16 Mar 2015 11:21:34 GMT

Server: nginx

Content-Length: 114

Connection: keep-alive

/* mapp MixVideoPlayer */....welcome ul {...width:210px;..float: left; ..}...welcome ul li {..margin-top: 10px;.}HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/css..Date: Sat, 27 Jun 2015 04:24:50 GMT..ETag: "5506bcbe-72"..Last-Modified: Mon, 16 Mar 2015 11:21:34 GMT..Server: nginx..Content-Length: 114..Connection: keep-alive../* mapp MixVideoPlayer */....welcome ul {...width:210px;..float: left; ..}...welcome ul li {..margin-top: 10px;.}....

GET /templates/_common/_templates/browser_survey_SMARTKEYS_MASTER_lightbox_UA/css/style-ie.css HTTP/1.1

Accept: */*

Referer: hXXp://qbmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: qbmzz.exclusiverewards.7001.info

Connection: Keep-Alive

Cookie: ci_session=YLgflIjitzS+rqS24FC+aFj6Sn/vymD+SOAu54gEffwniCeivCWL89EtdQANV0oswKwuq7kvEZamgooOZomNKUCfSzLF3Y7o9Wwj6vUq8XyvX7SfaqRzhVflTrhpNN3BRG+r0l9rQE2Cubiy5hkz5xvK1H/7ONLem3sA9dTpolNUbrOo0IEHKwfGSnwjLHb3oK5lCjV5i3jmIBHlMrYIp+p2GmwDt1NXB6Hgjtb7DMCzEwD3D2awThMkb2rmxY6cdpPcjpSJVpspJTtAvP/IecNgzapLtHMV3+QKQQyQurFAdBgKsJNYYuRFQ6CefdlRVzteYw0X6OVi5RbsWwLkksi+5laD6cO3qDI0H+JrRnnRU6an7aZ5bamZSpStwmIWX+ZhwJ4jZ0oL4jLtYCstH5fG76UO8d2x8ROu+WDh/Y+r86VzlRkLGBNigoy23Rf0OQ6BslB6ZRwN7EQk/RBylQ==; id=XNSX.-r10845-t68; SITE_ID=73001201; sov=73001201; mov=nr.ytsurvey.mini; redid=10845; gsid=68; URI=sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68; templateid=2582; path=browser_survey_SMARTKEYS_MASTER_lightbox_UA; version=227198; tags[2582][expand_enable]=-1; tags[2582][alert_enable]=1; tags[2582][audio_enable]=0; tags[2582][pop_enable]=0; tags[227198][expand_enable]=-1; tags[227198][alert_enable]=1; tags[227198][audio_enable]=0; tags[227198][pop_ena

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Sat, 27 Jun 2015 04:24:57 GMT

Content-Type: text/css

Last-Modified: Fri, 11 Oct 2013 18:30:44 GMT

Transfer-Encoding: chunked

Expires: Tue, 21 Jun 2016 04:24:57 GMT

Cache-Control: max-age=31104000

Pragma: public

Cache-Control: public, must-revalidate, proxy-revalidate

Content-Encoding: gzip

269.............S...0.=o.b....6!....;{.zh{GN.....:N...{'v`.......x..{....)...AT1..<......j...9L..5....E3.c..f.....F..g[..-Z.LxX.'.N..9<....m.`.....f.PI-*<..,..Kn.T.....V.zk.yn.[..Tuh.%,I.k..f<G$.V.l.C7..B...1....r..z.#^b......e.A..\..@cp.CJ.:l$.i..s....w/:#Qu.`.<.......[A.4D{..V....*..=..;{.#..e..1.:8..I.e6.?....N....a.Qh.w.....~.-.h...i.V..Y.Ai..wkD5.c..q=.v.....q....I......3......F...b*%......2..|p........d.-}.l.Q..M...8...Dc.\...y|........i..\./..N.L.......l.$.S.\.~<P`..[a..^.....hz....x..J.M.1}...2.c7.KrnE.oH.2^,...1....".......!9..3.zi.^w.......7..`k=kdM7... ..N6........&?.Nt.U........./%g.L.....S.'...K.h.O.....0..HTTP/1.1 200 OK..Server: nginx/1.6.3..Date: Sat, 27 Jun 2015 04:24:57 GMT..Content-Type: text/css..Last-Modified: Fri, 11 Oct 2013 18:30:44 GMT..Transfer-Encoding: chunked..Expires: Tue, 21 Jun 2016 04:24:57 GMT..Cache-Control: max-age=31104000..Pragma: public..Cache-Control: public, must-revalidate, proxy-revalidate..Content-Encoding: gzip..269.............S...0.=o.b....6!....;{.zh{GN.....:N...{'v`.......x..{....)...AT1..<......j...9L..5....E3.c..f.....F..g[..-Z.LxX.'.N..9<....m.`.....f.PI-*<..,..Kn.T.....V.zk.yn.[..Tuh.%,I.k..f<G$.V.l.C7..B...1....r..z.#^b......e.A..\..@cp.CJ.:l$.i..s....w/:#Qu.`.<.......[A.4D{..V....*..=..;{.#..e..1.:8..I.e6.?....N....a.Qh.w.....~.-.h...i.V..Y.Ai..wkD5.c..q=.v.....q....I......3......F...b*%......2..|p........d.-}.l.Q..M...8...Dc.\...y|........i..\./..N.L.......l.$.S.\.~<P`..[a..^.....hz....x..J.M.1}...2.c7.KrnE.oH.2^,...1...

<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Sat, 27 Jun 2015 04:24:51 GMT

ETag: "54f07a03-1ef8"

Last-Modified: Fri, 27 Feb 2015 14:06:59 GMT

Server: nginx

Content-Length: 7928

Connection: keep-alive

GIF89a..........DCD...:::.........qqq............555...zzziii}}}...............aaaQQQeee...%%%.........VVV...lll...............,,,...YYY...)))...uuuJJJNNN!"!...]]]...101.................................\[\.........#$#KLK.../0/KKK[\[`_`...GGG'''...???............///......ccc...sssddd```...###.........SSS...777...VVV...888...xxx...............{|{{{{ghg............kmk444XXX......OOOWWW...222...333!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6E6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6F6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D6C6C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D6D6C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....

<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 27 Jun 2015 04:24:52 GMT

ETag: "54f07a08-570"

Last-Modified: Fri, 27 Feb 2015 14:07:04 GMT

Server: nginx

Content-Length: 1392

Connection: keep-alive

.PNG........IHDR...|.........L.......tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:15582AE06BF411E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:15582AE16BF411E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED896BEF11E4901AB7B77D879212" stRef:documentID="xmp.did:24FEED8A6BEF11E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.......IDATx...=..@.Ea~:52u.....,.g...e..<..l..F...|.E.....G....n..g......V..v.^.C..?... .........k..Bc.Y.V....._....E.(...T.eR...`yn..i.{t...-{tB..{\5......y..s..4kyn<=\5.KV:......u..l..QK.)z.n.........c......\....N.=EG..w..^.Xh......~....w...>..S.dy.H.$5.@.^o..........t...5.N|...>....3..H.....(.3..`Ft..........y..~8^...1OC..x....it&W@it..."..=^MV..WA.$.....W...D6.....v.y.......Pis..2.W:..^..........-.lx>P......3$CR...}.<..5*......f,vl]c.i...k...xN.|>o6......P......z..p8..cv.....o.....&..m.c....IEND.B`...

<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 27 Jun 2015 04:24:51 GMT

ETag: "54f07a01-599"

Last-Modified: Fri, 27 Feb 2015 14:06:57 GMT

Server: nginx

Content-Length: 1433

Connection: keep-alive

.PNG........IHDR...*...*.....J.^.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:24FEED836BEF11E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:24FEED846BEF11E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED816BEF11E4901AB7B77D879212" stRef:documentID="xmp.did:24FEED826BEF11E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>lW1.....IDATx.b|...0p..?.@....l...#...k.....!..T?.&..}_......{....`..?....{..z...'..a..C*....'V.....&VV"M...eWT...{..X...b..\\.M.LHP.:..0.v..9..?.>.W.......ax....X...MM.........~.xA.d....".nTT............/w..c,...!.....\T..;w.Z.......D.K......O....G.......E..$X.D...9..../......K..$...JD.CF_............>.......Lc.f.U.$.7.NqJK...".....|}.<|H.Qd.z...xTU.ll@I....II..^.T.......d.....98.>..w RNK.*....C.._.<..q.....mX.)...?..D.l!.{<...7o......\........W.....^.|,?..v.;p.B..B..r..d.~B.........X%....b-<..c {9.Im.O..........Z?l...v\. ...F.0_B.5....IEND.B`.....

<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Sat, 27 Jun 2015 04:24:52 GMT

ETag: "54f07a05-12d72"

Last-Modified: Fri, 27 Feb 2015 14:07:01 GMT

Server: nginx

Content-Length: 77170

Connection: keep-alive

GIF89a|..............................c........"..y..4.....H.....i...../..1..2.....M.....W...........v...........-..u........0..1.. ..... ........*.....!.....*.....,..{........z..s.....5........&.."..(..(..,..2..4..8..).. ..u..... ..$.....z..m...........*......../..*.....,...........4..".....%..'.. ..............%........(../..............!..............8.....&..3.....)..... ../........%..4.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6A6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6B6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D686C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D696C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....

<<< skipped >>>

GET /click/jGJunWecqZmPY2mWYcp6w4iQa5tnnH6Wi2SYmGakfZSJkGqaYKOBl7dia5Vmon2X?dp=Mjd8NTc4fFVBfDF8MXx8|34ee69d9819b5a94df7268d81470e3f3-17-62|7601abf1-1c84-11e5-9d25-f8bc125381b8 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: network.adsmarket.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx/1.6.2

Date: Sat, 27 Jun 2015 04:24:54 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.38

Set-Cookie: ce-visitor-iWZrnWWe=imGQ35nVfa-oc4DGn7CetouphN2i33vekHl_rl6bepI; expires=Tue, 11-Aug-2015 04:24:54 GMT; path=/; domain=network.adsmarket.com

Set-Cookie: ce-click-iWRymmajfJe3ZGuZZZx6nYtmag=iWRymmajfJe3ZGuZZZx6nYtmag; expires=Sun, 28-Jun-2015 04:24:54 GMT; path=/; domain=network.adsmarket.com

Location: hXXp://VVV.webtrackerplus.com/?page=ec&a_aid=51ccedn87de7&pubid=415891&prgid=152873&cpnid=1208733&clickid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.&ce_cid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.

0..HTTP/1.1 302 Moved Temporarily..Server: nginx/1.6.2..Date: Sat, 27 Jun 2015 04:24:54 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.38..Set-Cookie: ce-visitor-iWZrnWWe=imGQ35nVfa-oc4DGn7CetouphN2i33vekHl_rl6bepI; expires=Tue, 11-Aug-2015 04:24:54 GMT; path=/; domain=network.adsmarket.com..Set-Cookie: ce-click-iWRymmajfJe3ZGuZZZx6nYtmag=iWRymmajfJe3ZGuZZZx6nYtmag; expires=Sun, 28-Jun-2015 04:24:54 GMT; path=/; domain=network.adsmarket.com..Location: hXXp://VVV.webtrackerplus.com/?page=ec&a_aid=51ccedn87de7&pubid=415891&prgid=152873&cpnid=1208733&clickid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.&ce_cid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000...0..

GET /d5/msjava.dll HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: static.4magno.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/octet-stream

Date: Sat, 27 Jun 2015 04:24:42 GMT

ETag: "54ef0d1c-e5910"

Last-Modified: Thu, 26 Feb 2015 12:10:04 GMT

Server: nginx

Content-Length: 940304

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8...........#...............................k................................m...............................`#..te...........................................................................................................................text............................... ..`.data...d"......."..................@....rsrc...............................@..@.reloc..............................@..B4.D8@...0[.8M..... 8W...4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll......................................................................................................................................................................................................................................................................................................................................................... ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: qbmzz.exclusiverewards.7001.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Sat, 27 Jun 2015 04:24:56 GMT

Content-Type: text/html

Transfer-Encoding: chunked

X-Powered-By: HHVM/3.8.0-dev

Cache-Control: no-cache

Expires: Mon, 01 Jan 2001 00:00:00 GMT

X-Sov: 73001201

X-Rot: 227198

X-Source: Mini

Pragma: no-cache

Vary: Accept-Encoding

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Set-Cookie: ci_session=YLgflIjitzS+rqS24FC+aFj6Sn/vymD+SOAu54gEffwniCeivCWL89EtdQANV0oswKwuq7kvEZamgooOZomNKUCfSzLF3Y7o9Wwj6vUq8XyvX7SfaqRzhVflTrhpNN3BRG+r0l9rQE2Cubiy5hkz5xvK1H/7ONLem3sA9dTpolNUbrOo0IEHKwfGSnwjLHb3oK5lCjV5i3jmIBHlMrYIp+p2GmwDt1NXB6Hgjtb7DMCzEwD3D2awThMkb2rmxY6cdpPcjpSJVpspJTtAvP/IecNgzapLtHMV3+QKQQyQurFAdBgKsJNYYuRFQ6CefdlRVzteYw0X6OVi5RbsWwLkksi+5laD6cO3qDI0H+JrRnnRU6an7aZ5bamZSpStwmIWX+ZhwJ4jZ0oL4jLtYCstH5fG76UO8d2x8ROu+WDh/Y+r86VzlRkLGBNigoy23Rf0OQ6BslB6ZRwN7EQk/RBylQ==; expires=Sun, 28-Jun-2015 04:24:56 GMT; Max-Age=86400; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: id=XNSX.-r10845-t68; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: SITE_ID=73001201; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: sov=73001201; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tov=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: mov=nr.ytsurvey.mini; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: redid=10845; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: gsid=68; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: ref=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: URI=sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: templateid=2582; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: path=browser_survey_SMARTKEYS_MASTER_lightbox_UA; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: version=227198; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[2582][expand_enable]=-1; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[2582][alert_enable]=1; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[2582][audio_enable]=0; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[2582][pop_enable]=0; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[227198][expand_enable]=-1; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[227198][alert_enable]=1; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[227198][audio_enable]=0; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[227198][pop_enable]=0; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: content=227198; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: token=225240dc3a95faa44da68d858aea9c52; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: rpm=22; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: vid=10432; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: log_73001201=1; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.exclusiverewards.7001.info

Set-Cookie: id=XNSX.-r10845-t68; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: SITE_ID=73001201; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: sov=73001201; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tov=227198; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: mov=nr.ytsurvey.mini; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: redid=10845; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: gsid=68; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: ref=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: tags[2582][iframe_enable]=0; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.qbmzz.exclusiverewards.7001.info

Set-Cookie: noshid=bphljlbtnhfddldl; expires=Sun, 28-Jun-2015 04:26:36 GMT; Max-Age=86500; path=/; domain=.7001.info

Content-Encoding: gzip

e7d.............[{o....[....P..%YR.....k..H.d...h...(.1E.$....ytm...Px.0.........y.y8.>....;.^R|Y....cS.....{..s8Q.|...k._^a..k.....;..u4..4...&..V..-.}..B..&....=.j../....y_.\T..LW3...NOSXS|ZT\m.-.....QmGs..../.SX./....-y.x.... ....{..c.C....{..3.:..{....&n>......y.Xe.<W ..h*.i.=.9vsQ)..k.vq....M..N.iu....7.......S*......T..f...,.Jb*>.....ckmL.j.....S.c..e...[...r4....Mm..zq......W...W.V...}..6.....R.qJ..chE\)...E..v:..*...%......=FM...)...<'(? (/........"|..|M.T...y.c..50...?).F.f(.......1.WS-...BL..6.~g..7..n.lj..4"...{...S.....^....Vsc*oZ8.r..eu]....4. ..E...h...W(.k.k....W..qu.....L..f.S..#...........P.]......U 0(...P...m...H....-.-......!4u.y/.._c..'...wP..}.[....Q..;.....5.x._.F..........k#n.M..... ...G.E.....v.O6...6....t..m.0.j[.amq.T I.XkX.....=.>2......Z.&k...,*.....m}[k....%~..1.....]V....9zKk.6......H1W.v%...&'.........|....m@..G.........a...(5.'...G.g[...E...>...KB.#s...n1Ck...3F......p\.2...C 9.....>H_.S...i.t.(O..>a.M....z.....w... ..-..PL..m../L........~.o....6)(.Z..oc.>........Z...e..;.......a..=).b...'"B)h....n........pb.{..f.n........fx...;.g..aP(...~B.$..`........=...7..`.>..x .S..........]....Xm...6.....]..B......x.._. ...U....-.......S|7.\`....7)...OiKD.S..b.b....b.....~..1..?..t.Iq..Xu.......=....3..l.-.F..&H{N..b...B `,L=....H...H...??...}.6... ..{?C^....&........em......Ltd ..e... ......u,Scs...bdX.y..N~..h..d.c. .).!b.a.V.1... ^..@..!.B.&5.lF...-..Q........1.e.|..C.>......E%...g).\p'6%..rr@..w.d..oq./...e....*..C..)GI.9.`%nf........$C-I.....KzEa...s

<<< skipped >>>

GET /templates/_common/_templates/browser_survey_SMARTKEYS_MASTER_lightbox_UA/css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://qbmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: qbmzz.exclusiverewards.7001.info

Connection: Keep-Alive

Cookie: ci_session=YLgflIjitzS+rqS24FC+aFj6Sn/vymD+SOAu54gEffwniCeivCWL89EtdQANV0oswKwuq7kvEZamgooOZomNKUCfSzLF3Y7o9Wwj6vUq8XyvX7SfaqRzhVflTrhpNN3BRG+r0l9rQE2Cubiy5hkz5xvK1H/7ONLem3sA9dTpolNUbrOo0IEHKwfGSnwjLHb3oK5lCjV5i3jmIBHlMrYIp+p2GmwDt1NXB6Hgjtb7DMCzEwD3D2awThMkb2rmxY6cdpPcjpSJVpspJTtAvP/IecNgzapLtHMV3+QKQQyQurFAdBgKsJNYYuRFQ6CefdlRVzteYw0X6OVi5RbsWwLkksi+5laD6cO3qDI0H+JrRnnRU6an7aZ5bamZSpStwmIWX+ZhwJ4jZ0oL4jLtYCstH5fG76UO8d2x8ROu+WDh/Y+r86VzlRkLGBNigoy23Rf0OQ6BslB6ZRwN7EQk/RBylQ==; id=XNSX.-r10845-t68; SITE_ID=73001201; sov=73001201; mov=nr.ytsurvey.mini; redid=10845; gsid=68; URI=sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68; templateid=2582; path=browser_survey_SMARTKEYS_MASTER_lightbox_UA; version=227198; tags[2582][expand_enable]=-1; tags[2582][alert_enable]=1; tags[2582][audio_enable]=0; tags[2582][pop_enable]=0; tags[227198][expand_enable]=-1; tags[227198][alert_enable]=1; tags[227198][audio_enable]=0; tags[227198][pop_enable

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Sat, 27 Jun 2015 04:24:56 GMT

Content-Type: text/css

Last-Modified: Fri, 11 Oct 2013 18:30:45 GMT

Transfer-Encoding: chunked

Expires: Tue, 21 Jun 2016 04:24:56 GMT

Cache-Control: max-age=31104000

Pragma: public

Cache-Control: public, must-revalidate, proxy-revalidate

Content-Encoding: gzip

9ec.............Z[o...~...5A1;.:.%.....L6.,....E.7..(..%*.............l[`k#...9<......,....'...o.~u.v...7.....Td..<...>...9.E..@<.'...I.3..%J=..(.P.B...(d<zx.. .(....a.pT.|.!..%.*....(..xLPL......%<.....y....=..U8 P.a.P%J.@...w..C. .....(D5.(". %.aM...q.j..E.%,.`../3.p.d...<F.......<GB.]$..$R.....$b...].........]....N....I..y-...~..ZT....]..7'.:9Q\.....S....<'............!...C..8..xl{.u.\'.N@<....7.[.,.DI2..0\p'&.l.IxTW.......r.[^.}...t.2..........I..Z.......EL"^b)}........B.%.wiKViP2I.srBb.}D....@A?.............Br.&I.Zu..3.....>uj]4 .;.~..Y.sG:....sF.!.M...4..X9/......."F...|.vB....md..h.F.-0..D......_..-.D.-UT.;..b....S)&.B..(._;.........yLNQ.........1.1rpI1.?....hr#=.. m8Z.....!..v`'y|..%.....fxG....6.m3L...M>.......s.`...LpLB......x.3f4v......H%|.b...U.c..F..<........p...,.l.....Lc.....zC..K......m......(..K.....u6k=..a..9Z.:=..j.....1.\.....f.Q.V.......^N...U..q...f.8RN.......).J.r,j.......m..eOn.t>..gA....R......m.R....E...>..&....E.]6Zn.M..R-..8...:....u..._..C..s....b?,.s%......`.h.vf!.........LnLs.J..F'..HG.......5.4f.C ......mo...7...r.....&..Z...;..d. oJ.z...F.L..'p.....E.e..q..ptP>.......]Mx.eK..&...*i...:...AZ~"73......C....Smp..V3...C..ZHZ.........F.... ..G>..*..w.8A....(;ky]J....Z.....&.)._.u.^....A..2Afo'm.6......3.Kg5^`....Z-..........F.".:.c....=..G<.5a.3)..u.Gl%.......b_tP.....d^.N ...gO..........|..%.v;.J&.......s...X. ....~.X.t=.....&..v.]'..J...6...../.$....K......-.r2 ...7.fn.GJYf...B..."..W....NZ.V....:5,2.m...l.hk..M.S..'.....;e. HRJ

<<< skipped >>>

GET /templates/_common/_templates/browser_survey_SMARTKEYS_MASTER_lightbox_UA/js/script.js HTTP/1.1

Accept: */*

Referer: hXXp://qbmzz.exclusiverewards.7001.info/?sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: qbmzz.exclusiverewards.7001.info

Connection: Keep-Alive

Cookie: ci_session=YLgflIjitzS+rqS24FC+aFj6Sn/vymD+SOAu54gEffwniCeivCWL89EtdQANV0oswKwuq7kvEZamgooOZomNKUCfSzLF3Y7o9Wwj6vUq8XyvX7SfaqRzhVflTrhpNN3BRG+r0l9rQE2Cubiy5hkz5xvK1H/7ONLem3sA9dTpolNUbrOo0IEHKwfGSnwjLHb3oK5lCjV5i3jmIBHlMrYIp+p2GmwDt1NXB6Hgjtb7DMCzEwD3D2awThMkb2rmxY6cdpPcjpSJVpspJTtAvP/IecNgzapLtHMV3+QKQQyQurFAdBgKsJNYYuRFQ6CefdlRVzteYw0X6OVi5RbsWwLkksi+5laD6cO3qDI0H+JrRnnRU6an7aZ5bamZSpStwmIWX+ZhwJ4jZ0oL4jLtYCstH5fG76UO8d2x8ROu+WDh/Y+r86VzlRkLGBNigoy23Rf0OQ6BslB6ZRwN7EQk/RBylQ==; id=XNSX.-r10845-t68; SITE_ID=73001201; sov=73001201; mov=nr.ytsurvey.mini; redid=10845; gsid=68; URI=sov=73001201&hid=bphljlbtnhfddldl&redid=10845&gsid=68&id=XNSX.-r10845-t68; templateid=2582; path=browser_survey_SMARTKEYS_MASTER_lightbox_UA; version=227198; tags[2582][expand_enable]=-1; tags[2582][alert_enable]=1; tags[2582][audio_enable]=0; tags[2582][pop_enable]=0; tags[227198][expand_enable]=-1; tags[227198][alert_enable]=1; tags[227198][audio_enable]=0; tags[227198][pop_enable]

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Sat, 27 Jun 2015 04:24:57 GMT

Content-Type: application/javascript

Last-Modified: Fri, 11 Oct 2013 18:30:48 GMT

Transfer-Encoding: chunked

Expires: Tue, 21 Jun 2016 04:24:57 GMT

Cache-Control: max-age=31104000

Pragma: public

Cache-Control: public, must-revalidate, proxy-revalidate

Content-Encoding: gzip

9c0..............iw.6... .....LIv.m..]?'N.^.g7i..q.(..XS.J.>bi............$....`........} ....>..e.._.d...;.........v2xM.4..HY..........w.h..}gCF...o.%........... S..,...2.....E.....$...q..lLD.\d..{....[....N.l....v..By...a.e<.D.[....'.i|6...z....x...u~.F..d..V*$..-....^.-..Rj.cqU.{7 ...@..p..].$.5..7mc$./..)-..$...=..).....k...9Ox(...e..C.z..&..\Y.\_.../..HQ....Q.GC.Ac...F..Qi.A.....i......|...Q..L\R. .J}l[..=?...$.s.d....\s......c......@7^0...mD.X&.b.|.Ax>.D.FN.9.......-.f..........D..SFf>.."....i...&..`E:..w..{.fd!.q.2...IP$.66."H.?. .._....'...%..........i...F .b.......g({....V.$B.d..1....3g..P........3..9..q...?.`!O,.<.R9lt..Y..p....Lb.D....%.1.P...h2...6.\>"..#.........A......8....U....)....$D.....L...8..9.J.8.{..K.%.[\..[.o...!]c.S;m).[.Z.....)...m.p.\...T..#py..Q"......9..P..E..<..|.lS...]r$L.a...= M....."......hV..mr..._U2.J<..f<...TJ.....H8..*"@L..m.]p.%...Y8..1......E.Ji1. .F}..l/....EvlO.......P..Z..G.S....X..4...A;mv..e..G.clV.TU..U...a.....!.`O.9..V....vVx..._.....B...8N.A=Vk......wY_......{...1.....T..S2.r.......H......k..aytM..b...c<...6...ri1..A.V..^...VT....q..'.6..L.C..p L....ZU ...)...h......~..nW..h9.s.e..F3.M...v.Z...D...Z..;...(.t.......`A.. M.9...p..z..S(]y-.....@...._\.P.f.v6..1hTK.:*..`.-7....{.CT..P..%j...m.b....;I.\...a..r.3.'...YG.Z.Wf.*z.F.^.%6..m......S.....X.3.g.WB..S....t....'.....'...Pj..k....j.NV..eu....(..2T.b.).S@qh..g/j....a.....W.J./<...v..7....:;....MA........n.....p....@..y7.dT..ts..R..8.....B.L;lA.F<m1U.ZN[.l;-.............W%..;:y.

<<< skipped >>>

GET /?page=ec&a_aid=51ccedn87de7&pubid=415891&prgid=152873&cpnid=1208733&clickid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000.&ce_cid=20Wzkj3KPBGaqETR3xKxtt1z8HFI000. HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.webtrackerplus.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 27 Jun 2015 04:24:55 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

location: hXXp://3p6.popularfastchannel.com/?s1=&s2=&s3=

Set-Cookie: SERVERID=web4; path=/

Set-Cookie: visid_incap_227739=o oC4ntRTg66NQlIonH3jJcljlUAAAAAQUIPAAAAAAAJsg6oBjNhL bALnGd4aeJ; expires=Sun, 25 Jun 2017 20:43:35 GMT; path=/; Domain=.webtrackerplus.com

Set-Cookie: incap_ses_323_227739=a2IIINzTYRsm4zcp/YZ7BJcljlUAAAAAB9X4cAK36cKq r9P1xvWxg==; path=/; Domain=.webtrackerplus.com

Set-Cookie: ___utmvmFPupvfO=kqefggcrMNt; path=/; Max-Age=900

Set-Cookie: ___utmvaFPupvfO=tcJ.PSCN; path=/; Max-Age=900

Set-Cookie: ___utmvbFPupvfO=OZx

XYeOQalQ: atE; path=/; Max-Age=900

X-Iinfo: 1-43105183-43105184 NNNN CT(116 -1 0) RT(1435379095088 1) q(0 0 2 0) r(3 3) U5

X-CDN: Incapsula

0..

GET /__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 27 Jun 2015 04:24:50 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 961

Connection: keep-alive

....<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system tray shortly to allow you to work on other items while your selections install. To restore this window, simply click on the icon in your system tray.</p>. . <div class="install-loading">. </div>. <div class="progress-bar">. <div class="_TotalProgressLevel progress-level" ></div> . </div>....<div class="clear" style="height:10px; display:block;"></div>. <div class="_ProgressInstallingText" style="display:none; text-align: center; margin-left: 45px; width: 422px;"><p>Installing ...</p></div>. . <div class="_ProgressText" style="display:none; margin-left: 33px;">. <p>Process: <span class="_ProgressTextDownloaded"></span> of <span class="_ProgressTextTotal"></span> (<span class="_ProgressTextPercentage"></span> %)</p>. </div>.. . .</div>.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Language: en..Content-Type: text/html; charset=utf-8..Date: Sat, 27 Jun 2015 04:24:50 GMT..Server: nginx..Vary: Accept-Language..Content-Length: 961..Connection: keep-alive......<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system

<<< skipped >>>

GET /BesH3gE9/pop-up/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4magno.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Language: en

Content-Type: text/html

Date: Sat, 27 Jun 2015 04:24:52 GMT

Server: nginx

Set-Cookie: lpsl_BesH3gE9=23445178416668ea9d53f103836f5aa7 1435465491; Path=/; Expires=Sun, 28-Jun-15 04:24:51 GMT;Domain=VVV.4magno.com

Vary: Accept-Language

Content-Length: 1068

Connection: keep-alive

...........Vko.6..._...$'.h...$.Y.a...X].C...D.r$Q%);^...KIv.*..3..&.=..s.exg7.^O.x...U..w.~x..5.6!.........?Mn.".i.....U.3.......\.|H.j.rVm...2..<i,W;.K[.x:.......>.I&..0.`0..K[F..a ._.<..8WH.s.c...Y.%.v1.".1Ir.$/D.$YH......,$.{....3.......&.....-...:eoF%Cs...:uR..q'.)I....}......\..tfM.i.V......}y..vg..m..#..v.......~.;d.-.E0RT<0...dI.....T.....~....L.....,>.L.m.q...qvT./e..3Un..E...5....=..c.T.j.hB.P0.BB..&?..2P.;.m...m..n...w..A.KsB..............i.|d%<.Z.N....O|.......^.".2^2...j....-.e.`..%.Z0$d...5......... .o.h.6........%...\..C.Z.s.....q.....E..un.>N....:..H.{sdl.V"V.YX.._..$..ZJ.......#...............T....6K.`...B.E.9lQ7)..2..L6....)H........x...f.z..Pj...G&Cd...@1.........i6N......e.L.4g.*.....G..n.6..!L.&.V....].c.C.R.O..f}t.o.v....4...45.S.=..l..Oz.WT.k.B... {tN^...?......;.g9O..l....~.7c...^..D....F..mu;].v[xd....,c.v.n..Ab".Jo. ..:.....`k:..<&$s;.jZ......8x..-...r*h*.....8.W..}q~..0..:....AA.x...,..z94...|.,.K".|5.. .M_ ..........n8.^..VTd...V..\;zBWSc.s.. ..w.....#.f..J.......@HK...fEV$I.i<....P).....Dx6..w/.2/.T......K.*_[.......c@|u.......

GET /lpresources/js/linkv2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4magno.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4magno.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=23445178416668ea9d53f103836f5aa7 1435465491

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 27 Jun 2015 04:24:52 GMT

ETag: "280056-d84-4feef24b01140"

Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 1358

Connection: keep-alive

...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|srf.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S..9......5.)..R..xQ.1Vb.......V.A........>:J..@yY.w)..:.[....w4.....Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0.."...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?...?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI...\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2..w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T...)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X....f..=..U8......vLc. f...h@..A' E..A3.....t......-.yhZ)..6.`....o%.........'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_.....K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b.....&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7..}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........

<<< skipped >>>

GET /lpresources/js/ainj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4magno.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4magno.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=23445178416668ea9d53f103836f5aa7 1435465491

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 27 Jun 2015 04:24:52 GMT

ETag: "185921-0-4f9c38966d780"

Last-Modified: Mon, 19 May 2014 16:48:46 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 20

Connection: keep-alive

........................

GET /lpresources/js/dlStoragev1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4magno.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4magno.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=23445178416668ea9d53f103836f5aa7 1435465491

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 27 Jun 2015 04:24:52 GMT

ETag: "180b8a-1a57-50572ea11d0c0"

Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 2010

Connection: keep-alive

...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p.......\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}....2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&....".......mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.............%....H<...m..O.~.&...-...f...V..@.iV@....[.. .fZ8Ie...Z..%Zdy...s..@.T..B.2.~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.).Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.)...~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`.@....f...ix........h*!-.l9L...1...@L...6{h./.HpF.).T......i.......3u.'...fK..j.OY.;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}..............IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #..........Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_Cl7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)......p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..

<<< skipped >>>

GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4magno.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4magno.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=23445178416668ea9d53f103836f5aa7 1435465491

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Sat, 27 Jun 2015 04:24:52 GMT

ETag: "53a84f60-1762a"

Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT

Server: nginx

Content-Length: 95786

Connection: keep-alive

/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h ),"object"==typeof g||m.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_464:

`.rsrc

FV<.tn>

PSSSSSSh

J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h

HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0

kernel32.dll

%System%\drivers\vmmouse.sys

%System%\drivers\vmhgfs.sys

%System%\drivers\VBoxMouse.sys

sbiedll.dll

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf

SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase

Software\Microsoft\Windows\CurrentVersion\Uninstall

Software\Classes\ProcMon.Logfile.1\shell\open\command

IsWindowsServer

MNN\\\\\glz&-;ISSboq!*79=KYciu"'''5778?M[crt} .7HLS_ns}*/1

hXXps://ssl.google-analytics.com/collect?

KY[dddddiwDFLV[\es -8BBCDQQ]lw$,0:B

INPWWWWWdfkpqty*HMTclllru#%679DOTceo

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum

DPQYYYYYhw},//;89COYdky*7:IO

JUUXXXXXZdqss},09DP

P[\\\\\\]cmz))6AFHHNNUUcp!-6EGLWflu} 04@

GKMQQQQQV`div"% 4?LMZ[]hu"./>KQVcp "*9=BMTcqsuy (3AIPQ`ly $%,5=>EHSTcp{$)8>DQ[gst%%.78BBNUXftxx *17AIOVW^htx"-89GN[[ajkt"16>LQWfnv$&5DGH

BQS_____ijx#)29CFMQ\_hku!09CDFTTT_``ks!*3557EFQX_git#.4=ESahqu}**0;@JV\]enn}CRXZcpx".4AM\huy{}!$(2@HI

ACESSSSSYcr!)4:GV`nttxy}}%*-57CRTXfoquv!'1@NNW[[ft%,-4=BMQ]fgp (.=BBJQTZ^iiooqsu{(**5?MY]bjrv"1GKQWW`enx'6DDRSUbbmpv!!!$/7C

KV[gggggty$$(78DP[drwz%4:;@BCES[eikx8DGSUVer{$)-1@AESWfhu&(4CQTccqux!-8BPPT\ft#%(3=LYY]fsx#$)-07EOXbqv%(3CRT]fp},.8AFQUXagux| **-

INSTTTTT^``acgs$34?DGLW_esx!%LEPXgor|}

FNU`````nu}$$ 49@KQZdhp{CKR[gru&5

HRT_____eo .78?BO]^fpuw!KQSUdpqz$$(/=GHOOU]fqs &.

()$^.* ?[]|\-{},:=!

N\`aaaaagst|"--0=FP]_chrwx"137?@ACRT]`iw

BOQRRRRRVchn|}#),-4CFUWdmr}&015CDIJRUW]^

APRRRRRRWdr (58>DQUUW]hkz#4CLV]ap}&/2>JT]`hjjptx$&0>CKKX`dlx{(7FHRZ\_h

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\locale

CPSYYYYY^fqy#(25:HKZgru"%-

invalid _N_type: %d

NVW]]]]]jtz -3BEFT[bprz%()46AKR]_et",7>GHKYZhttt!,1@CCFU``hv""/9@EGTcpy}

CRUXXXXX`jsv#13ACDHVdoy#-9GGVVValu}}#9DEPU[iqtx /7CCKPS\gv!'.=CQ[fjpp

IW[\\\\\`n}& 9>BDKZiprv"68FQY^aegv#')

M\coooooz}#*4;@BHTZ`bhhwz)09ALLWfqz%)DRZ^ijos!% 4=EIRSadqz*137AOU]_cr

N]^cccccdqq 4CRT[\etx(7=?GJQUZiv#1?BBGQ

O]aiiiiiu};EQQUdltz ,:@LLX[^cowy{}(7??KST[fjoot!FPX`ckx(6AIQY]hpv#

LT[_____`jwz$7CL[bhtw##&.=GN]coy*--8E

PSUbbbbbbkq|}(02@LQTUZdkt&88DKYgm{ ,5D

MNQTTTTTZiv!,/2;JOTZ]gloz#'/3:EFSVadp{$/5

CPSXXXXX_krsw(8CJYcr|#/9FFKN[`lz)17?LT

OSYfffffq}-@IRX\ccrw| 38AJXcdpy&*/;@OYdfu&2=AEMMQTUZ_mz#//7CGIRXgo|}$2:HU^ds" //4;APQY^ituxy(6>?LSbjv}% 5CP^fkmqru|"03=?BCMQYcpuwz(,,;EIS`jx$24:IW\dllz)19CDOZeqrt!$25;IU_ftw&'.99>JPXZ]krx& 3:>GHKUdfkqq"-6;AGQW[eguv'5DDHSVdfhkx"/2?@

AFM\\\\\_mmt$/78@MX]goqw&'00>KVbqtwy%-66;;@ER_kvw}"',9@OZegsz&1DKTcdss{,37=ENQVW[glqr#/22?MSY``lt#&/0>FUdpz#19EKRR^bdddlt|!"'08;FRUcit#&)67COOX^hs$%%./99>IM[]^mz #$2@HTbq|'./1=IRR`mmt"./112>?KSUZ\_ap}-27EHU_fty*07EGSbppss{%,9AKTcekops!/KYdejlmqsuu!--6=>JVYgnnv ,29=LXdostu 7;?N[gllu{(/38=HIW\^_nuy# 5CQWennoo}(006CQZffoz -5?EJP^kv#//;??AEEKVYhnx% 3>JNOORYZabmz*9FT\fir"'27;JYemq| 7CHLW\`iix"((3BPT]gixz|%2:ACMQQT``jyz$1??DNPZ]^`opv!#-;EMM\gv')8GV^^iq{$/6@K

DEHIIIIIU[jv!$(0=LQXgr!.49FSZ^mu}.56;CCNZenx&)22;HU`ilno} 3AN[_`hr!" 4;IQQXbffky|}"),7;EEH

NetBase.cpp

FHJJJJJJX`mx)2AIW^hr{$CDMUXboy* -;JLZ^lx{!" 5AGUY^amppw} .8DNV[gpuv{"

GJQ[[[[[_cqv{$39?DFGISU_ipu *5;AMNV[^ky $ .:=>HQXX`ks$$1?MR[_cquyzz{ /0=IT_ehu{DCQTW`flp!!#%*125AFJPVdpp ./4

URL EMPTY

"url":"

ParseUrl

/Setup.application

hXXp://

PictureEx.cpp

c:\logFile.txt

hXXp://42e546f0ea2d40afa114ea020951ec9d:9538ea5acbbe4fc6b42811c415685653@

.cpp" ,

errormsg

Error opening key.

Key not found.

CheckRegistryKeyExistance

_virtualGetStringKey

_virtualSetStringKey

_virtualSetDwordKey

_virtualcheckRegkKey

SetStringKey

CWebBrowser2

0.0.0.0

mb_00000000-0000-0000-0807-060504030201

mb_09F005AE-AC9D-4FC1-AB7A-24004F6C043A

mb_01010101-0101-0101-0101-010101010101

mb_58585858-5858-5858-5858-585858585858

mb_4c4c4544-0000-2010-8020-80c04f202020

mb_11111111-2222-3333-4444-555555555555

mb_11111111-1111-1111-1111-111111111111

mb_00020003-0004-0005-0006-000700080009

mb_890E2D14-CACD-45D1-AE66-BC80E8BFEB0F

mb_8E275844-178F-44A8-ACEB-A7D7E5178C63

mb_52309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_DC698397-FA54-4CF2-82C8-B1B5307A6A7F

mb_61F39712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_50FB9712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_93309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_56F49712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_07090201-0103-0301-0807-060504030201

mb_03000200-0400-0500-0006-000700080009

mb_FEFEFEFE-FEFE-FEFE-FEFE-FEFEFEFEFEFE

mb_FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_00000000-0000-0000-0000-000000000000

CNotSupportedException

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp

m_nMsgLast =

m_msgCur = {

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occmgr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occdlg.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

m_pszExeName =

m_nCmdShow =

m_lpCmdLine =

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxadv.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Warning: no message line prompt for ID 0xX.

Warning: OnUpdateKeyIndicator - unknown indicator 0xX.

Warning: scroll bars in frame windows may cause unusual behaviour.

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.h

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp

SENDING control notification %d from control id 0xX to %hs window.

SENDING command id 0xX to %hs target.

No handler for command ID 0xX, disabling it.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp

Error: failed to load message box prompt string 0xx.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp

Warning: unknown WM_MEASUREITEM for menu item 0xX.

hhctrl.ocx

Implementation Warning: control notification = $%X.

Warning: not executing disabled command %d

hWnd = $X (nIDC=$X) is not a %hs.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occsite.cpp

IOleInPlaceObject not supported on OLE control (dialog ID %d).

Persistence not supported on OLE control %ls.

%d. Column ordinal %d: Binding as native data type

%d. Column ordinal %d: Binding a COM object

%d. Column ordinal %d: Binding as an IStream object

%d. Column ordinal %d: Binding as an ISequentialStream object

neither ISequentialStream nor IStream are supported!

IStream is supported

ISequentialStream is supported

Testing streams support...

%d. Column ordinal %d: Binding by reference in provider allocated, consumer owned memory

%d. Column ordinal %d: Binding length and status ONLY

Number of columns: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atldbcli.h

Unsupported DBTYPE (%d) in column %d

$@Column %d not bound

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occcont.cpp

Error: no data exchange control with ID 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp

m_ps.rcPaint =

m_ps.fErase =

m_ps.hdc =

lgpn.lopnColor =

lgpn.lopnWidth.x (width) =

lgpn.lopnStyle =

lb.lbColor =

lb.lbHatch =

lb.lbStyle =

lf.lfFaceName =

lf.lfPitchAndFamily =

lf.lfQuality =

lf.lfClipPrecision =

lf.lfOutPrecision =

lf.lfCharSet =

lf.lfStrikeOut =

lf.lfUnderline =

lf.lfItalic =

lf.lfWeight =

lf.lfOrientation =

lf.lfEscapement =

lf.lfWidth =

lf.lfHeight =

bm.bmBitsPixel =

bm.bmPlanes =

bm.bmWidthBytes =

bm.bmWidth =

bm.bmHeight =

bm.bmType =

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp

IGNORING command id 0xX sent to %hs dialog.

Routing command id 0xX to app.

Routing command id 0xX to owner window.

Warning: Creating dialog from within a COleControlModule application is not a supported scenario.

Warning: ExecuteDlgInit failed during dialog init.

ERROR: Dialog with IDD 0xX must have the child style.

ERROR: Dialog with IDD 0xX must be invisible.

ERROR: Cannot find dialog template with IDD 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp

CHttpConnection

CHttpFile

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\inet.cpp

Unknown status: %d

Internet ctxt=%d:

Warning: throwing CInternetException for error %d

Warning: Extended error reported with no response info

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp

WM_HOTKEY

WM_SETHOTKEY

WM_IDLEUPDATECMDUI

WM_DDE_EXECUTE

WM_KEYLAST

WM_SYSKEYUP

WM_SYSKEYDOWN

WM_KEYUP

WM_KEYDOWN

WM_VKEYTOITEM

WM_CTLCOLORMSGBOX

WM_USER 0xX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp

Warning: Unable to unpack WM_DDE_EXECUTE lParam lX.

Warning: failed to reclaim %d bytes for memory safety pool.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occevent.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filemem.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp

Warning: Shrinking safety pool from %d to %d to satisfy request of %d bytes.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleenum.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp

Error: failed to load AfxFormatString string 0xx.

Error: illegal string index requested %d.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxmt.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemsgf.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occlock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledobj2.cpp

a %hs object at $%p, %u bytes long

an invalid object at $%p, %u bytes long

faulted while dumping object at $%p, %u bytes long

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledlgs2.cpp

m_bz.hTask =

m_bz.hResource =

m_bz.lpszTemplate =

m_bz.hInstance =

m_bz.lCustData =

m_bz.lpszCaption =

m_bz.hWndOwner =

m_bz.dwFlags =

m_bz.cbStruct =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledoc1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_o.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

%s(%d) :

%s_%0x

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: %s

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setvbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

This is an unsupported way to load Visual C DLLs. You need to modify your application to build with a manifest.

- Attempt to initialize the CRT more than once.

- CRT not initialized

Please contact the application's support team for more information.

- floating point support not loaded

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

ADVAPI32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

USER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\convrtcp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

Run-Time Check Failure #%d - %s

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

MSPDB80.DLL

RegCloseKey

RegOpenKeyExA

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appmodul.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp

MaxCore.cpp

.?AVCCmdTarget@@

MaxCoreDlg.cpp

.?AVCWebBrowser2@@

.?AVExecuteBase@@

.?AVExecuteFacade@@

Idispimp.cpp

.PAVCFileException@@

.PAVCInternetException@@

.PAVexception@std@@

Text.cpp

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCOleException@@

.?AVCNotSupportedException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCArchiveException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCOleDispatchException@@

zcÃ

%X4wtG

%n%S>pn

.pzyf

GetCPInfo

GetConsoleOutputCP

GetProcessHeap

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyW

RegEnumKeyW

RegCreateKeyW

RegDeleteKeyW

RegQueryInfoKeyW

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

ShellExecuteExW

ShellExecuteW

UrlUnescapeW

URLDownloadToFileW

SetWindowsHookExW

GetKeyState

CreateDialogIndirectParamW

UnhookWindowsHookEx

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

InternetOpenUrlW

InternetCanonicalizeUrlW

InternetCrackUrlW

.text

`.rdata

@.data

.rsrc

PA

KERNEL32.DLL

ADVAPI32.dll

COMDLG32.dll

dbghelp.dll

GDI32.dll

IPHLPAPI.DLL

ole32.dll

OLEACC.dll

OLEAUT32.dll

oledlg.dll

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

WININET.dll

WINSPOOL.DRV

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xutility

AtlThrow: hr = 0x%x

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlsimpstr.h

std::_Vector_const_iterator >::operator *

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\vector

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator > *,class std::allocator > *> >::operator *

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator > *,class std::allocator > *> >::operator =

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlconv.h

std::basic_string,class std::allocator >::operator []

hWarning: implicit LoadString(%u) failed

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Windows

IsWindowsServer,

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator,class std::allocator >,class std::allocator,class std::allocator > > >::operator =

std::_Vector_const_iterator,class std::allocator >,class std::allocator,class std::allocator > > >::operator *

std::_Vector_const_iterator,class std::allocator >,class std::allocator,class std::allocator > > >::operator

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\ostream

std::_String_const_iterator,class std::allocator >::operator *

std::_String_const_iterator,class std::allocator >::operator

std::_Tree,class std::allocator >,0> >::const_iterator::operator ==

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xtree

std::_Tree,class std::allocator >,0> >::const_iterator::operator *

std::vector,class std::allocator >,class std::allocator,class std::allocator > > >::operator []

invalid operator

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::operator ==

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::operator ==

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::operator ==

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::operator *

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::operator *

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::operator *

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::_Inc

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::_Dec

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::_Inc

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::_Dec

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::_Dec

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::_Inc

ExtractIcon.cpp

std::list,class std::allocator >,class std::allocator,class std::allocator > > >::_Const_iterator::operator

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\list

std::list,class std::allocator >,class std::allocator,class std::allocator > > >::_Const_iterator::operator --

std::_String_const_iterator,class std::allocator >::operator --

std::_String_const_iterator,class std::allocator >::operator *

std::_String_const_iterator,class std::allocator >::operator

std::_String_const_iterator,class std::allocator >::operator =

std::_Vector_const_iterator,class std::allocator > >::operator =

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\regex

_std::_Vector_const_iterator >::operator *

std::list,class std::allocator >,class std::allocator,class std::allocator > > >::_Const_iterator::operator *

Bstd::vector,class std::allocator > >::operator []

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\algorithm

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::operator ==

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::operator *

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::_Dec

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::_Inc

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlcomcli.h

helpJavaScript.cpp

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator

std::vector >::operator []

E_OUTOFMEMORY FAIL URLDownloadToFile

INET_E_DOWNLOAD_FAILURE FAIL URLDownloadToFile

SUCCEEDED URLDownloadToFile

SUCCEEDED default URLDownloadToFile

default URLDownloadToFile

hXXps://

std::vector >::operator []

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator

ddata.exe

start.gif

std::vector >::operator []

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator

std::_Vector_const_iterator >::operator =

3.2.640

"sentry.interfaces.Message": {

std::_Tree,class std::allocator >,0> >::const_iterator::operator ==

std::_Tree,class std::allocator >,0> >::const_iterator::operator *

%s%s%s

std::_Tree > >,class std::basic_string,class std::allocator >,struct std::less > > >,class std::allocator > > const ,class std::basic_string,class std::allocator > > >,0> >::const_iterator::operator ==

std::_Tree > >,class std::basic_string,class std::allocator >,struct std::less > > >,class std::allocator > > const ,class std::basic_string,class std::allocator > > >,0> >::const_iterator::operator *

std::_Tree > >,class std::basic_string,class std::allocator >,struct std::less > > >,class std::allocator > > const ,class std::basic_string,class std::allocator > > >,0> >::const_iterator::_Dec

std::_Tree > >,class std::basic_string,class std::allocator >,struct std::less > > >,class std::allocator > > const ,class std::basic_string,class std::allocator > > >,0> >::const_iterator::_Inc

SELECT * FROM Win32_OperatingSystem

_hd_%S

0mb_%S

Windows

CACHE_S_FORMATETC_NOTSUPPORTED

CO_E_SERVER_EXEC_FAILURE

MK_E_INTERMEDIATEINTERFACENOTSUPPORTED

OLE_E_ADVISENOTSUPPORTED

REGDB_E_KEYMISSING

UCACHE_E_FIRST...CACHE_E_LAST

CACHE_S_FIRST...CACHE_S_LAST

CLASSFACTORY_E_FIRST...CLASSFACTORY_E_LAST

CLASSFACTORY_S_FIRST...CLASSFACTORY_S_LAST

CLIENTSITE_E_FIRST...CLIENTSITE_E_LAST

CLIENTSITE_S_FIRST...CLIENTSITE_S_LAST

CLIPBRD_E_FIRST...CLIPBRD_E_LAST

CLIPBRD_S_FIRST...CLIPBRD_S_LAST

CONVERT10_E_FIRST...CONVERT10_E_LAST

CONVERT10_S_FIRST...CONVERT10_S_LAST

CO_E_FIRST...CO_E_LAST

CO_S_FIRST...CO_S_LAST

DATA_E_FIRST...DATA_E_LAST

DATA_S_FIRST...DATA_S_LAST

DRAGDROP_E_FIRST...DRAGDROP_E_LAST

DRAGDROP_S_FIRST...DRAGDROP_S_LAST

ENUM_E_FIRST...ENUM_E_LAST

ENUM_S_FIRST...ENUM_S_LAST

INPLACE_E_FIRST...INPLACE_E_LAST

INPLACE_S_FIRST...INPLACE_S_LAST

MARSHAL_E_FIRST...MARSHAL_E_LAST

MARSHAL_S_FIRST...MARSHAL_S_LAST

MK_E_FIRST...MK_E_LAST

MK_S_FIRST...MK_S_LAST

OLEOBJ_E_FIRST...OLEOBJ_E_LAST

OLEOBJ_S_FIRST...OLEOBJ_S_LAST

OLE_E_FIRST...OLE_E_LAST

OLE_S_FIRST...OLE_S_LAST

REGDB_E_FIRST...REGDB_E_LAST

REGDB_S_FIRST...REGDB_S_LAST

VIEW_E_FIRST...VIEW_E_LAST

VIEW_S_FIRST...VIEW_S_LAST

FACILITY_WINDOWS

severity: %s, facility: %s ($lX)

range: %s ($lX)

%s ($lX)

Warning: constructing COleException, scode = %s.

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h

G%s (%s:%d)

%s (%s:%d)

ntdll.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

If:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Error: failed to execute DDE command '%s'.

Warning: DDE command '%s' ignored because window is disabled.

pMRU: open file (%d) '%s'.

Can't register window class named %s

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

WinHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

HtmlHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h

commctrl_DragListMsg

Kf:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Binding entry %d failed. Status: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h

GetData failed - HRESULT = 0x%X

m_pColumnInfo[nColumn].ulColumnSize == sizeof(ctype)

Jf:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

ERROR: Dialog named '%s' must have the child style.

ERROR: Dialog named '%s' must be invisible.

ERROR: Cannot find dialog template named '%s'.

CLSID\%s

Interface\%s

mfcm90ud.dll

QueryInterface(%s) failed

QueryInterface(%s) succeeded

Kcomctl32.dll

Kcomdlg32.dll

Kshell32.dll

connecting to socket address '%s'

resolved name for %s!

resolving name for %s

Warning: destroying an open %s with handle %8.8X

Warning: Disconnecting %s handle %8.8X in context %8.8X at destruction.

KHTTP/1.0

WININET.DLL

Warning: could not get volume information '%s'.

Warning: could not parse the path '%s'. Path is too long.

Warning: could not parse the path '%s'.

CFile exception: %hs, File %s, OS error information = %ld.

user32.dll

AppMsg

WinMsg

CmdRouting

%s: hwnd=0xX, msg = 0xX (0xX, 0xX)

%s: hwnd=0xX, msg = %hs (0xX, 0xX)

%s: Advise item='%s', Format='%s', Ack=%d, Defer Update= %d

%s: Execute '%s'.

0xx

Lf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

Warning: OleInitialize returned scode = %s.

mscoree.dll

nf:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp

%S(%d) :

ppCategory && pfnCrtDbgReport

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlmem.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tmakepath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tsplitpath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fsetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\rewind.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcslwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\atof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsinc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsdup.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

V_CrtSetReportHook2

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputws.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

f:\dd\vctools\crt_bld\self_x86\crt\src\clearerr.c

fMode == _CRTDBG_REPORT_MODE || (fMode & ~(_CRTDBG_MODE_FILE | _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_WNDW)) == 0

_CrtSetReportMode

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

nRptType >= 0 && nRptType

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

Mf:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), rterrs[tblindx].rterrtxt)

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "\n\n")

strcpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftelli64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

$f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

c:\%original file name%.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

%original file name%.exe_464_rwx_00401000_001C0000: