Skip to main content

Sample_dd7ebc874b


mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: dd7ebc874b9cb6a3a8df8ffde087d2ab

SHA1: 40128056d9f060462a09d744c6aa9369e4ebf919

SHA256: 1b44dc43c72dfa7edb031ed4b37a1e8b2f1458eb34ebbe735d2376a443ee264b

SSDeep: 49152:fJYDvvXoq/WO91SaPd6PziPPY jkybKktITn:qv4HOPSmd7PPYmkhkqTn

Size: 2355453 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-06-07 00:41:54

Analyzed on: Windows7Ada SP1 64-bit

Summary: Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

_installB3E08.exe:4068
%original file name%.exe:2528
CheckInstall.exe:3596

The Malware injects its code into the following process(es):

FreeHideIP.exe:964

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process _installB3E08.exe:4068 makes changes in the file system.


The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\System.dll (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\fpinstall.dll (20 bytes)
C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe (750 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\NSISArray.dll (804 bytes)
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe (9320 bytes)
C:\Windows\SysWOW64\Macromed\Flash\install.log (251985 bytes)
C:\Windows\SysWOW64\Macromed\Flash\Flash10e.ocx (130085 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjC9D4.tmp (98019 bytes)

The process %original file name%.exe:2528 makes changes in the file system.


The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeHideIP\res\flag_short\MX.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\images\about.png (2392 bytes)
%Program Files% (x86)\FreeHideIP\res\hideip.dat (10 bytes)
%Program Files% (x86)\FreeHideIP\lang\English.lan (13 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DJ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GM.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KE.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PN.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BG.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ET.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KP.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AS.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FI.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BT.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LY.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\FreeHideIP.exe (119955 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\US.PNG (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp (4 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ER.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ML.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112140701.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CZ.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\const.dat (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ZM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TD.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\Privacy Policy.url (65 bytes)
%Program Files% (x86)\FreeHideIP\res\logo.png (7 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VC.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MANN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AR.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Help.lnk (338 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SA.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NG.PNG (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\ioSpecial.ini (16099 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ZA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SI.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DM.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TL.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SCOTLAND.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TH.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BJ.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VATICAN CITY.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\A.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SAINT HELENA.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GL.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\uninst.exe (1426 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LI.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\OM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TM.png (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AI.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PY.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\InstallOptions.dll (30 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IN.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GT.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\End User License Agreement.url (84 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IS.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\WALLIS AND FUTUNA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MG.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NA.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112138779.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MP.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ZW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LV.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NR.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\WALES.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PE.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SM.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BI.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BV.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\trialnotify.mht (1552 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SD.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UA.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DK.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MQ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GI.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LK.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ES.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IQ.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Free Hide IP.lnk (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BM.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ID.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\EC.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CV.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TT.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GQ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SY.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MD.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Get Free Hide IP Pro.url (83 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112135624.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MC.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RO.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IO.PNG (4 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KZ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PK.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\skins\default.skn (1856 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\QA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SB.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TV.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PT.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\ffextension.xpi (4 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HT.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112139176.png (4 bytes)
C:\Users\Public\Desktop\Free Hide IP.lnk (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LB.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CH.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CI.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UK.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\WS.png (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AL.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\map.tpl (269 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BS.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\EG.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SK.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Privacy Policy.url (65 bytes)
%Program Files% (x86)\FreeHideIP\End User License Agreement.url (84 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\JP.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SV.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NORTHERN IRELAND.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BB.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AU.PNG (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\modern-wizard.bmp (5520 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KY.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AM.png (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GE.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SG.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NI.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Uninstall Free Hide IP.lnk (816 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\PR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\200868112142681.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\HU.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CA.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\CheckInstall.exe (45705 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\ST.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CK.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VE.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso2481.tmp (142800 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GY.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SC.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KI.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\EE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\YE.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AE.png (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\background.png (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\VU.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MH.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GP.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\DZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UN.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NL.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\JM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FJ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BR.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\IL.PNG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\modern-header.bmp (784 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\JO.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MV.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LT.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\NP.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\RW.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BF.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\TJ.PNG (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Free Hide IP Site.url (89 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\LC.png (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BZ.PNG (3 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CS.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MZ.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\GA.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\KW.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\SR.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\AD.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\BA.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\MM.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\UY.PNG (2 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\FR.PNG (1 bytes)
%Program Files% (x86)\FreeHideIP\res\flag_short\CO.PNG (1 bytes)

The process FreeHideIP.exe:964 makes changes in the file system.


The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\update[1].htm (1116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\FreeHideIP\UserFlag.ini (22 bytes)
C:\ProgramData\FreeHideIP\setting.dat (2153 bytes)

The process CheckInstall.exe:3596 makes changes in the file system.


The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_installB3E08.exe (14071 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\flash_player_ax[1].exe (59131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sgDEF74.tmp (62984 bytes)

Registry activity

The process _installB3E08.exe:4068 makes changes in the system registry.


The Malware creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}]
"Policy" = "3"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
"(Default)" = "FlashBroker"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper\DefaultIcon]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe,1"

[HKCR\MIME\Database\Content Type\application/futuresplash]
"Extension" = ".spl"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper]
"(Default)" = "Macromedia Flash Paper"

[HKCR\ShockwaveFlash.ShockwaveFlash]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX\Components]
"Main" = "1"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"8.0" = "42"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"VersionMinor" = "0"

[HKCR\ShockwaveFlash.ShockwaveFlash\CurVer]
"(Default)" = "ShockwaveFlash.ShockwaveFlash.10"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"(Default)" = "Adobe Flash Player"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
"(Default)" = "IShockwaveFlash"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"URLInfoAbout" = "http://www.adobe.com/go/getflashplayer"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
"(Default)" = "Macromedia Flash Factory Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.1]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
"(Default)" = "IFlashBroker3"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
"(Default)" = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"URLUpdateInfo" = "http://www.adobe.com/go/flashplayer/"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"VersionMajor" = "10"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
"(Default)" = "1.0"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
"(Default)" = "ShockwaveFlash.ShockwaveFlash"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"9.0" = "16384000"

[HKCR\ShockwaveFlash.ShockwaveFlash.6\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\MIME\Database\Content Type\application/x-shockwave-flash]
"CLSID" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
"(Default)" = ""

[HKCR\FlashFactory.FlashFactory.1]
"(Default)" = "Macromedia Flash Factory Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.8]
"(Default)" = "Shockwave Flash Object"

[HKCR\FlashFactory.FlashFactory\CurVer]
"(Default)" = "FlashFactory.FlashFactory.1"

[HKCU\Software\Macromedia\FlashPlayer]
"FlashPlayerVersion" = "10.0.45.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}]
"AppPath" = "C:\Windows\SysWow64\Macromed\Flash"

[HKCR\ShockwaveFlash.ShockwaveFlash.10\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"NoModify" = "1"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\0\win32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"10.0" = "2949122"

[HKCR\.mfp]
"(Default)" = "MacromediaFlashPaper.MacromediaFlashPaper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"DisplayVersion" = "10.0.45.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Locale" = "EN"
"ComponentID" = "Flash"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
"(Default)" = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe -osint -url %1"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
"(Default)" = "Shockwave Flash"

[HKCR\.spl]
"Content Type" = "application/futuresplash"

[HKCR\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
"(Default)" = "IShockwaveFlash"

[HKCR\.swf]
"Content Type" = "application/x-shockwave-flash"

[HKCR\FlashFactory.FlashFactory.1\CLSID]
"(Default)" = "{D27CDB70-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"6.0" = "88"

[HKCR\ShockwaveFlash.ShockwaveFlash.8\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
"(Default)" = "FlashFactory.FlashFactory.1"

[HKCR\ShockwaveFlash.ShockwaveFlash.6]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx, 1"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\ShockwaveFlash.ShockwaveFlash.3]
"(Default)" = "Shockwave Flash Object"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"HelpLink" = "http://www.adobe.com/go/flashplayer_support/"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShockwaveFlash.ShockwaveFlash.7]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}]
"AppName" = "FlashUtil10e.exe"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer]
"currentVersion" = "10,0,45,2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"RequiresIESysFile" = "4.70.0.1155"

[HKCR\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
"(Default)" = "_IShockwaveFlashEvents"

[HKCR\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
"LocalizedString" = "@C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe,-101"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags" = "0"

[HKCR\FlashFactory.FlashFactory]
"(Default)" = "Macromedia Flash Factory Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.5]
"(Default)" = "Shockwave Flash Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.7\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Version" = "10.0.45.2"

[HKCR\ShockwaveFlash.ShockwaveFlash.10]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\Macromed\Flash\Flash10e.ocx, 1"

[HKCR\ShockwaveFlash.ShockwaveFlash.9]
"(Default)" = "Shockwave Flash Object"

[HKCR\ShockwaveFlash.ShockwaveFlash.4\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"UninstallString" = "C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe"
"DisplayName" = "Adobe Flash Player 10 ActiveX"

[HKCR\ShockwaveFlash.ShockwaveFlash\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\.sol]
"Content Type" = "text/plain"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib]
"Version" = "1.0"

[HKCR\MIME\Database\Content Type\application/x-shockwave-flash]
"Extension" = ".swf"

[HKCR\.sor]
"Content Type" = "text/plain"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"(Default)" = "Shockwave Flash Object"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled" = "1"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer\SafeVersions]
"7.0" = "73"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents]
"Flash" = "application/x-shockwave-flash"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"Publisher" = "Adobe Systems Incorporated"

[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
"(Default)" = "ShockwaveFlash.ShockwaveFlash.10"

[HKCR\MIME\Database\Content Type\application/futuresplash]
"CLSID" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\.swf]
"(Default)" = "ShockwaveFlash.ShockwaveFlash"

[HKCR\.spl]
"(Default)" = "ShockwaveFlash.ShockwaveFlash"

[HKCR\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
"(Default)" = "FlashBroker"

[HKCR\ShockwaveFlash.ShockwaveFlash.4]
"(Default)" = "Shockwave Flash Object"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"IsInstalled" = "01 00 00 00"

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
"(Default)" = "FlashFactory.FlashFactory"

[HKCR\.mfp]
"Content Type" = "application/x-shockwave-flash"

[HKCR\ShockwaveFlash.ShockwaveFlash.5\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX]
"Path" = "C:\Windows\system32\Macromed\Flash"

[HKCR\ShockwaveFlash.ShockwaveFlash.1\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib]
"(Default)" = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"

[HKCR\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
"(Default)" = "_IShockwaveFlashEvents"

[HKCR\ShockwaveFlash.ShockwaveFlash.3\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

[HKCR\FlashFactory.FlashFactory\CLSID]
"(Default)" = "{D27CDB70-AE6D-11cf-96B8-444553540000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
"DisplayIcon" = "C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe"

[HKCR\ShockwaveFlash.ShockwaveFlash.9\CLSID]
"(Default)" = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"

The Malware deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Programmable]
[HKCR\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable]

The process %original file name%.exe:2528 makes changes in the system registry.


The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF" = "01 00 00 00 00 00 00 00 66 70 48 96 2A 2A D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"DisplayName" = "Free Hide IP"
"HelpLink" = "http://client.free-hideip.com/client/?PID=FHI&&ACTION=?uninstallhelp"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionMinor" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"InstallLocation" = "%Program Files% (x86)\FreeHideIP"
"VersionMinor" = "0"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionBuild" = "6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"DisplayVersion" = "4.0.1.6"
"URLInfoAbout" = "http://client.free-hideip.com/client/?PID=FHI&&ACTION=?uninstall"
"NoModify" = "1"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionMajor" = "4"
"VersionRevision" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeHideIP]
"DisplayIcon" = "%Program Files% (x86)\FreeHideIP\FreeHideIP.exe,0"
"VersionMajor" = "4"
"UninstallString" = "%Program Files% (x86)\FreeHideIP\uninst.exe"

[HKLM\SOFTWARE\Wow6432Node\FreeHideIP]
"VersionTest" = ""
"(Default)" = "%Program Files% (x86)\FreeHideIP"
"CHL" = "c:\%original file name%.exe"

The process FreeHideIP.exe:964 makes changes in the system registry.


The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=;ftp=;https=;"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 01 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The Malware disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Free Hide IP"

The process CheckInstall.exe:3596 makes changes in the system registry.


The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FA B7 B3 8D 2A 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "FA B7 B3 8D 2A 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "FA B7 B3 8D 2A 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
59077f032a5e8339a86a7802d80d87c7c:\Program Files (x86)\FreeHideIP\FreeHideIP.exe
d6d62204a6565c2c957b268b1d68349fc:\Program Files (x86)\FreeHideIP\uninst.exe
5f6c243a10337a4269f994cd8b3a6137c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\flash_player_ax[1].exe
5f6c243a10337a4269f994cd8b3a6137c:\Users\"%CurrentUserName%"\AppData\Local\Temp\sgDEF74.tmp
c06e6e160f34ce092301bd2b29067f3fc:\Windows\SysWOW64\Macromed\Flash\Flash10e.ocx
678f50cbc5537150cfdcca7944130b6dc:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe
f43a50b2fd91e872089f50dac29bf4e9c:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
c06e6e160f34ce092301bd2b29067f3fc:\Windows\System32\Macromed\Flash\Flash10e.ocx
678f50cbc5537150cfdcca7944130b6dc:\Windows\System32\Macromed\Flash\FlashUtil10e.exe
f43a50b2fd91e872089f50dac29bf4e9c:\Windows\System32\Macromed\Flash\uninstall_activeX.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    _installB3E08.exe:4068
    %original file name%.exe:2528
    CheckInstall.exe:3596

  2. Delete the original Malware file.
  3. Delete or disinfect the following files created/modified by the Malware:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\System.dll (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\fpinstall.dll (20 bytes)
    C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe (750 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\UserInfo.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszC9E5.tmp\NSISArray.dll (804 bytes)
    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe (9320 bytes)
    C:\Windows\SysWOW64\Macromed\Flash\install.log (251985 bytes)
    C:\Windows\SysWOW64\Macromed\Flash\Flash10e.ocx (130085 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjC9D4.tmp (98019 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MX.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AO.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\images\about.png (2392 bytes)
    %Program Files% (x86)\FreeHideIP\res\hideip.dat (10 bytes)
    %Program Files% (x86)\FreeHideIP\lang\English.lan (13 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\DJ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GM.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SL.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KE.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PN.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BG.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MK.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ET.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KP.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AS.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\FI.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BT.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LY.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GN.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\FreeHideIP.exe (119955 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MS.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\US.PNG (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp (4 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ER.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ML.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\VN.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BH.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\DE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\200868112140701.png (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CZ.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PH.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\const.dat (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ZM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TD.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\Privacy Policy.url (65 bytes)
    %Program Files% (x86)\FreeHideIP\res\logo.png (7 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\VC.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MANN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AR.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Help.lnk (338 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MY.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SA.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NG.PNG (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\ioSpecial.ini (16099 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ZA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SI.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\HK.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\DM.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TL.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SCOTLAND.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TH.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BJ.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\VATICAN CITY.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\A.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CU.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SAINT HELENA.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GL.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MU.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MW.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\uninst.exe (1426 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LI.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\OM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AT.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BO.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CN.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TM.png (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AI.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PY.PNG (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\InstallOptions.dll (30 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TO.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IN.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NF.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IT.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PW.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GT.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\End User License Agreement.url (84 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IS.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\WALLIS AND FUTUNA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MG.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NA.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GD.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\FO.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\200868112138779.png (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MP.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ZW.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\UG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SO.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LV.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BD.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NR.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\WALES.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PE.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SM.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BI.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\RU.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BV.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\trialnotify.mht (1552 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SD.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\UA.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\DK.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MQ.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BY.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GI.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LK.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ES.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NU.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IQ.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Free Hide IP.lnk (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\HN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BM.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ID.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\FK.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\EC.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CV.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\RS.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TT.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LS.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AF.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LU.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PL.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GQ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PF.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SY.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MD.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Get Free Hide IP Pro.url (83 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\200868112135624.png (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MC.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\RO.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IO.PNG (4 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MT.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KZ.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PK.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\HR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\skins\default.skn (1856 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AW.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\QA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SB.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TV.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PT.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\DO.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\ffextension.xpi (4 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\HT.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\200868112139176.png (4 bytes)
    C:\Users\Public\Desktop\Free Hide IP.lnk (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LB.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CH.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CI.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\UK.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\WS.png (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AL.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\map.tpl (269 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KH.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BS.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\EG.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\UZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SK.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Privacy Policy.url (65 bytes)
    %Program Files% (x86)\FreeHideIP\End User License Agreement.url (84 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\JP.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GW.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GU.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SV.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NORTHERN IRELAND.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BB.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AU.PNG (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\modern-wizard.bmp (5520 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KY.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AM.png (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CL.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GE.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TW.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SG.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NI.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Uninstall Free Hide IP.lnk (816 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\PR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NO.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\200868112142681.png (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\HU.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CA.PNG (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\CheckInstall.exe (45705 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\ST.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CK.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\VE.PNG (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso2481.tmp (142800 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GY.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SC.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BW.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KI.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\FM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\EE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\YE.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AE.png (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\background.png (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\VU.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GH.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MH.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CF.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GP.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MO.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\DZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CY.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\UN.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NL.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\JM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\FJ.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BR.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\IL.PNG (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2492.tmp\modern-header.bmp (784 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\JO.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MV.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LT.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\NP.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\RW.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BF.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\TJ.PNG (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Hide IP\Free Hide IP Site.url (89 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CD.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\LC.png (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BZ.PNG (3 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CS.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MZ.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\GA.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\KW.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\SR.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\AD.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\BA.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\MM.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\UY.PNG (2 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\FR.PNG (1 bytes)
    %Program Files% (x86)\FreeHideIP\res\flag_short\CO.PNG (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\update[1].htm (1116 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\FreeHideIP\UserFlag.ini (22 bytes)
    C:\ProgramData\FreeHideIP\setting.dat (2153 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_installB3E08.exe (14071 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\flash_player_ax[1].exe (59131 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sgDEF74.tmp (62984 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623130235524.448410bc2ffd32265a08d72b795b18265828d
.rdata28672449646083.59163f179218a059068529bdb4637ef5fa28e
.data3686411048810243.26405975304d6dd6c4a4f076b15511e2bbbc0
.ndata1474564096000d41d8cd98f00b204e9800998ecf8427e
.rsrc18841619992204803.887588d81c20318317444b4ad81feddaf5f86

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://clientn.super-mp3-download.com/install/flash_player_ax.exe173.230.157.214
hxxp://clientn.free-hideip.com/map/getinfo.php?MagicWord=FHI69.164.212.52
hxxp://clientn.free-hideip.com/update/?ACTION=Update&39955&PID=FHI&SN=&MCD=00000000B48A115F&UNL=&LANG=English&DAY=0&RUNTIME=0&VER=04000106&SVER=0&WVER=6_1_Service Pack 1&WLANG=1033&CHL=64643765626338373462396362366133613864663866666465303837643261622E65786569.164.212.52
hxxp://clientn.free-hideip.com/client/?PID=FHI&ACTION=installed&IVER=4.0.1.6&ILAN=69.164.212.52
hxxp://free-hideip.com/free-hide-ip-installed.html
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://pagead46.l.doubleclick.net/pagead/show_ads.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/grid-12.css
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry.css
hxxp://free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style-ie6.css
hxxp://free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style.css
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla.css
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry-ie6.css
hxxp://www.trialpay.com/mi/?rc=v&ri=1379108&p=Hu5zu11&t=9ahOMV9&type=img199.68.156.31
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/joomla.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/joomla-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/suckerfish.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/style2.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/style2-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/demo-styles.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/template.css
hxxp://d261sv3xac0f7i.cloudfront.net/store/1731321/18800433.gif54.230.45.143
hxxp://free-hideip.com/templates/rt_dominion_j15/css/template-ie6.css
hxxp://free-hideip.com/templates/rt_dominion_j15/css/typography.css
hxxp://free-hideip.com/components/com_jcomments/js/jcomments-v2.1.js?v=2
hxxp://free-hideip.com/components/com_jcomments/libraries/joomlatune/ajax.js
hxxp://free-hideip.com/media/system/js/mootools.js
hxxp://free-hideip.com/media/system/js/caption.js
hxxp://free-hideip.com/plugins/system/rokbox/rokbox.js
hxxp://free-hideip.com/plugins/system/rokbox/themes/light/rokbox-config.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-ie6menu.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-buildspans.js
hxxp://free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/belated-png.js
hxxp://free-hideip.com/images/stories/app/product2/box/box200.png
hxxp://free-hideip.com/images/stories/app/common/button/download.png
hxxp://pagead46.l.doubleclick.net/pagead/js/r20141209/r20141212/show_ads_impl.js
hxxp://free-hideip.com/images/stories/app/common/button/buynow.png
hxxp://free-hideip.com/images/stories/app/product3/box/box200.png
hxxp://free-hideip.com/images/stories/app/package1/box/box180_fhi.png
hxxp://www.gstatic.com/pub-config/ca-pub-2137902362367109.js173.194.113.215
hxxp://free-hideip.com/images/stories/app/common/button/buynowpp.gif
hxxp://pagead46.l.doubleclick.net/pagead/html/r20141209/r20141212/zrt_lookup.html
hxxp://free-hideip.com/modules/mod_analytics/gatr.js
hxxp://pagead46.l.doubleclick.net/pagead/osd.js
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://www.free-hideip.com&dtd=270
hxxp://pagead46.l.doubleclick.net/pagead/js/r20141209/r20141212/expansion_embed.js
hxxp://free-hideip.com/templates/rt_dominion_j15/images/backgrounds/style2/main-bg2.png
hxxp://sa.software-pay.com/sa/imgs/banner_holiday_halfprice_fhi.jpg173.230.138.89
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/style2/header-bg-low.png
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://www.free-hideip.com&dtd=404
hxxp://free-hideip.com/images/stories/app/home/logo.png
hxxp://pagead46.l.doubleclick.net/pagead/images/nessie_icon_tiamat_white.png
hxxp://pagead46.l.doubleclick.net/pagead/js/r20141209/r20110914/abg.js
hxxp://free-hideip.com/templates/rt_dominion_j15/images/menus/style2/topmenu-daddy.png
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://t3.gstatic.com/favicon?q=tbn:ANd9GcSlGZwIY7CG1hRqkjjqDVrr1EIcXRVy4ZHks-_ST_Ki1xol2xUZky_UN4RJumq9P5aerQCoS5ut8se_LPXXYm_BaAUUQ3X2173.194.113.208
hxxp://googleapis.l.google.com/css?family=Slabo 27px&lang=en
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/light/bodydiv-low.png
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=288397215&utmhn=www.free-hideip.com&utmcs=utf-8&utmsr=1716x901&utmvp=1700x804&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=10.0 r45&utmdt=Free Hide IP Installed | Free Hide IP&utmhid=2086676748&utmr=-&utmp=/free-hide-ip-installed.html&utmht=1420601563639&utmac=UA-16601039-8&utmcc=__utma=56730365.308850550.1420601563.1420601563.1420601563.1;+__utmz=56730365.1420601564.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1655947318&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAQAAAAE~
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/style2/module-title-icon.png
hxxp://t3.gstatic.com/favicon?q=tbn:ANd9GcReSaXCC2MAHzTS01g7TjEwIe8oX3B4FmQweFpVjdKFz1OlANtg9MkAb1JsXMSuWpg173.194.113.208
hxxp://free-hideip.com/templates/rt_dominion_j15/images/body/style2/footer-div.png
hxxp://pagead46.l.doubleclick.net/pagead/images/ad_choices_i.png
hxxp://pagead46.l.doubleclick.net/pagead/images/ad_choices_en.png
hxxp://pagead46.l.doubleclick.net/pagead/drt/s?v=r20120211
hxxp://www.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff173.194.113.215
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e94853d51d9631
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0059695b36fcc39d
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDFpSHzfyfGc
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHj3S83xBK9k
hxxp://pagead46.l.doubleclick.net/bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js
hxxp://free-hideip.com/favicon.ico
hxxp://pagead46.l.doubleclick.net/activeview?id=osdim&avi=BFggm8KisVKv1JvGjiga8oIDgBgD1ubXv7QEAABABOAHIAQHIA8MEqBOAAQ&ti=1&adk=180657799&p=546,395,606,863&tos=1230,0,0,0,0&mtos=1230,1230,1230,1230,1230&rs=1&ht=0&tfs=1527&tls=2757&fp=client=ca-pub-2137902362367109&url=http%3A%2F%2Fwww.free-hideip.com%2Ffree-hide-ip-installed.html&correlator=4583063697160&eid=317150304%2C42631034&oid=3&afp=&output=html&slotname=8429118295&flash=10.0.45.2&dt=1420601562998&adx=395&ady=546&ifi=1&tdl=1747&abd=3-0-4&r=u&bs=1700,804&bos=1724,865&ps=1716,1440&ss=1716,901&tt=1016&pt=1742&deb=1-2-2-3-7-3&tvt=1231&iframe_loc=http://www.free-hideip.com/free-hide-ip-installed.html&is=468,60&uc=4
hxxp://a1284.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1284.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1284.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4a860dfad991908a
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEG4KXix8eJvaF19Xf/1VSWE=
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEA+oSQYV1wCgviF2/cXsbb0=
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEAUR6vhXniZivmIt5a4M1Ag=
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/style2-ie6.css66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=23.43.139.27
hxxp://pagead2.googlesyndication.com/pagead/show_ads.js173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/joomla-ie6.css66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=23.43.139.27
hxxp://www.free-hideip.com/images/stories/app/common/button/buynowpp.gif66.228.40.66
hxxp://www.free-hideip.com/plugins/system/rokbox/themes/light/rokbox-config.js66.228.40.66
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0059695b36fcc39d88.221.132.177
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl88.221.132.166
hxxp://www.free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style.css66.228.40.66
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4a860dfad991908a88.221.132.177
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/belated-png.js66.228.40.66
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar88.221.132.190
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla.css66.228.40.66
hxxp://www.free-hideip.com/images/stories/app/home/logo.png66.228.40.66
hxxp://www.google-analytics.com/ga.js173.194.113.192
hxxp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff173.194.113.207
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=23.43.139.27
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://www.free-hideip.com&dtd=404173.194.113.218
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://www.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://www.free-hideip.com&dtd=270173.194.113.218
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEA+oSQYV1wCgviF2/cXsbb0=93.184.220.29
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==23.43.139.27
hxxp://t1.gstatic.com/favicon?q=tbn:ANd9GcReSaXCC2MAHzTS01g7TjEwIe8oX3B4FmQweFpVjdKFz1OlANtg9MkAb1JsXMSuWpg173.194.113.212
hxxp://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/style2/module-title-icon.png66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry-ie6.css66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/backgrounds/style2/main-bg2.png66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/osd.js173.194.113.218
hxxp://crl.verisign.com/pca3.crl23.43.133.163
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEAUR6vhXniZivmIt5a4M1Ag=93.184.220.29
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=93.184.220.20
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHj3S83xBK9k173.194.113.206
hxxp://www.free-hideip.com/favicon.ico66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/suckerfish.css66.228.40.66
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=288397215&utmhn=www.free-hideip.com&utmcs=utf-8&utmsr=1716x901&utmvp=1700x804&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=10.0 r45&utmdt=Free Hide IP Installed | Free Hide IP&utmhid=2086676748&utmr=-&utmp=/free-hide-ip-installed.html&utmht=1420601563639&utmac=UA-16601039-8&utmcc=__utma=56730365.308850550.1420601563.1420601563.1420601563.1;+__utmz=56730365.1420601564.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1655947318&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAQAAAAE~173.194.113.192
hxxp://pagead2.googlesyndication.com/bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/menus/style2/topmenu-daddy.png66.228.40.66
hxxp://clients1.google.com/ocsp173.194.113.206
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/template.css66.228.40.66
hxxp://crl.geotrust.com/crls/secureca.crl23.43.133.163
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=23.43.139.27
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-ie6menu.js66.228.40.66
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDFpSHzfyfGc173.194.113.206
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/js/gantry-buildspans.js66.228.40.66
hxxp://www.free-hideip.com/components/com_jcomments/libraries/joomlatune/ajax.js66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/template-ie6.css66.228.40.66
hxxp://www.free-hideip.com/images/stories/app/common/button/download.png66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/grid-12.css66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/images/ad_choices_en.png173.194.113.218
hxxp://ocsp.verisign.com/23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl88.221.132.166
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/gantry.css66.228.40.66
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl88.221.132.166
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/style2/header-bg-low.png66.228.40.66
hxxp://www.free-hideip.com/media/system/js/caption.js66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/style2/footer-div.png66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/images/nessie_icon_tiamat_white.png173.194.113.218
hxxp://www.free-hideip.com/images/stories/app/product3/box/box200.png66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=23.43.139.27
hxxp://www.free-hideip.com/images/stories/app/package1/box/box180_fhi.png66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/js/r20141209/r20141212/show_ads_impl.js173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/joomla.css66.228.40.66
hxxp://www.free-hideip.com/media/system/js/mootools.js66.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/js/r20141209/r20141212/expansion_embed.js173.194.113.218
hxxp://www.free-hideip.com/plugins/system/rokbox/themes/light/rokbox-style-ie6.css66.228.40.66
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEG4KXix8eJvaF19Xf/1VSWE=23.43.139.27
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/typography.css66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/lib/gantry/css/joomla-ie6.css66.228.40.66
hxxp://www.free-hideip.com/templates/rt_dominion_j15/images/body/light/bodydiv-low.png66.228.40.66
hxxp://www.free-hideip.com/images/stories/app/product2/box/box200.png66.228.40.66
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e94853d51d963188.221.132.177
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=23.43.139.27
hxxp://client.free-hideip.com/client/?PID=FHI&ACTION=installed&IVER=4.0.1.6&ILAN=69.164.212.52
hxxp://www.free-hideip.com/images/stories/app/common/button/buynow.png66.228.40.66
hxxp://www.free-hideip.com/plugins/system/rokbox/rokbox.js66.228.40.66
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl88.221.132.166
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=108.162.232.197
hxxp://pagead2.googlesyndication.com/pagead/images/ad_choices_i.png173.194.113.218
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US63.245.215.110
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/demo-styles.css66.228.40.66
hxxp://www.free-hideip.com/components/com_jcomments/js/jcomments-v2.1.js?v=266.228.40.66
hxxp://pagead2.googlesyndication.com/pagead/js/r20141209/r20110914/abg.js173.194.113.218
hxxp://www.free-hideip.com/templates/rt_dominion_j15/css/style2.css66.228.40.66
hxxp://fonts.googleapis.com/css?family=Slabo 27px&lang=en64.233.161.95
hxxp://www.free-hideip.com/free-hide-ip-installed.html66.228.40.66
hxxp://googleads.g.doubleclick.net/pagead/html/r20141209/r20141212/zrt_lookup.html173.194.113.218
hxxp://www.free-hideip.com/modules/mod_analytics/gatr.js66.228.40.66
safebrowsing-cache.google.com173.194.113.196
safebrowsing.google.com173.194.113.197
www.google.com173.194.113.209
services.addons.mozilla.org63.245.216.134
ieonline.microsoft.com204.79.197.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /css?family=Slabo 27px&lang=en HTTP/1.1

Accept: text/css

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: fonts.googleapis.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Wed, 07 Jan 2015 03:33:04 GMT

Date: Wed, 07 Jan 2015 03:33:04 GMT

Cache-Control: private, max-age=86400

Content-Length: 252

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02

@font-face {. font-family: 'Slabo 27px';. font-style: normal;. font-weight: 400;. src: local('Slabo 27px'), local('Slabo27px-Regular'), url(hXXp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff) format('woff');.}.....

GET /css?family=Slabo 27px&lang=en HTTP/1.1

Accept: text/css

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: fonts.googleapis.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Wed, 07 Jan 2015 03:33:04 GMT

Date: Wed, 07 Jan 2015 03:33:04 GMT

Cache-Control: private, max-age=86400

Content-Length: 252

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02

@font-face {. font-family: 'Slabo 27px';. font-style: normal;. font-weight: 400;. src: local('Slabo 27px'), local('Slabo27px-Regular'), url(hXXp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff) format('woff');.}.HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-Origin: *..Expires: Wed, 07 Jan 2015 03:33:04 GMT..Date: Wed, 07 Jan 2015 03:33:04 GMT..Cache-Control: private, max-age=86400..Content-Length: 252..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:quic,p=0.02..@font-face {. font-family: 'Slabo 27px';. font-style: normal;. font-weight: 400;. src: local('Slabo 27px'), local('Slabo27px-Regular'), url(hXXp://fonts.gstatic.com/s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff) format('woff');.}...

GET /plugins/system/rokbox/themes/light/rokbox-style.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164d7-b19-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2841

Connection: close

Content-Type: text/css

/* CSS Guideline to style rokbox */./* When adding your own theme,make sure to replace "custom" with your theme name */./* use lowercase characters and no space. For example,we name our theme "mytheme" */./* we replace every "rokbox-light" with "rokbox-mytheme" */./* Wrapper,the very outside container of rokbox */.#rokbox-wrapper.rokbox-light{}.#rokbox-wrapper .clr {clear:both;}.#rokbox-close{height:30px;width:20px;display:block;background:url(close.png) 0 0 no-repeat;clear:both;}.#rokbox-close span{display:none;}./* Table for border look and feel */.#rokbox-top.rokbox-left{background:url(tl.png) 0 0 no-repeat;clear:both;}.#rokbox-top .rokbox-right{background:url(tr.png) 100% 0 no-repeat;}.#rokbox-top .rokbox-center{background:url(top.png) 0 0 repeat-x;height:20px;margin-left:20px;margin-right:20px;}.#rokbox-middle {overflow: hidden;}.#rokbox-middle.rokbox-left{background:url(left.png) 0 0 repeat-y;clear:both;}.#rokbox-middle .rokbox-right{background:url(right.png) 100% 0 repeat-y;}.#rokbox-middle .rokbox-center{background:#fff;margin-left:20px;margin-right:20px;}.#rokbox-bottom.rokbox-left{background:url(bl.png) 0 0 no-repeat;}.#rokbox-bottom .rokbox-right{background:url(br.png) 100% 0 no-repeat;}.#rokbox-bottom .rokbox-center{background:url(bottom.png) 0 0 repeat-x;height:20px;margin-left:20px;margin-right:20px;}./* Object/Image container */.#rokbox-container{}./* Spinner class that gets added when loading content and removed when loaded */.#rokbox-container.spinner{background:url(ajax-loader.gif) 50% 50% no-

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=409185, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 21:14:33 GMT

Expires: Sun, 11 Jan 2015 21:14:33 GMT

Date: Wed, 07 Jan 2015 03:37:01 GMT

Connection: keep-alive

0..........0..... .....0......0...0........6?s....V....OlL".O..20150104211433Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......l$.%t...............20150104211433Z....20150111211433Z0...*.H.............P.<...'A.!..?... .T T..0... .K... #.Z..X.@0u@....Q...)`...z.fq........L:T.........7.I....3.}.5&.b.c..DP....O...~....K....N....ny.....`..Z....{...........f..n....j.h..A*...7T._.. .....q....6.5$|..=.....t.)....,..B...8...*.O....SM6....VqP.....e...i7Y....Q-.....#0...0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{(..t....2.Vf.....&;6).i*FK....W@....F....jnb.w._p.E.6.|.mk....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...

<<< skipped >>>

GET /images/stories/app/product2/box/box200.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:32:23 GMT

ETag: "1689d-97c7-50b147f16b7c0"

Accept-Ranges: bytes

Content-Length: 38855

Connection: close

Content-Type: image/png

X-Pad: avoid browser bug

.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<...iIDATx.....$e.6...:.......sf..!. ...0...u..u.....au..\e..kX.DD\P..a.af..&.|s......9U.....YE@..z.owuuu.y..<....Jk..V.....z%.9.4.N...B..?b..,.........y....a.6......C..axx.._~...7,<.Eo...7n....~..>l.,....,..;a.El...1.-."...ail....q.EHL...;WA;.&.........k...O!...l.......W^.D_....^.<.\..q.=......E...a.[..*Z.)..`....m..yg.....m..G....Fm8#....iL?...c.Gwn..Z4O..l.!..l.......c.......1..qx..4.\..(.... .F]s.r}....@...psC.9Y.e.h..|xm)..v/..{...8..<.3. =i"......a&..ji@...C=Ch<.d.5...oA...0...g..kv..e.L....N...R.....`h ...6d.z..@...v.<9....P3u....Lo.....;.S..U.#....2....W.t.._c$.Pi..t..N..;..lT...........w..F.z.^Y[. ...."K......--Wn.t..CI...Q..L{Lv...*U...)....<..m..y .....=.....lW.....2.*@..A.7.X.#............x.|$>.......].I..q..=.D*2.u............Z.......S.js...hK.6....8..]G...i..T.S.._.^...F..n..H&.s.C....;...{.jJ#..D....i.e.pI..i..[...r...,O.L.u..\.8...5..:.....\.@..:.r.....o'p<...Ve....a.V!S...#BAb..ysCC...->F^..\..`7,.....z....#.e!^......z$..0.Q.F..#Qh.....C..)....\.<n.ECGrJ..g.1.4.OnC6byE#92..K...,)p.....}....y......i. /......D...d...(..,..(.-.\.. ..7r..........j...1.mH#.H!.L.J'...A....d..a..M(K.....]tr6E.A......Z.5....G......g..B.7....y.....<.:.....W....NF..T-....v#.....{#...h...Q.).k.!_.M.H... 6..D....z..7./X.#0.....=.......8..:n. .....9.H}.....d....H"N...v.XyE.....s.cY...L.4t...Iu..'1.s.E:=.8u.I......_eFb.R.MG......M'V..U....p..1.R."..Iz...E.Q.^.D6.#..t......J...N.....,.-..F`v.`..a.>U@.:..k.....0...

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/css/grid-12.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e4-b72-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2930

Connection: close

Content-Type: text/css

/**. * @package..Gantry Template Framework - RocketTheme. * @version..2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */../* 12 Grid */..rt-grid-1, .rt-grid-2, .rt-grid-3, .rt-grid-4, .rt-grid-5, .rt-grid-6, .rt-grid-7, .rt-grid-8, .rt-grid-9, .rt-grid-10, .rt-grid-11, .rt-grid-12 {display: inline;float: left;position: relative;margin-left: 10px;margin-right: 10px;}..rt-container .rt-grid-1 {width: 60px;}..rt-container .rt-grid-2 {width: 140px;}..rt-container .rt-grid-3 {width: 220px;}..rt-container .rt-grid-4 {width: 300px;}..rt-container .rt-grid-5 {width: 380px;}..rt-container .rt-grid-6 {width: 460px;}..rt-container .rt-grid-7 {width: 540px;}..rt-container .rt-grid-8 {width: 620px;}..rt-container .rt-grid-9 {width: 700px;}..rt-container .rt-grid-10 {width: 780px;}..rt-container .rt-grid-11 {width: 860px;}..rt-container .rt-grid-12 {width: 940px;}../* Grid Push */..rt-container .rt-push-1 {left: 80px;}..rt-container .rt-push-2 {left: 160px;}..rt-container .rt-push-3 {left: 240px;}..rt-container .rt-push-4 {left: 320px;}..rt-container .rt-push-5 {left: 400px;}..rt-container .rt-push-6 {left: 480px;}..rt-container .rt-push-7 {left: 560px;}..rt-container .rt-push-8 {left: 640px;}..rt-container .rt-push-9 {left: 720px;}..rt-container .rt-push-10 {left: 800px;}..rt-container .rt-push-11 {left: 880px;}../* Grid Pull */..rt-container .rt-p

<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=589437, public, no-transform, must-revalidate

Last-Modified: Tue, 6 Jan 2015 23:14:45 GMT

Expires: Tue, 13 Jan 2015 23:14:45 GMT

Date: Wed, 07 Jan 2015 03:33:05 GMT

Connection: keep-alive

0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....20150106231445Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:v....20150106231445Z....20150113231445Z0...*.H.............|..5.B..A.Zz}.8...S....Eo.>...S.J..........hJb.....z.....I.ob q.j..!..%z../F.....I..r..es..d ..<eF.5\l.h....1<....].ir....ue..~(0..Emv{K/M)*.@hP...ZR....L.y0].a..r................U.t.W>...l.R.23..-4KX85......6...q.?.."..X..dL,....(...7..n..<{u. .A./?...>q<....0...0..}0..e........:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTrust Global CA TGV OCSP Responder 30.."0...*.H.............0............\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd.....x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x..............6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830...*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a...nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7...=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v.....\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%....

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/js/belated-png.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:57:22 GMT

ETag: "16975-1b6c-50b14d86fa480"

Accept-Ranges: bytes

Content-Length: 7020

Connection: close

Content-Type: application/x-javascript

/**.* DD_belatedPNG: Adds IE6 support: PNG images for CSS background-image and HTML <IMG/>..* Author: Drew Diller.* Email: drew.diller@gmail.com.* URL: hXXp://VVV.dillerdesign.com/experiment/DD_belatedPNG/.* Version: 0.0.8a.* Licensed under the MIT License: hXXp://dillerdesign.com/experiment/DD_belatedPNG/#license.*.* Example usage:.* DD_belatedPNG.fix('.png_bg'); // argument is a CSS selector.* DD_belatedPNG.fixPng( someNode ); // argument is an HTMLDomElement.**/..var DD_belatedPNG={ns:"DD_belatedPNG",imgSize:{},delay:10,nodesFixed:0,createVmlNameSpace:function(){if(document.namespaces&&!document.namespaces[this.ns]){document.namespaces.add(this.ns,"urn:schemas-microsoft-com:vml")}},createVmlStyleSheet:function(){var b,a;b=document.createElement("style");b.setAttribute("media","screen");document.documentElement.firstChild.insertBefore(b,document.documentElement.firstChild.firstChild);if(b.styleSheet){b=b.styleSheet;b.addRule(this.ns "\\:*","{behavior:url(#default#VML)}");b.addRule(this.ns "\\:shape","position:absolute;");b.addRule("img." this.ns "_sizeFinder","behavior:none; border:none; position:absolute; z-index:-1; top:-10000px; visibility:hidden;");this.screenStyleSheet=b;a=document.createElement("style");a.setAttribute("media","print");document.documentElement.firstChild.insertBefore(a,document.documentElement.firstChild.firstChild);a=a.styleSheet;a.addRule(this.ns "\\:*","{display: none !important;}");a.addRule("img." this.ns "_sizeFinder","{display: none !important;}")}},readPropertyChange:functi

<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/style2/module-title-icon.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:05 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:37 GMT

ETag: "1687a-774-50b147c58d040"

Accept-Ranges: bytes

Content-Length: 1908

Connection: close

Content-Type: image/png

.PNG........IHDR.............V..W....sBIT....|.d.....pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2009-11-02T15:30:41Z</xap:CreateDate>. <xap:ModifyDate>2009-12-30T07:58:27Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>. . . ;.S.....tEXtSoftware.Adobe Fireworks CS3..F.....tEXtCreation Time.12/11/09........IDAT8....O.A.......@[(.D..H...D.G..A.{.........'=pS.O&&&J... (~ .6.Z...v....g..4.........<..3C.GzH.![A&.O/f..wQhoJ....uA2K.Z....k...... .R.(...V.t.p....u........j...%k|.{.d......[.G.)PW."..>S.2_.....Gte..7.s.z.K....w......F...r

<<< skipped >>>

GET /templates/rt_dominion_j15/css/joomla-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:12 GMT

ETag: "1696f-399-50b14d4438700"

Accept-Ranges: bytes

Content-Length: 921

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.2 December 9, 2009. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2009 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */..rt-joomla .rt-headline {margin-bottom: 15px;}..rt-joomla .rt-articleinfo {width: 100px;}.#roksearch_results .roksearch_even {zoom:1;}.#roksearch_results .container-wrapper {position:relative;zoom:1;width:400px;}.#roksearch_results .container-scroller {position:relative;zoom:1;}.#roksearch_results .container-scroller .page .roksearch_odd, #roksearch_results .container-scroller .page .roksearch_even {zoom:1;z-index:1000;}.#roksearch_results .container-scroller span.small {bottom:6px;right:10px}.body .roknewspager-comments div.roknewspager-div {zoom: 1;}.body .roknewspager-comments ul.roknewspager li {display: inline;}...

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272609

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:33:03 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive

d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._......y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3...I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8....2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/.@.mJg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u..yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. .k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w.......&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i......(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q..nZ@..|....@l4....z...f..ll..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.....u.$...&}.......Od.. ....".......;[.7@.......n....h$.n.[...B?n......$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....9...I.m IW..a1.$u8..o..@........h<...i.v./-.\-......d..~h..H. ..6.M..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$...s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3...1...'Ki../...n.A.........cs...0n@Zh.W....B..<.M$..2..|.v.n/6...V........lE/......w8-........-R..\e...WA...756.H.]/d.....-......'......... ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._...c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......

<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1200000-1499999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272549

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:34:03 GMT

Content-Range: bytes 1200000-1499999/47994403

Content-Length: 300000

Connection: keep-alive

,................L'...UM*..b...."..A.(.P`*.v..f...1.%.`.Xu...X# .d .". .B2!.J..U....Z1....ff.Q..)........v.S.B.D.. .U@X..`.AN....A.F.Q.E..U.4..#=.Vy.b$..H.x...J..V&.Z.q...d....<.v.Q..*..p...,.1`%.Q.........H.E..k*..Uj ..c ...S..I.Y....gz.aR.. .j...<\.xxE)..t.B..M.R.|..(...,.Q..QD[_>.c..YcaA"X!T:...[j\...;2J...3.4.{.Mm.,..Q2....t<.Jw7..@.al .......U .3....<....e%....R.....K.S=.3(.........K.>.|.%Q<..,..H...X(. ....zg... tAh..Q...,...X1.H.E]kR.V.Q..q,ol.....Z..Hc....X!.R....1mT...J.E..U.A#....mU...U.....s5.1 ...V2%h.c..........S.....b.&.*YAj)G...F..#2....U.....C...d..ihR. .D`..J[m..Y.e....7Vv...D#1...X.A,Z...|.t..KK..X.Z..|.c2..x........X2...Q....%......a.......-.L...S......`...c#....V.... .`..[eB...1Q.b.....w..b....,.dr.Fg..w.b[.....4(.e,6n.]..y...VWA....e.(T....e.P."cm..[......~G...l....h.f|..[[.m..8....%\K{aH...6...Ls,....h.2h..p..aHR.K.b..DHu^.u.....W.b/k..l....'2.4M)M.Nhq..L.-...e..^d...e.2..j`..B...%X1..6.-X.....[...b.. ....a....Q.w..P.....6...eaG.Llb0Q.;.f....h!Z...AE........._..j.4.Y...hQ......)..H..B..K=..............$}O.[.......P^.p.6....G.T&.9...mw.j...F!..'O........K...M.?.....J..y....c"......@j4_x.#.......&.....8.n......r=..$_..)?e.u.OB.'....V.r.....Z,ur..O....R..1...@....9p....1........QTK.'.."I...S[............%e.........xo/..5.a-=..t.Em.I.I...Aq..@.v1\..1.-..vAz...UQ.V.[L..... qEQ.,.._ET/1..#.wX.-.1..(./.#.c....G..chR....%..X.]........q....]N.F.Q...\Y..Q.I...[..o_..0..,x*.-y].t2...FB0....c..f.i.....w29..;:-.....u.......zXKM.].?.........3Fsll|.l.q...7.'..m.......B[....a......:..

<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1500000-1799999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272489

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:35:03 GMT

Content-Range: bytes 1500000-1799999/47994403

Content-Length: 300000

Connection: keep-alive

..d'...oj.H.u{...yO.W.f...hUj..@q...1~..g}.O......._./..... .....H.kk...u..g.<.`.M\.$C.......[.....Q|..Vzy...s4r..0&....9..9I.}@.m Y....9..1......{..Y...).................&.KWo._;d..o.;.9.....C..W.L...A..l.e5uz...m.R......y..dA..?..o.B:....CH............p.....>..=s...\.\.Ffw3.....B....].Y\../0...h..........u@..L!..... b..a%*A...|.)#...T..;..[.T.b.O.....".`....^Uew5...t....N..[ ..).c%.J4R.}E...C..H./.0Y.R.._;K.$$>...gV.......!8.MS.fhv......fW...9.1....0z......_a.O.2.....@W^da. G0...3.K.$...N....j....F..O.........f...h5d.....@.I.$u..Y..../..I....elx..#~.Wub.=v...1.B..U.`vk......;..dE....%I.K...4........Cs.i..;.i..$j)..b0...W`....o2p._w5.......J&0..X...6)M....t."..P>bN.(3W...h.U.fBY:...]h...rF....yv.5....4Ih.*....C.........>B.$..K._.W.1C[..>d..\...l.mE.f..... fw.Uv..,......YsL\r.l,h..=..d.....{D........ .c.h.,....`u7.$/...X.~.[|.V....K..2d}*..Fj.E<.V....9...A.......k)..$..S.Wo.'..Y..]*..U.q,..&..W....qZ...c`...t.-d.w.29..6D.z.M....i.N.o.....e._..%i..M.....Y. .b.."(.4.X..z..T".....:.i...3.T..1..B.E..)...0.g..Z<9!"...) .>...t/......grw}..y...;.q..).........=....X....flIZ...[..B^.ex..,......].....\.u}....=.....Q@..4n<@.A.e!...Zn!.".>-....9........H@".C.h-=Vf.x......'.|...HD$..V.J.V.....s.e..........@@......kF.......b. !`..6...V....B.....:A..u..........|.f.....g...F..$..mI..{V......Y... ...i;.Dn.B*i.....?8..!.../~^g..5r.0.C...n=P..K...k>....x.6...A.7<j.|..&.c.).a...=....m8e.RD...H@-.~.F...0....`.p...|..<\W6q.....M ..T.5.4..Q;..#.m.d.SU...KI..:..}...r......01...Q.......<..m.

<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1800000-2099999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272429

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:36:03 GMT

Content-Range: bytes 1800000-2099999/47994403

Content-Length: 300000

Connection: keep-alive

.......<".......w..b[TC.... ....[u-.eS.9.......}..o'.O..Z....,..~.5.s.........z<.XP?.Z(..=#.....8t..:q....bR..:..I..<f.!O.U..^/.....w.Z.q#%.k....J......*.o.&.Yb?..n..._.E^...h..j.$-........k.......4{.^..1.>..i0....fJ..m}.\...Vt...Bz..........d.W.../..Z.l.6....v*.....H.=.h.........vH.....Zs....6O.Lc}o$..%......H..G..myQ...D...T...9..f.$....l...8.>..|...C.^ ..B01..........!.|..F.I}.U..6..@L....]..W.Qr1.......cI.4'(.b..O.'D1...l4....y.............y..c....m5.{.7~...;a.nQ..cBk{X...............o;.`....K..SR...........S.xR.}Xb.....~q..Y.R.[8....9...o.c.I.a..4.zc.i.S.~.^......uI.. ...(u..[.............6.K..}.$T..x......a{..}...{i#.......P...........?......!..Z.D4..Jr....."l7Nl..x.O.^..!v.........u.B:.i..#\gcR.....fB.$?..5.....$.......ll\...Z....V>.a. S...o.Gw..B..........ny!{{.tAo.(v.S...bR......5...M.b.(Z.T.:.%V.=Z.e11).B76.....r....g..z_d..C 6.;..]..........:T....\-!....j.......\.Q6..di....s..q.~.WU.......y..lgvH.@C....R`.....0..$....B..C0`8).0dtB^. rV..6h ..u..2......... .b...Q .1...r..h......z:..........^...|}.....6...R..8..../......&..!A.....c.=..C.....m..I..........W...G....tN.k.5o6.*.s...3..............U<...c....1....j.~.....$.<.. .}.K6.t@......-...X........V.'.hBA....s.~..O..w...q..A!...qf.......h...r.y.h..=..j..57......U.D;.'...r|.9[...].?..._.......p/@....nR....0..U.*..i.E.KX......(R/....5...3.@/T`z..4./.v..-..Q|........=.....n/..e.v.......e."...AIAS........c`.....#-..4...7..O.%.m.....u.S*...........,. 2L....v.z..?.j....pc......W...........Y..*...Ev........w[......@....U.tX=..y.^)(`.7(

<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=2100000-2399999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=272369

Expires: Sat, 10 Jan 2015 07:16:32 GMT

Date: Wed, 07 Jan 2015 03:37:03 GMT

Content-Range: bytes 2100000-2399999/47994403

Content-Length: 300000

Connection: keep-alive

................y.h"-P. ..=x..#.f?j\B........w......U}..J<X....8....$(...o6X$.....f....S...8........yF...|..(.s&.{SC.1Y6T..............z..@..`j.l.....c..N..F.4-.=z..e.J..S...&8..b.....O4...Z........ ..k.F..a*.. ....p.......p..R>....[....9..$ ..`_....;b.....F.6..h.. .....n....i.....f.q5..i...X.w.z....,.. {.4.......l.Q.?....-"...6..a.=.Z.H9..'K.p..Ww..w;.../}.u...c...4.BBP...t.....1..Yv1S...c...S<umz...Q..i.f....&..o.o...8@.....~..m...m6....A..R.T.>.`J2o.e.....|Q....a,-.f..Z..v...Zf.@.I..uV]....k.....A.....(.I.1..,3b.N........!Z....>r...KrP..O..8.....I..$.S.2".2...-..)...~.!.X.u.%.....g..d.QlweV.].....f.Cf.F.;..........`zA.jl.@y.=o..Hb.%..h..3S5.1....eI...[Z.)Du..O.S.u....H.,..{..Ymu.........o.#........\$..........$......y.[.J..K..S.F.t....../.{.....I.)...Q.e........e.... .eB.8.-..!/S.....o.....Z..........<;7..Ld.O.hc8.j,....`'.....2..\..-.q..&J.oKh....*.(....X..V.......2hp. R3.$<.T.z.tdfPd2.......CX. ...../../.^k..Zx.HP.}..ty....O..7.Z.....}.T].4>.h...MA...0'..4..Y..y!.....r6.o.E......C.@..!..H.N.ZHX...!.6..D?..]....p)..f.P....:BP~.)....jT..X.@Gw...n.......:.%"71!.0..g.k[Ow.>..U.......Q.f.0HM.5g!Y...F.....KR..j.S...I8f.......N......a,.5.......!...p.1..y.-....a.............F..Y..MX3X...BD7..j. d.B"d...`.../t......,.r...8..Ol$EwK....Fz.>H..R.-......I.....9>k.....C..'g.$I...x.!C..-V..U.Y..H....8-n)..W.k.@"0.....K.Akc....5..v.l.aO..9.x`[..K..^......)W.W^>q.T..4Q......@g.@..A...R....lr.c....'`.......L............u..T^>......N.....8 #.?.[....rKH..^V..,6..*..Ua.j.`.D.<2W..b$..-

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/js/gantry-buildspans.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "164f4-320-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 800

Connection: close

Content-Type: application/x-javascript

/**. * @package..Gantry Template Framework - RocketTheme. * @version..2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */ ..var GantryBuildSpans=function(g,j,k){(g.length).times(function(i){var e="." g[i];var f=function(a){a.setStyle('visibility','visible');var b=a.getText();var c=b.split(" ");first=c[0];rest=c.slice(1).join(" ");html=a.innerHTML;if(rest.length>0){var d=a.clone().setText(' ' rest),span=new Element('span').setText(first);span.inject(d,'top');a.replaceWith(d)}};$$(e).each(function(c){j.each(function(h){c.getElements(h).each(function(b){var a=b.getFirst();if(a&&a.getTag()=='a')f(a);else f(b)})})})})};..

GET /plugins/system/rokbox/themes/light/rokbox-config.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "164f5-a26-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 2598

Connection: close

Content-Type: application/x-javascript

/* All the presets options are the custom ones */..var rokbox;.window.addEvent('domready', function() {..rokbox = new RokBox({...'theme': 'light', // this string must match the theme folder name (string, no space, lowercase)...'transition': Fx.Transitions.Quad.easeOut, // Transition to use when opening RokBox...'duration': 400, // Duration of opening RokBox Effect (integer, milliseconds)...'chase': 50, // Chase to use for the animation. works only for growl, see next line. (integer)...'frame-border': 20, // Width of each border if any (integer, pixels)...'content-padding': 0, // Padding of internal content wrapper (integer, pixels)...'arrows-height': 35, // Height of arrows div (integer, pixels)...'effect': 'growl', // Type of effect to use. Presets are: 'quicksilver', 'growl', 'explode'...'captions': 1, // Whether to enable or disable captions (boolean, 1 or 0)...'captionsDelay': 800, // How long captions effect should last, when captions are enabled (integer, milliseconds)...'scrolling': 0, // Makes RokBox follow when scrolling the page (boolean, 1 or 0)...'keyEvents': 1, // Enable keyevents. Esc, Left, Right to close and change previous or next (boolean, 1 or 0)...'overlay': {....'background': '#000', // Overlay background color (string, hex color format with starting hash #)....'opacity': 0.2, // Opacity of the overlay (float, from 0 to 1, 0.1 makes it invisible but clickable)....'duration': 200, // Duration of overlay effect (integer, milliseconds)....'transition': Fx.Transitions.Quad.easeInOut // Transiti

<<< skipped >>>

GET /map/getinfo.php?MagicWord=FHI HTTP/1.1

Host: clientn.free-hideip.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:36:02 GMT

Server: Apache/2.2.21 (CentOS)

X-Powered-By: PHP/5.2.6

Content-Length: 112

Connection: close

Content-Type: text/html; charset=UTF-8

IP=193.138.244.231.COUNTRY_SHORT=UA.COUNTRY_LONG=UKRAINE.CITY=KIEV.REGION=KYYIV.LATITUDE=50.433.LONGITUDE=30.517..

GET /modules/mod_analytics/gatr.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "166f7-7e3-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 2019

Connection: close

Content-Type: application/x-javascript

if (document.getElementsByTagName) {.. var hrefs = document.getElementsByTagName("a");.. for (var l = 0; l < hrefs.length; l ) {.....try{... if (hrefs[l].protocol == "mailto:") {.........if (pv[1] == 1) {..... ..startListening(hrefs[l],"click",trackMailto);.........}... } else if (hrefs[l].hostname == location.host) {.........if (pv[0] == 1) {..... ..var path = hrefs[l].pathname hrefs[l].search;...........var isDoc = path.match(regex);... .. ..if (isDoc) {... .... startListening(hrefs[l],"click",trackExternalLinks);... ..}.........}... } else {.........if (pv[2] == 1) {..... ...startListening(hrefs[l],"click",trackExternalLinks);.........}... }.....}.....catch(e){.......continue;.....}.. }..}..function startListening (obj,evnt,func) {.. if (obj.addEventListener) {.. obj.addEventListener(evnt,func,false);.. } else if (obj.attachEvent) {.. obj.attachEvent("on" evnt,func);.. }..}..function trackMailto (evnt) {.. var href = (evnt.srcElement) ? evnt.srcElement.href : this.href;.. var mailto = trmlname href.substring(7);.. if (typeof(pageTracker) == "object") pageTracker._trackPageview(mailto);..}..function trackExternalLinks (evnt) {.. var e = (evnt.srcElement) ? evnt.srcElement : this;.. while (e.tagName != "A") {.. e = e.par

<<< skipped >>>

GET /images/stories/app/product3/box/box200.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:32:23 GMT

ETag: "168a0-a00f-50b147f16b7c0"

Accept-Ranges: bytes

Content-Length: 40975

Connection: close

Content-Type: image/png

X-Pad: avoid browser bug

.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.....dWu&..P..:M.LO.....QBB".c.........u...:....kl.w..'......0.....HBa.F3........r.....9..W.Z3b...6.%...~...........5Vn ....o..%X.....s..?........8...C.P@6....r...-."._...\N.... ...... ..rW...v.*]?2..N....(=.`.Y;Q...z.w.....].r..v.B.....w.k.....c....g.P*..c.b..[...a..^.n..V..Fm......-.BD..<.)\..y...p...P..`...@...&.H.......^=.......7"..q....t...y.8y...zE..........Xw...Bz...X<...v.0.]....@..W.).B..=.)....AP?...WP...PVmL..S.../..&..:.<.......d.....P..p..n.jL...............G.u.n.^......_..S....yT.E|...`u../..F<1q........^.N..}_...t..0.?....5......[.....>.{._.^........._.z..x.k.....{>.{g...aI....{./..yW]s.5.\.._..(r.5..8.......">..T...S...|6.?.*..A?..3..{.....w...\..0.Rlav...."k.....LVv...8|' ......o ..@~.M..w....Jq.qs....S..>...Q...z....^... `0."...X,.......5...v.....4.?.....s.0 |.....O................vo.]w=................e.N..u..8..FOTt_Y. ..7.. .A.cd..u?L...H........ Z.n...s;.N......:rpx.Je2,..y.J*.X..8.{-#....%.E~.^%.Y.....^...|/..R.=..bk3..m.......r.\...{.....$....c.E.N....Z.hb..-.%..5.D.}..j5.$y..5.:{..Bq..r...G....:?...k........\z......kn...}....0r.....z?..s..\g.. .f. .:.;Z.d1.###.!...t....!. K@....S= ...."_).A.~..x....h......:.K....bC....|..........Bv......B!...T....D'.4....Y.GVI...5.....:_#......v..).....Vt..@.=.A."O.x^.R.OD.n.{.......R..mkGQ.....'...s.Ec.......8.w@.=.}r.P..J.6..v..B.=[.'....Q.G.>K.'".dQ..F.=..E_a..e.8...bi<.8-'..3.,..-..-..7.....VU..8........m{....t....NOW K|. O....D..X.z....k.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=486675, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 18:44:32 GMT

Expires: Mon, 12 Jan 2015 18:44:32 GMT

Date: Wed, 07 Jan 2015 03:37:03 GMT

Connection: keep-alive

0..........0..... .....0......0...0........6?s....V....OlL".O..20150105184432Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......A..2.....:...:......20150105184432Z....20150112184432Z0...*.H.............P*........D..)..Ex/.......P?)...K...BJ..G..x. \2....6y....\..t..0.1,y..S...{.....:..<... vn....&.$[.3...I...\ ...._.L..1@=cZ;..J....w.o.]s.n.......F.3.....V...P..NA/......\... ..%.`p...AA....W.?..@UI..3pi..E....%w.Z:~.C............`..:...:....UE..x...x.......#0...0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{(..t....2.Vf.....&;6).i*FK....W@....F....jnb.w._p.E.6.|.mk....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...

<<< skipped >>>

GET /favicon?q=tbn:ANd9GcSlGZwIY7CG1hRqkjjqDVrr1EIcXRVy4ZHks-_ST_Ki1xol2xUZky_UN4RJumq9P5aerQCoS5ut8se_LPXXYm_BaAUUQ3X2 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t3.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/jpeg

Last-Modified: Fri, 24 Oct 2014 08:00:44 GMT

Date: Sun, 04 Jan 2015 22:07:53 GMT

Expires: Mon, 04 Jan 2016 22:07:53 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 452

X-XSS-Protection: 1; mode=block

Age: 192311

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002

......JFIF......................................... ."" ...$(4,$&1'..-=-157:::# ?D?8C49:7...........7%.w7 77777777777777 777 77 77 777 7 77 777 777 7 7..........."..................................%............................!A3Q.12...................................................!a............?.5}....@.M.!........$..I.Xy. po^.Eku...9.o.:......w........H...~.TV..<.......RF.k@..5% .',..l......}k.R.............`.ZM;.C........?,`..zO .U....r:...HTTP/1.1 200 OK..Content-Type: image/jpeg..Last-Modified: Fri, 24 Oct 2014 08:00:44 GMT..Date: Sun, 04 Jan 2015 22:07:53 GMT..Expires: Mon, 04 Jan 2016 22:07:53 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 452..X-XSS-Protection: 1; mode=block..Age: 192311..Cache-Control: public, max-age=31536000..Alternate-Protocol: 80:quic,p=0.002........JFIF......................................... ."" ...$(4,$&1'..-=-157:::# ?D?8C49:7...........7%.w7 77777777777777 777 77 77 777 7 77 777 777 7 7..........."..................................%............................!A3Q.12...................................................!a............?.5}....@.M.!........$..I.Xy. po^.Eku...9.o.:......w........H...~.TV..<.......RF.k@..5% .',..l......}k.R.............`.ZM;.C........?,`..zO .U....r:.....

<<< skipped >>>

GET /mi/?rc=v&ri=1379108&p=Hu5zu11&t=9ahOMV9&type=img HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.trialpay.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache

Vary: Accept-Encoding

Set-Cookie: tpsess=o65f9pvfl2m59apkv9kmteod6043c48aea35a7fe; expires=Mon, 06-Jan-2020 03:33:03 GMT; path=/; domain=.trialpay.com

P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"

Set-Cookie: ss=tG8UF8iXGLL8GRUz.5149678f50f5b053; expires=Mon, 06-Jan-2020 03:33:03 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_ui=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_ui=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Set-Cookie: u_uk=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_uk=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Set-Cookie: u_ul=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_ul=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Set-Cookie: u_sr=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=.trialpay.com

Set-Cookie: u_sr=deleted; expires=Tue, 07-Jan-2014 03:33:02 GMT; path=/; domain=merchant.trialpay.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 07 Jan 2015 03:33:03 GMT

Cache-Control: no-store, no-cache, private, max-age=1, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Location: hXXp://d261sv3xac0f7i.cloudfront.net/store/1731321/18800433.gif

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html

0..

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEA+oSQYV1wCgviF2/cXsbb0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510805

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:37:05 GMT

Etag: "54ac683d-1d7"

Expires: Tue, 13 Jan 2015 15:37:05 GMT

Last-Modified: Tue, 06 Jan 2015 22:57:01 GMT

Server: ECS (frf/8795)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......E.......1-Q...!..m....20150106200000Z0s0q0I0... ............@..D3=?..Mn8...Q..E.......1-Q...!..m......I......!v...m.....20150106200000Z....20150113200000Z0...*.H.........................T#cS..U...~.......kb......A...G..f.=!cV..g...5..Fo.......1....I5.{.YU...`.....l...".......0/%.p...g].3B:...U.....z.T.{dn bK.j.-.^...s.P..g.j.|.xWC..9.r...*.........j.c.c..}O>6..w872t.........:...@.....^4....W.Xj.... .....q.....u.<......0...........

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEAUR6vhXniZivmIt5a4M1Ag= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=514362

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:37:05 GMT

Etag: "54ac88db-1d7"

Expires: Tue, 13 Jan 2015 15:37:05 GMT

Last-Modified: Wed, 07 Jan 2015 01:16:11 GMT

Server: ECS (frf/879A)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......{h.)....Iz..?...E.52..20150107010100Z0s0q0I0... .........j......3h...H.Y.!&...{h.)....Iz..?...E.52......W.&b.b-.........20150107010100Z....20150114011600Z0...*.H..............N....\...P...T;c.#..$|..@....f.......7..w...Omo:..........# ..B.tH.z2g\..8.h".b.G..$..v.z.l..>>.....S2<.!....)..xp..Va.=.S..._.b^;]x..5...(..wb.......h..._C.n....o..B..q.:...J.w.. .......4....3.Gw{A..xE*..n@...0...K.. E..*w..U.....t.X_'F.......z..jV.....]..

GET /templates/rt_dominion_j15/css/typography.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e9-ef4-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 3828

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.3 January 10, 2010. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */./* Core Styles */..rt-image {padding: 10px;margin-bottom: 15px;}../* Bullet Styles */.ul.bullet-1, ul.bullet-2, ul.bullet-3, ul.bullet-4, ul.bullet-5, ul.bullet-6 {padding: 0 0 0 15px;margin-left: 0;}.ul.bullet-1 li, ul.bullet-2 li, ul.bullet-3 li, ul.bullet-4 li, ul.bullet-5 li, ul.bullet-6 li {list-style: none;padding: 0 0 3px 15px;margin: 0 0 5px;background-repeat: no-repeat;background-position: 0 4px;}.ul.bullet-1 li a, ul.bullet-2 li a, ul.bullet-3 li a, ul.bullet-4 li a, ul.bullet-5 li a, ul.bullet-6 li a {font-size: 100%;line-height: 1.7;}../* Emphasis Styles*/.em.color {font-style: italic;font-weight: bold;}.em.bold {font-size: 120%;font-weight: bold;line-height: 135%;font-style: normal;}../* Drop Cap */.p.dropcap {overflow: hidden;}.span.dropcap {font-size: 400%;margin: 0 5px 0 0;line-height: 100%;float: left;display: block;}../* Notice Styles */.pre {font-style:italic;overflow: auto;padding: 10px;margin-bottom: 15px;}..alert, .approved, .attention, .camera, .cart, .doc, .download, .media, .note, .notice {display: block;margin: 15px 0;background-repeat: repeat-x;background-position: 0 100%;}..typo-icon {display: block;padding: 8px 10px 0px 36px;margin: 15px 0;background: no-repeat 10px 12px;}..approved .typo-ico

<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "0e20e453051989d614010fc5777516e5:1420601426"

Last-Modified: Wed, 07 Jan 2015 03:30:26 GMT

Date: Wed, 07 Jan 2015 03:33:05 GMT

Content-Length: 878

Connection: keep-alive

Content-Type: application/pkix-crl

0..j0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..150107030300Z..150117030300Z0..R0....X...140427081922Z0....v...140618150003Z0........140429180917Z0........140709194633Z0........140416233935Z0........140521155053Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140606204021Z0........100729164439Z0....x...140507204001Z0........140606222139Z0....%...020514181157Z0....S...140423105438Z0........140725020038Z0........100729164732Z0....M\..140430000442Z0.....-..140617185011Z0....V...140624123102Z0........120627171025Z0........100301134531Z0........140618143256Z0........120627171017Z0.....>..140711125531Z0....[...100730213120Z0....j...140226123519Z0...*.H............KS......%.-*....3...>.GF4....|V.|(t.D..V.z......j..0x.D..,X[....N.<....zD'..{.9.=6w....)...>L.?x.v|......>5L.R..S..x..1q[....f..HTTP/1.1 200 OK..Server: Apache..ETag: "0e20e453051989d614010fc5777516e5:1420601426"..Last-Modified: Wed, 07 Jan 2015 03:30:26 GMT..Date: Wed, 07 Jan 2015 03:33:05 GMT..Content-Length: 878..Connection: keep-alive..Content-Type: application/pkix-crl..0..j0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..150107030300Z..150117030300Z0..R0....X...140427081922Z0....v...140618150003Z0........140429180917Z0........140709194633Z0........140416233935Z0........140521155053Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140606204021Z0........100729164439Z0....x...14050

<<< skipped >>>

GET /pub-config/ca-pub-2137902362367109.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/javascript

Last-Modified: Tue, 06 Jan 2015 15:35:06 GMT

Date: Tue, 06 Jan 2015 23:00:48 GMT

Expires: Wed, 07 Jan 2015 11:00:48 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 106

X-XSS-Protection: 1; mode=block

Age: 16336

Cache-Control: public, max-age=43200

Alternate-Protocol: 80:quic,p=0.002

...........H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kdhlni`dl.D......@..J.E...y.I9.)JV%E......U..k...HTTP/1.1 200 OK..Vary: Accept-Encoding..Content-Type: text/javascript..Last-Modified: Tue, 06 Jan 2015 15:35:06 GMT..Date: Tue, 06 Jan 2015 23:00:48 GMT..Expires: Wed, 07 Jan 2015 11:00:48 GMT..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: sffe..Content-Length: 106..X-XSS-Protection: 1; mode=block..Age: 16336..Cache-Control: public, max-age=43200..Alternate-Protocol: 80:quic,p=0.002.............H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kdhlni`dl.D......@..J.E...y.I9.)JV%E......U..k.....

GET /images/stories/app/common/button/download.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:35 GMT

ETag: "16855-a34-50b147c3a4bc0"

Accept-Ranges: bytes

Content-Length: 2612

Connection: close

Content-Type: image/png

.PNG........IHDR...l..........DZ.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...WhU]..wb,...%.......^...>.A.......`y1.X......bC.....'...{.{.=s~....;..A.a........k....&* .....>.....>}..7.....".....m."E.... .c..E.....x..%&&..u<|.p........u.....S.NDz.H...........-Z.o.t.>`a[.nMHJJz.XS.O.?~..-r....}.-..o.v........?E&O.|....!..|.bW...$...6.&M..V.z...G`h.[.je...P.B...bbb"........"**..{......E_.~=.........^.7#. ....L...233.Dgdd$..]:.........!.#......X......S.c....../..4........\8".|&d.......U4Y...o.,.u.......W.,...X..j .....X.....2?..._...~M.8.5m..5k...\.p{...uL^s..k..U.Q.F...\...3.N....../.}C.A..-/ 5.7n.[.`..4h.....[6.$'a.cdv...;p.iP8a....sd...4 .qG..q3f.pe..q.;v.Q.~4.."2]x..........2.p.I............n...n..M.T.R.?u...1.V..?...M.....w..MsK..u].v5?.e..l.6n....m........\..v..Y....[.....]......#..;Z..@hg.&M...C].v.......o.....W.....j.l.c..5.1..O.>=......H.S.|y[....{ONNvO.<1.a.....%#.|.....W^. .Wso..../_..j..{.KII1f...bLo.....; rn.S...dC.d...(9..W...;...SH.ccc..C...B.......555G.~...*W...;pv...\....u..#.....?A......A.c.{D..a. W...........CI.....XE........6...._ a..J.*...$m.7o...s..q...7..c..P.2 ....W.....m..{..U.X\..../Z..u.....&...~I..9.A,....u...5j.K.......yc..=z...R..[.x....$.2..w.L..(......saa(..J. ..D..?.q...>FT.. .,..0..I......<z.(.f.5\<..X.pxg=......iii.$. ..y..D...o.I...b#<..........w..BEP...<y..><.0.............w.ZP.. .....J..O..V......;2dn% ..6^.e...xL,3...`....s.... ...0...0... .qo........w.`..`..W...9rj... .........k.0b..7x.`7`......]....c...XG.C...sr.H.I..2e.}...

<<< skipped >>>

GET /install/flash_player_ax.exe HTTP/1.1

Accept: */*

Host: clientn.super-mp3-download.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:32:46 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 11 Jun 2010 03:40:03 GMT

ETag: "7081d-1ddb30-488b8e4edeac0"

Accept-Ranges: bytes

Content-Length: 1956656

Connection: close

Content-Type: application/octet-stream

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L....$.E.................b...........6............@..................................@......................................P.......................`................................................................................................text...:a.......b.................. ..`.rdata..B............f..............@..@.data................x..............@....ndata.......p...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....$kB..H.P.u..u..u...L.@..B...SV.5(kB..E.WP.u...P.@..e...E..E.P.u...T.@..}..e....D.@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...H.@..E...E.P.E.P.u...X.@..u....E..9}...w....~X.te.v4..L.@....E.tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W...E..E.h ...Pj.h cB.W..\.@..u.W...u....E.P.u...`.@._^3.[.....L$..HkB...Si.....VW.T.....tO.q.3.;5LkB.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5LkB.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /client/?PID=FHI&ACTION=installed&IVER=4.0.1.6&ILAN= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: client.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Wed, 07 Jan 2015 03:36:03 GMT

Server: Apache/2.2.21 (CentOS)

X-Powered-By: PHP/5.2.6

Location: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /templates/rt_dominion_j15/css/suckerfish.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:13 GMT

ETag: "16971-74b-50b14d452c940"

Accept-Ranges: bytes

Content-Length: 1867

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.2 December 9, 2009. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2009 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */. ./* Root Items */.#rt-menu ul {margin:0;z-index: 200;position: relative;}.#rt-menu li {list-style:none;float:left;height:31px;position:relative;}.#rt-menu li .item {white-space: nowrap;display: block;float: left;font-weight: bold;padding: 0 18px;font-size: 12px;z-index: 100;cursor: pointer;position:relative;margin: 0;outline: none;text-transform: uppercase;line-height: 31px;}.#rt-menu li .item span {display: block;margin: 0;outline: none;padding: 7px 0;}.#rt-menu li a:hover, #rt-menu li:hover a, #rt-menu li.sfHover a {text-decoration:none;}../* Dropdowns */.#rt-menu li ul {position:absolute;width:180px;left:-999em;}.#rt-menu li ul ul {margin:-50px 0 0 180px;}.#rt-menu li:hover ul ul, #rt-menu li:hover ul ul ul, #rt-menu li:hover ul ul ul ul, #rt-menu li.sfHover ul ul, #rt-menu li.sfHover ul ul ul, #rt-menu li.sfHover ul ul ul ul {left:-999em;}.#rt-menu li li {margin: 0;padding:0;height:auto;width:180px;}.#rt-menu li li .item, #rt-menu li li.active .item, #rt-menu li li .item:hover {margin:0;padding: 0 0 0 15px;height: auto;float: none;width: auto;line-height:20px;display: block;}.#rt-menu li li .item span, #rt-menu li li.active .item span, #rt-menu li li .item:hover span {width: auto;display: block;line-height: 20px;tex

<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Thu, 23 Oct 2014 05:05:32 GMT

ETag: "a2f3ff97eeecf1:0"

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive

....

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.0

VTag: 279876544500000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive

0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p............<.J0... .....7.......0...U......30... .....7......150320224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c.{.m@Q.M.p...g.^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo...._...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.].....uki~......

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 43863145100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive

0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......10... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q>.ln...z..L.......5.5s@d.q.('..e...Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az......@..lHTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 43863145100000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 550..Cache-Control: max-age=900..Date: Wed, 07 Jan 2015 03:33:36 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......10... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q>.ln...z..L.......5.5s@d.q.('..e...Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d

<<< skipped >>>

GET /images/stories/app/common/button/buynowpp.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:39 GMT

ETag: "1688e-894-50b147c7754c0"

Accept-Ranges: bytes

Content-Length: 2196

Connection: close

Content-Type: image/gif

GIF89az./.......... Fn..,mlkXs............N.43....<r.....u'...Z[X.............V)r......>CDE.....O...........n.h8..........pO.........Jd......m&''..VD..i....@h{.......`cY..............?..&......................................3.W.0i...4..4-l.3u....h9^!..u.....=XnfVX l.x..8..`.."|.....a........8R..!........2..........................Y..a........................?v.........i.....X..T..8.8l..3......!.......,....z./...........}................./Q@o.............o@Q.}...}.i?............i...}M..................}><.............>...}.:..........................*\.........(... .3j..1...|B....dI.!S..a..K.k....b...8s..Y@eH..v..(....%.*].TE..}.T.B....X...#..U. .Z......5.v..V...o..(......Q.....o..\;..2./..z.....m.. ........"c....H../.^.. A...S.^.z ..DR.TY..l..W..............o....).....wO'..e8j.*C.......2P;F^.(......].z....O...y...U4).....E8..m|.Q..!.PD.!....>IqC.....V..W!...w...A'.6{.h...8...,..b.l...d....O2..b......|..b.0....?6....'.8b%}....TVY..X^I.W,..Bu3..V.Y....Y^Y..Y.......@.i....U.9.........*..a....8.9.O3HifHa..V...p&...$@..v.).}z*..a,...$.@.....'.lI.*.a@:..3..'.7........,9.k...&....6....>;.,MVk...f....v[....P....k..........n..Qt....k..................8....'....7....G,q...\H..*.....w... .,..$.......E......0.,..4.l..8..J.^X|....-..DO...H'...L7...PG-..TWm..Xg...\wM0.`.-..c....h.....D...nG`..O<....X.. ............!........3n.........=w.w... sD....s.y...........`O....c0.........M..x.]..k.>....o.......]..|.$..=.$0P;.i........ .`.6.../`.....>......IL?...4...:....W..G.G8........mV.... ... ...B..`.

<<< skipped >>>

GET /sa/imgs/banner_holiday_halfprice_fhi.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: sa.software-pay.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Wed, 14 Dec 2011 07:06:49 GMT

ETag: "2c029-1470b-4b40802f21440"

Accept-Ranges: bytes

Content-Length: 83723

Connection: close

Content-Type: image/jpeg

X-Pad: avoid browser bug

......JFIF.....d.d......Ducky.......W......Adobe.d..................................................................................................................................................................................................................................................!..1"..A2#.a3.Q.q...BRCS$.c.4....b..........r.s.Dd%5......tU.6.7W.T.eu.F.......................!..1AQ.aq.".....2...BR....br...#.T..S$4.3.5....s..%U&6Cc.t.............?.....;[.S....'q.{|.S.w=..u.2j.!J. .....j.x[...S.RBZ..Û...J".`1...3.6..9...J.iY...k.R..i.~.......;.r.%.mE...e......n.......k.6..,.......a....--*Ce.L....l...1:.i....`Y.X..r......y....V.c.....pd\..D.yJD..s0v.....2......u.srZ;....n..N...V.<.J..j..a...P.$.u6...cw.....c).bCpx..8... ..!.R.Wb..D.=-...7..;..M..m.xwB..ww..]].m..u[z. .......e.g..)...J.\p..."S....v............Ly<n..SR...^.#i.......u_Yt.\...[.k.....eOT=P..I&%JR..8..)b..Y).......#.........v.gm....X...j....Bi.M;..w.........R}E%..@.........v.._..V....A.I.A.....\..N..'` f...`..n.....i......v-.s....p..-.........:..Z.q....T k6..N*..<(.......n....W....7..U1..50..Q`..,3.!'.....!F..&....1D..IS....\.,...\ou-......J..J...JR3.R..D..'.A.. F..[i.....XG.w.7../....;....]..Wh{.`j...U..e..M6..]...WJ..S .}..(...AO.......x....a....}..7.?.<..k....F'..p.2m.;..........n...t.>...n..c.....-.=..n4.......Qotk6.KJZ]...c....2...R1.H=#n...8b.......<. f.\.7a..a.T..q.......6...{.xUP.UF.3*....q.i..KI\.Qr.EFU(6.R..i.N..N. ........n...X8g^mo.x.$.[p...E......~..L..#..Mb.f..HJ.q...m.).....e.`. ...L.....'x.im..c..M..s..z.J..

<<< skipped >>>

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive

HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer3.webapp.scl3.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Wed, 07 Jan 2015 03:33:02 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=492

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached

HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer3.webapp.scl3.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; charset=UTF-8..Date: Wed, 07 Jan 2015 03:33:02 GMT..Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=492..Content-Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

GET /pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: cafe

Cache-Control: private

Content-Length: 30424

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002

.............W.J.0.W..."].c.@....=$....0.............U.....3..[....R.......7......y....7../g....7.W.....n..[....0.k.h....{a.....0lw.....g.sF.....".....}........F.....GZ.[....EX\{.A....w..&.?..5o....y.f....^....f.{.........y^o......an....CoI..M.0....F..|I...Q7 .M...{..V>....h.....I.c.6.E.6Bw..Go..t.F..P7.n....Q....;Ng..c..F...z.].9?..i.....y.o.7.#6t1..d..........E..y......X..k...x2.F.f-..E..........\..T.......z...d.2..;...Q.N......R-.C?...j0....rO[H......y_..c>....]..Opa....?...L3.s.wvO...oi.8....aUI...k3..."S.S.cQ.v5........a~M.Z.h.}......W.......... ..owkS..M.......o.-g.Y..g3..4QW`/5.l.........0R.........a....'=..))ptv..%.......4cqq.aCz4:....6..n$.n...E.mA..M...l.....6f0-....0..p...g.....>....^M..m..-f....<..../.........x.......p.v.;.8.1.Z..B...E.2~...^.cY.qV5....Fg6.....wu.../..-.F";9....W.T..:....?..<.....J.t..6..^0b.t.h.l.;0........af.....a..Q5..=.`.m.S....nX...Vk>.v...[....6]*..- ..o.?...p...){)~.x.9..N.."j..,Y.........p..YU$U]Q^..... SL39v..a.....N(....U..N....rX.Cvswe..H..Z.lf.L.......?F-...Zx..........gj.Q....,...IE.,..*.........O..3.Zt..".g.....j..C-:.....IE-...7..........j..C-..)...P.@Q...G-.(..L'G'..u"....DD.z.\Z.....B.....h....)......P...X...FD.....H2....ay...*.>h.g1.s. 7......F*.........-..n........1}"....yC.U.UM..G*.K.nz)J..V.....n.i.^.V..._."z.. Ets..3.N.".y..9...1.OG.g...v...Qd..JZN<Q.. 3.H.~..............F].7...k./....k..k..k...|Q7.f...0...#M.y.7.p..#>....y.tm0.h.|3...9...D.,...)`i.Ee...>>.L;R..t.....s......B.,..85g.E.!..S...N........k.r1..IZcM&..$.SW..;].D...&l

<<< skipped >>>

GET /templates/rt_dominion_j15/css/template-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:17 GMT

ETag: "16973-12e0-50b14d48fd240"

Accept-Ranges: bytes

Content-Length: 4832

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.3 January 10, 2010. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */. . #rt-copyright, .rt-block, #rt-main-surround, #rt-header, #rt-header-overlay, #rt-mainbody, #rt-bottom, #rt-menu-overlay, .rt-main-overlay, .module-surround, .module-br, .module-title, #rt-background, #rt-background2, #rt-background3 {zoom: 1;}. . /* cludge for fixed width empty div */.#rt-drawer .rt-grid-12 {float: none;}../* cludge for mainbody jumping */.#rt-main {.zoom:1;position: relative;}. ./* Content Titles */..rt-headline {zoom: 1;}../* Header */..topbar ul li a {display: inline !important;}../* Showcase */..showcase-item {display: inline;}..showcase, .showcase-item {zoom: 1;}.#rt-showcase {padding-bottom: 0;zoom: 1;}../* Content */..pollstableborder {zoom: 1;}..rt-joomla .rt-headline {margin-top:0;}..article-rating {position: relative !important;}..rt-joomla .rt-articleinfo {width: auto;zoom: 1;}../* Top Menus */..menu-type-splitmenu .menutop li, .menu-type-suckerfishmenu .menutop li {margin: 0;}..menu-type-splitmenu .menutop li a, .menu-type-suckerfishmenu .menutop li a {margin: 0;}..menu-type-suckerfishmenu .menutop li {border: 0;}..menu-type-suckerfishmenu #rt-menu li li a span, .menu-type-suckerfishmenu #rt-menu li.sfHover li a span, .menu-type-suckerfishmenu #rt-menu li#current li a span {background: no

<<< skipped >>>

GET /plugins/system/rokbox/themes/light/rokbox-style-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:55:51 GMT

ETag: "1692a-22d-50b14d30317c0"

Accept-Ranges: bytes

Content-Length: 557

Connection: close

Content-Type: text/css

#rokbox-top.rokbox-left{background:url(tl.gif) 0 0 no-repeat;clear:both;}.#rokbox-top .rokbox-right{background:url(tr.gif) 100% 0 no-repeat;}.#rokbox-top .rokbox-center{background:url(top.gif) 0 0 repeat-x;}.#rokbox-middle.rokbox-left{background:url(left.gif) 0 0 repeat-y;}.#rokbox-middle .rokbox-right{background:url(right.gif) 100% 0 repeat-y;}.#rokbox-bottom.rokbox-left{background:url(bl.gif) 0 0 no-repeat;}.#rokbox-bottom .rokbox-right{background:url(br.gif) 100% 0 no-repeat;}.#rokbox-bottom .rokbox-center{background:url(bottom.gif) 0 0 repeat-x;}...

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:34:06 GMT

Last-Modified: Thu, 01 Jan 2015 15:18:48 GMT

Server: ECS (frf/8799)

X-Cache: HIT

Content-Length: 1406

0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..20150101064605Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M....'.G....20141203203331Z....20150331203831Z0...*.H.............H...y5p...Z...%...y.......w.>1......XZ.5(.X....D......~.....G...."1...8J.g.y..5.. }.1._..@.c..@eE..j....i.Mp..(..!..c.....r....&,|....G3...[.F..(...;A<.{;Bs.%Q....M:8........G.nKu}.97.......p..?.n_.#..d.. .N@.M..IF[...X.lP.;.5'...v...-.....*l.8. ...e.?.q\.....0...0...0...........'..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root0...140122184236Z..150122184140Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM..*.4.MP..../D4n.=ZTeH.B=kOT.v..2@F.2L..A...yn.4......fP...L...2.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>.O....G.A........0..0... .....0......0...U.......0.0...U...........0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ..k.F..^|A.Tb0...*.H.............. .p.)...09W..Z.......]....}.:..Vr.....c..U..:V^.O.....<...b*5.c.\.fF./....5'.>./ iS..R0..)..*.!..q.h.T..ul.}&.......`.1".~.U....rB.BR.s..x..o..Y.......).4:.[.9.=....x...'.f..\ kC......@I....G:J!.hRH..!z2DtL.s2.r.....Yi~..E..AzO..i.."N.$j...b...o..i."{(3....

<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/light/bodydiv-low.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:05 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:57:26 GMT

ETag: "16977-4e5-50b14d8acad80"

Accept-Ranges: bytes

Content-Length: 1253

Connection: close

Content-Type: image/png

.PNG........IHDR...2......... .._....sBIT.....O.....PLTE......... ....pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2009-11-02T15:30:41Z</xap:CreateDate>. <xap:ModifyDate>2009-12-30T07:58:27Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="hXXp://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>. . . ;.S.....tEXtSoftware.Adobe Fireworks CS3..F.....tEXtCreation Time.12/11/09........IDAT..c........Q...........IEND.B`...

<<< skipped >>>

GET /templates/rt_dominion_j15/css/demo-styles.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e7-8cd-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2253

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.3 January 10, 2010. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */./* Frontpage Content */..demo-img h4 {margin-bottom: 10px;}.h3.demo-title {margin-top: 0px;}..demo-img .rt-image {padding: 2px;margin-right: 10px;float: left;}..demo-img-tab {width: 33%;}..demo-img-tab .rt-image {float: none;}..demo-img-tab h4 {margin-top: 0;}..demo-img-padding {float: none;padding-left: 10px;padding-right: 9px;}..demo-tab .roktabs-wrapper .roktabs-container-wrapper div.wrapper {padding-top: 2px;}../* Gantry */..demo-img .rt-image.rt-image-right {float: right;margin-right: 0;}..gantry-logo {float: right;}../* Extensions */..rt-ext-col1 {float: left;width: 47%;}..rt-ext-col2 {float: right;width: 47%;}..rt-ext-block {margin-bottom: 30px;overflow: hidden;}..rt-ext-img {float: left;margin-right: 20px;margin-bottom: 25px;}..rt-ext-divider {height: 10px;display: block;}..rt-ext-links {text-align: right;display: block;}../* Style Variations */..demo-sv-title {width: 181px;float: left;margin-right: 10px;padding-left: 3px;}..demo-img .demo-sv-img {float: none;}../* Tutorials */..demo-tut-list {float: left;width: 30%;}..demo-tut-list2 {float: left;width: 40%;}..demo-tut-video-img {margin-right: 15px;width: 123px;float: left;}..demo-tut-divider {width: 15px;}../* RTL Stuff */..rtl .demo-img .rt-image {margin-left:

<<< skipped >>>

GET /store/1731321/18800433.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d261sv3xac0f7i.cloudfront.net

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 3599

Connection: keep-alive

Date: Tue, 09 Dec 2014 05:07:07 GMT

Cache-Control: max-age=31536000

Last-Modified: Wed, 18 Mar 2009 19:16:20 GMT

ETag: "9fd70a39539ab338b0760528ccca31e1"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2499957

X-Cache: Hit from cloudfront

Via: 1.1 87b36ff610510370f50c63729c65320e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lPkX15i7W9GYTBueboEr5lbEhyx4KgoLqxGQuOcMaepOWxs-Vh2laA==

GIF89ax.2................5r.....vL:}....;...y$Sk.d..?Y....5s.)]....,\.......4h.%M.1e....9z..9f...&Q...l.. .......b.......Gh.1e........|6.v2...aw.v..)T.Lw.tmgu.....1b.0e.....{.&Y....,`.......3i..7[2f...F.........Ym.p...c..........g..R{.-^.Jf.Gt....^y.=..g.....-a..\.2i..=j...7Ry0^.=.....X..#I.2g.T_q)U.1d.?..3m.(Y.4f./S.....a..`...%..)...1f.!Ey2h.2k.......-a..../].......W.....,Z. `.<..0a...a/`.0f..@t......3o.......C..5o.*_.!Es:......1L...Vg|......7u./d.2d.6l.l..2c. X....&P..?p1`.:_.$Bf7Kb&O.2f.1a..oP.....2......1a..........5o....7w.-Z...6;a....S..s..3...../b.(Ep...2k.....\.G_.1d.#..*W./_............. Y.... \.6o....>..n..8x....3d.-[....>l..=b..I...&Js...,Z.............'[.......0c.AXrGo..q\......M..0P}1e....&;S........,>c.@f.2g.y../`....(P.......'MyX...7bt.....o..Yq.4m.Zq....!.......,....x.2............k..*\......#J.H.".f.3...B...Z...I....(S.\...K.....Q...-..jI.B...@...JR..&Mn..7L....L.p1...nX.r....V.. B.....f..];.-.)p....W...f...KD.\.8..01l$.:.~h....HB..r.K..e._/.%.....t....W.^I.g.^.....|QKZM.......At....M....s$.)U.n...2.....==.6..t.O'2.M..]*.....K.63R.N......gxW}...3.pX.c8......T-.p`....5Z]R..\X.t..jlT.^.....\..v.w..(.y..H..".X^.B...7(...7..q......N.."....8..J.%..R....kU..w`.s...`.J..f..(R.g.\|E.b.)ji.9U.G.x=.a...X.......7~(....4.......0.p.... ......C.#....cU&.^`....fvA..*t.....c.......k.w.....C.w....;.............g..........6..y..~.b..#.A.6.X.."J.....|...#.C...~..4H.@.<.~.....bo,..KF........1.... .9d.........j .M..z..8..q..7.a...hQ.,.....~.".*........r.J(....D#C4...H..:....PP...D.G.J.H.#.D-..H$q3.

<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:34:07 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d769df113145dd17e267a97a9a8ac956f1420601647; expires=Thu, 07-Jan-16 03:34:07 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Mon, 05 Jan 2015 22:10:47 GMT

Expires: Sun, 11 Jan 2015 03:34:06 GMT

ETag: "6cb83c5a0979f7a013d3af9d841ab7d42bcceae2"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1a4d19065f39157d-FRA

0..........0..... .....0......0...0..........<.|7...@N6p.I.e|..20150105221047Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.{.....Z..w...d..\.-....w.....20150105221047Z....20150109221047Z."0 0... .....0......20140105221047Z0...*.H.............<.7.1...@2....f.M.?]. ..._:..2.&7.o #!..].VkT3..8~....c....9F..{!Q....-...`.....!..~RJ...iVu.Uo..Q.whi ,Lr..@...K..1..?.K2`Qu...&w.<..gA.pNV.L.....sk.[.N.z.-_.T@....f.q.[...v..\..,..%..A@d"r.ZQ )...-.w..Qv..z;.tu..R..7.....B...V..{....pJ..n........H;1#...b....0...0...0..........Z..~..M..<ZYJ....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Should be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q...........bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... .......0... .....7....0.0... .......0... .....0......0...*.H..................sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0059695b36fcc39d HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Wed, 07 Jan 2015 03:33:05 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..Cache-Control: max-age=86400..Date: Wed, 07 Jan 2015 03:33:05 GMT..Connection: keep-alive..

GET /s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff HTTP/1.1

Accept: */*

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://googleads.g.doubleclick.net

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: font/woff

Last-Modified: Mon, 11 Aug 2014 21:03:10 GMT

Date: Tue, 09 Dec 2014 02:38:32 GMT

Expires: Wed, 09 Dec 2015 02:38:32 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 20060

X-XSS-Protection: 1; mode=block

Age: 2508873

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002

wOFF......N\.......H........................GDEF.......'...(.I..GPOS.......\...L....GSUB.......A....S%QgOS/2...H...W...`k.c.cmap.......W.......tcvt .......9...:....fpgm...4.......a.A..gasp...,............glyf...<..=.....a.\.head..F....6...6...2hhea..F........$....hmtx..G.........m...loca..H............2maxp..J.... ... ....name..J........J..1.post..K........F.F..prep..M.........i..Bx.c`d``.a..&.. ....`..$.1<..O.~30..'..f.x.....fg....j...c..X..m.6......=."lT.....>k{......~................1@S....Y.....bBR.$%.....D...qY...........8...E.......j....Q......>.8._...4......Y..h>.......!.-.) C....".Z.i...%...U_.Q.0S..S.6S..S.!S.3...3......x..y.<H-'y.o...<L..#.*S.*T.*Uk..k..j..k.fk..j..k..j..k..j.VR.j..z.7h.6i..h.....c<...}[..S......-U..U.JU.Z......w..<..*T.e.o.m..N.jP...sW......<.4.w.7.v!Oz|F....o.c:..:..%_.) O.j.....*..j...j.I..E].M..C.......-....x..mN..B...{<.1...1.#..UE*V.r....]2E.K........u.._..~.....-...jU.z5...7.]..s.<W9F..JH.......s..s.%.?x...u.Z..<b......,7....W.^...%........... z... ...iV/..Zr.z.g.v...#........mhK{....B.)..r*...G.Dg...nt.. z....c.....&1...d=...&6....a/.8.!..mj........b..C.C..K[...I.g....ND.b...*W=jr.DwR...c_...I1...3.NG.$...D.4...B.3.....0..L...PK.G.%&.....5i.&M[...qV.........=<:...&`0C..n".2...&b...h...N61S....f...,$`...XaB....`".49<crp.......E&.*x.m.3..Q....9....b.^.mc..[.......>G.\Kzn..<._BC....,..N}m.....V9i..j.fL._.._.Hr...C...!.U..x.....Y.|.^.......t.5.d.24A....`...~...W_R)k...4X.4.]..Q..1....*...?*...KkdO.?..?5..L..z.c.1..c.%V.`.....0.P..

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/css/gantry.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164df-1575-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 5493

Connection: close

Content-Type: text/css

/**. * @package..Gantry Template Framework - RocketTheme. * @version..2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */../* Reset */.html, body, div, span, applet, object, iframe, h1, h2, h3, h4, h5, h6, p, blockquote, pre, a, abbr, acronym, address, big, cite, code, del, dfn, em, font, img, ins, kbd, q, s, samp, small, strike, strong, sub, sup, tt, var, b, u, i, center, dl, dt, dd, ol, ul, li, fieldset, form, label, legend, table, caption, tbody, tfoot, thead, tr {margin: 0;padding: 0;border: 0;outline: 0;font-size: 100%;vertical-align: baseline;background: transparent;}. th, td {margin: 0;padding: 0;border: 0;outline: 0;font-size: 100%;}../* Grid Container */..rt-container {margin: 0 auto;width: 960px;}.body {min-width: 960px;}../* Grid Block */..rt-block {padding: 15px;margin-bottom: 10px;position: relative;}.#rt-content-top .rt-alpha, #rt-content-bottom .rt-alpha {margin-left: 0;}.#rt-content-top .rt-omega, #rt-content-bottom .rt-omega {margin-right: 0;}../* Layout */.#rt-logo {width: 185px;height: 115px;display: block;}.#rt-content-top, #rt-content-bottom {overflow: hidden;}.#rocket {display: block;width: 110px;height: 15px;margin: 0 auto;}.#rt-copyright {text-align: center;}../* Menu */.#rt-menu .rt-container {background: #666;height: 3em;}.#rt-menu ul.menu {list-style: none;margin: 0 10px;padding: 0;}.#rt-menu ul.menu li {float

<<< skipped >>>

GET /templates/rt_dominion_j15/css/style2-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:14 GMT

ETag: "16972-694-50b14d4620b80"

Accept-Ranges: bytes

Content-Length: 1684

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.3 January 10, 2010. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */..menu-type-splitmenu #rt-menu .menutop {padding: 0 10px;}..menu-type-splitmenu #rt-menu li a {color: #fff;}..menu-type-splitmenu #rt-menu li a:hover {color: #fff;}..menu-type-splitmenu #rt-menu li a:hover, .menu-type-splitmenu #rt-menu li.active a {background: #002640;border: none;}..menu-type-splitmenu #rt-menu li a:hover span, .menu-type-splitmenu #rt-menu li.active a span {border: none;}..menu-type-splitmenu #rt-menu li.active a {color: #fff;}...menu-type-suckerfishmenu #rt-menu .menutop {padding: 0 10px;}..menu-type-suckerfishmenu #rt-menu li a {color: #fff;}..menu-type-suckerfishmenu #rt-menu li.sfHover a {color: #fff;}..menu-type-suckerfishmenu #rt-menu li.sfHover a, .menu-type-suckerfishmenu #rt-menu li#current a {background: #002640;border: none;}..menu-type-suckerfishmenu #rt-menu li.sfHover a span, .menu-type-suckerfishmenu #rt-menu li#current a span {border: none;}..menu-type-suckerfishmenu #rt-menu li#current a {color: #fff;}..menu-type-suckerfishmenu #rt-menu li ul {background: #002640;}..menu-type-suckerfishmenu #rt-menu ul ul li .item:hover {background: #26BBE0;}..menu-type-suckerfishmenu #rt-menu ul ul li .daddy:hover {background: #26BBE0;}..menu-type-suckerfishmenu #rt-menu li.sfHover li .item {color: #f

<<< skipped >>>

GET /templates/rt_dominion_j15/css/style2.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164db-752c-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 29996

Connection: close

Content-Type: text/css

/**.. * @package Dominion Template - RocketTheme.. * @version 1.5.3 January 10, 2010.. * @author RocketTheme hXXp://VVV.rockettheme.com.. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC.. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License.. */.. ../* Core */..body {background: #fff;color: #666;}..a:hover {color: #000;}..h1, h2, h3, h4, h5, h6, legend {color: #333;}../* Backgrounds - High */...backgroundlevel-high #rt-background {background: url(../images/backgrounds/style2/main-bg2.png) 50% 0 repeat-x;}...backgroundlevel-high #rt-background2 {background: url(../images/backgrounds/style2/main-bg.jpg) 50% 0 no-repeat;}...backgroundlevel-high #rt-background3 {background: url(../images/backgrounds/style2/main-bg-bottom.jpg) 50% 100% no-repeat;}../* Backgrounds - Med */...backgroundlevel-med #rt-background {background: url(../images/backgrounds/style2/main-bg-med.jpg) 50% 0 repeat-x;}...backgroundlevel-med #rt-background2 {background: url(../images/backgrounds/style2/main-bg-bottom-med.jpg) 50% 100% repeat-x;}../* Backgrounds - Low */...backgroundlevel-low #rt-background {background: url(../images/backgrounds/style2/main-bg2.png) 50% 0 repeat-x;}../* Header */..#rt-logo {background: url(/images/stories/app/home/logo.png) 0 0 no-repeat;}..#rt-top, #rt-drawer {background: #00060D;}..#rt-top .title {color: #ccc;}..#rt-top .title span {color: #fff;}..#rt-top .module-title {border-bottom: 1px dotted #aaa;}...bodylevel-high #rt-header, .bodylevel-med #rt-header {ba

<<< skipped >>>

GET /components/com_jcomments/js/jcomments-v2.1.js?v=2 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:25 GMT

ETag: "16416-6a2b-50b147ba1b540"

Accept-Ranges: bytes

Content-Length: 27179

Connection: close

Content-Type: application/x-javascript

function JCommentsEvents(){}..function JCommentsInput(){}..function JCommentsIndicator(){this.init();}..function JCommentsForm(id,editor){this.init(id,editor);}..function JCommentsEditor(textarea,resizable){this.init(textarea,resizable);}..function JComments(oi,og,r){this.init(oi,og,r);}..JCommentsEvents.prototype = {...add: function(o,e,f){if(o.addEventListener){o.addEventListener(e,f,false);return true;}else if(o.attachEvent){var r=o.attachEvent("on" e,f);return r;}else{return false;}},...remove: function(o,e,f){if(o.removeEventListener){o.removeEventListener(e,f,false);}else if(o.detachEvent){o.detachEvent( "on" e,o[e f] );o[e f]=null;o["e" e f]=null;}},...cancel: function(e){if(e.stopPropagation){e.cancelBubble=true;e.preventDefault();e.stopPropagation();}e.returnValue=false;return false;},...target: function(e){var t;if(!e)e=window.event;if(e.target)t=e.target;else if(e.srcElement)t=e.srcElement;if(t.nodeType==3)t=t.parentNode;return t;}..};..JCommentsInput.prototype = {...register: function(el){if(el){var th=this,events=new JCommentsEvents();events.add(el,'focus',function(e){return th.onFocus(e);});events.add(el,'blur',function(e){return th.onBlur(e);});}},...unregister: function(el){if(el){var th=this,events=new JCommentsEvents();events.remove(el,'focus',function(e){return th.onFocus(e);});events.remove(el,'blur',function(e){return th.onBlur(e);});}},...onFocus: function(e){var t=JCommentsEvents.prototype.target(e);if(t!=null){t.className=t.className.replace('error','') ' selected';}},...onBlur: function

<<< skipped >>>

GET /images/stories/app/package1/box/box180_fhi.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:39 GMT

ETag: "16893-d855-50b147c7754c0"

Accept-Ranges: bytes

Content-Length: 55381

Connection: close

Content-Type: image/png

X-Pad: avoid browser bug

.PNG........IHDR.............=..2....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.....y..r....:.#....y=......}.........(.@.P...c...O.>.|../....%..3... cHRM..z%..............u0...`..:....o._.F....IDATx...w.e.U........S..&j.F3#.IHHHB ....@.&.K...._~.6.lcc..@6....4.%4..A..==.s.t...u......w.S.#.......j>.=.]]u..k.w.g=............|..........................Q....r../.I.cO..!...{..../......#.{t...k..Jk.8F.I.G.*..8&

<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 13 Nov 2014 06:02:42 GMT

Accept-Ranges: bytes

ETag: "88cab6f7ffcf1:0"

Server: Microsoft-IIS/8.0

VTag: 438246244800000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Wed, 07 Jan 2015 03:37:03 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..141112173206Z..150211055206Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......W0... .....7......150210174206Z0...*.H................].`...D..9.>LO.ey...Qx%.^.P.& ...D.......b}.K..[.....5.m....).....H..6R....G/ju.........:..A.#.9!......D5...|".w.x..=.u..X6.7{..).XN....g......B.8.!&...........<7fS$..........t<X)%.b(0.L@..i..Kn.......fX... ,...K\....U1cp).........y.T..?rm.t..Y.}.E..-@...

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?4a860dfad991908a HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 56928

Date: Wed, 07 Jan 2015 03:33:36 GMT

Connection: keep-alive

MSCF....`.......,...................I.................,E.Y .authroot.stl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.....................@.....L.........KNAy8/"...f.......k..Jm7j....R.5q....Rz..!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m..._.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|.@.M.._.....7._6...C.0...A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?...........WE.Or..O>..{.'W2.........3m.O.u..Z8....H4@.w}.o:?~....]<!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!.........`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=...f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..].|......3..y..-./....K..6{...s.<R`.}6....?.......-..@.g..S....

<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/style2/footer-div.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:05 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:58:25 GMT

ETag: "16a01-4e5-50b14dc30f240"

Accept-Ranges: bytes

Content-Length: 1253

Connection: close

Content-Type: image/png

.PNG........IHDR..............6.x....sBIT.....O.....PLTE.Ab..1.w.a....pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2009-11-02T15:30:41Z</xap:CreateDate>. <xap:ModifyDate>2009-12-30T07:58:27Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="hXXp://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>. . . ;.S.....tEXtSoftware.Adobe Fireworks CS3..F.....tEXtCreation Time.12/11/09........IDAT..c............%lo.....IEND.B`...

<<< skipped >>>

GET /pagead/show_ads.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 17505132066848985518

Date: Wed, 07 Jan 2015 02:39:08 GMT

Expires: Wed, 07 Jan 2015 03:39:08 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 7529

X-XSS-Protection: 1; mode=block

Age: 3235

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002

...........\ys.F.._...KQ.....5...v..I|.g.......".@...".....N..f_.....\===}.......B....I `..OM.Y..U....XD^.[..k.}!.Lc.6..>....i.C..=O.~k$"[%...E........Z.E.8LA.q.e......Y.......kI.&...W?t..)0q..r...$:..z....-...[..".e.v[[....P..a.......Z.h,...uz..E...}..7...L3viS".*.}...e...O(.T.B..k.....C...X..D......4X...C).{c.u&3m.1..F5...8..y....<...0K......J....It.:M.(.%....q.. n.L2D..R:....!..(...'.?.oX..Va:..,..c.r...h7....;.j......,Y.E.........}..]...^..;.u.3.J.......l>rx..2..........Cq...g...D.._...5]5..g1OR.*.xF.<..O...x_...|....q..7.Mc..mz.g.J...f".Y...Q.o..c......r..[..]?.v.....x747.~6...>.v...=S.....m.,.]....n..3v&.)..]<..t...<..s....x../..o.].oC</8..5..f.......;.p`..-....A.o...MkD..K.X......#..Vi..X6;<..6..!..D...4O.gD#......E...}.N._...#)....<...@.Eq.h../.._..>||..g.n.!...a....%4.c.B\0...~.......B.R.t..6."b..r....D.t,...d...'...H....Z.6.D.. ..r......W.(....S..v.-...R....-......nw.6ji....K..|.gH...U..b.B-;....c...E...x9.C.p.t........J.[.......4Q"..;B...<..t<:.u...z.....h.`t.v....>......gj?..-.>.,l=..LZ....f..b...O...)..WL.....q&../.':..@H!.............3,.K..Ki......x.8....,.r........{....'.M...7...~W.=.......i.............GO>z..$=.......3....M..|._.H;....iGh8.`.l._...|=..m~..K..9..Z.....<}w.....\..t..zQ"..LM.....7.9..$$..Ba...9Tj~c^.....dGu.%.l`....-.XX..c..Y..J..G.w...t...^...~..P$.]..A)...*.......\vi...0.../V.i.nm.E.@.......T"....z{.!..1..I.{:.7....l.H...U1b... q..Vi.m..c>.o.o..RN`.L.L......@...<.<....8..%.mKt:..7..>~btt..dh@.8s...).<.tm?.>{....

<<< skipped >>>

GET /pagead/js/r20141209/r20141212/show_ads_impl.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 14148960368062276995

Date: Wed, 07 Jan 2015 03:33:04 GMT

Expires: Wed, 07 Jan 2015 03:33:04 GMT

Cache-Control: private, max-age=1209600

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 49924

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002

............g{...0...B..u...%.....l..W..d'Nl-=l*.ZD.%......$X..}.s..w....m0.......Y.<.._...0.g.~.Fv......l>....}.P^.mg..G..\.....)..A..k%..<.[,..s[n.G..^.J.S.5.i.2[,...a.Z.3.Vg<.1.[Ni........c..~g...e..)#.5.....]........k.d..U...yNbpN...NF...y..S..)..*.1..=......'k.....y..;...wtm.~...f...A....}..d.M........hV:..U"2.\...l.[.L..1.Y....i..-y.`.mQ.ny.._.#.....x.5..D6...Z...F...L!$..M.6..A.?.|m=N....U...I0.=..u.8.:.....'...L3.....XL>.....,...P....Cr..e0......!.E1..(..@..v...E...d..m(&..}.".,..DJ.R.\...(.G..x..~.....).....e.T.d......P.p2.m.........'..8.%g2.<.N...g...k8..0S.lIX.u......B}:..C[g{?*'.....i.(./D@..N.a.r..)...Qy.J.......y...pD..f......L..M....si.....S...YY_..! .(A0x....9..CP..>l.j.1.r..S..\...}O...2m..j.]..%`u..d..r.#=.t..8K..}....h..Xd...'../.,{&:.k..9'.....%...-C..O,/.....p:..TD..{..1%o...t...S........5.u.iq.v.......m...m.2[....F..r..(.....Y..[.%.).....6.]..3.............s.3...> ..{..........8.A..R.T....Ey...`...[.Y.b...es....8^.....~8..?....f.xW2^.._.li.w.my.].hT_l.i.-..R..S.:3.......iSnA[.%t....K.m...6.A.=$..e.\......g......&..Q. N9.?....|..{.``.b..8..T.......S..S>E.A.4..w.,..s...\(ub.....'.6.{..T.0m..`.D.h...,].M.....v...d.....|..31_217.....o..!}..d/......C.Ni...x.......%.<....|x_..3.p.....NU.8](.]...........x......28.z..}....B.N..j^.(E7.fn.4...@.[....wON.U\D_/..L.....fs.dVd..e..3.X...u0n0S....MD.0..|...c....S..S\...<....J.!w.c....'..f.....F:.~&w<.L........_j/....g.~....dMNJ&...l.t.x..I.........l.~...............%.~._..>.....7..k/[[l......j...CL..uX......_..0.V.i

<<< skipped >>>

GET /pagead/osd.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 9604784682434440633

Date: Wed, 07 Jan 2015 02:38:31 GMT

Expires: Wed, 07 Jan 2015 03:38:31 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 18569

X-XSS-Protection: 1; mode=block

Age: 3273

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002

............yW...8.?...tq.F..:..5.R...h..!.K..$%S3.i..g....,'........Y[{...M...3....k1Z...vg...6B.X.%\T..ng.{U/`)....Z.._O....*oer..:..|..|.s{.L.D.`.._FI. ..I{s..<....l..A.....z.I.k......B6.......P.x.b....1...r....... .!.......4.....'..`...H....LG}O......R!:.z..AQ...h0.`....l2..[.Dt.P.5.B.`.s...n.......VHF..T.....b9.....8o.Oe......cq..yW,4t(G.......#.w!..Fy.....`uplk_..7....G..k..M.........;..:.?.4..`Sm"X..V.b..'.L..%e.,.8.....`......5..6,......q./...t ....,..wl...e}Y.;.8........gni.&...%.V=.U1.vg........`...1.![....!.I{4.Y?...R.........&........T..3Y.....%`....A..j.'X.....V t..f.X.u%.3 .6]..)7[...Grss..qW..@~P...=.......\O.)....af.y}...s...9j....j..w.{...s.....t.......c).Q".{SX....h,_t.b.o....D...>.....=..Z(T.m.o|.^..A....j.!x...o.tM..xz...y.n..)......h$...&....]..1......S.Q.7..f,.3.\...Y2....[...c.`..F... `...sq9....fen]..[..`v_......P.....4..&.....pb...r-..)z..`.r.......;)K.t%.3L.*K....r..L.s:(-.....c.....,..m.....2.(.........!....|...)|.....9|...!|.XpN.y......_.m..jy..4).5..&..;.&.E......2~,&.jO.....L...Z...b.ln....U.....,...(........d..v.{..ez?......y-.....Q:.b'.O.....x.%..&;..*.[.G......hQ..... .I..'.)T....=N...?.1..k....I.u.....c..l...`<..`q...6....X.,....4Ke/nl.C.4n........r4x....a.{^../.........)-:...q......T]..~]v..}.P......./.......{Qi...........qyIU{....^.....D....Bp..h......]"..*~..`. q.kV..@Q..t...*..2.gE...@..bo...o.k:g..}...1W...3OF35\..c..!,.S...A.n{$...R.7.SU...N3.Q.he.w..2i.p./ ......OM. j......b.~...)mbX....}`N.B(64........c.?.?.......(.j2..'.jKN>P.O.;.ch.l..6.....w..V../.e.!.(8.

<<< skipped >>>

GET /pagead/js/r20141209/r20141212/expansion_embed.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 15330149891054740749

Date: Thu, 01 Jan 2015 11:27:17 GMT

Expires: Thu, 15 Jan 2015 11:27:17 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 51194

X-XSS-Protection: 1; mode=block

Age: 489947

Cache-Control: public, max-age=1209600

Alternate-Protocol: 80:quic,p=0.002

...........}iW....w~.hr.)n...,R.?.%...%.....l...m......zQ.$2......V.KuUum.f..x...]......Y/.t.cv.........Q..n.Mf.sa...s...y}<.u'.Sw. ..\l/.{,.b..t....^7s....\....^D...7Nge/......EFG..)...E/..a:.fy..;..2.'N.F.....g.....c,.2..GOt.p.p.b.=j.S....8....h0.`....p2......z....T.`.K.....a$..M..*F..ROON..:JG...T.....3?....4......sq....\..0.M.....p:.Q...Ug..h...k3c.vC...pe.......M.#R[.L..q.d..D8T].@..Eh...)9.. ._....C..%U.HyA.B....%...M..aU.c.1..........IU9c}.\.....Se...A.a.33W{.:..s....?=..7....i.C'.........\85......>..G......}....6...k.."....n..p.{ty=.c....0......rM..9.M:.....h.......]On.X.$.Cj..1..y.U....~..W._....R.}..rj1Kt.\..l..r..b..L.miAnCu...q%..g..s..j..zu.L.......{.....pI...K.B..r<.>....=.o..5.[v8....nT...;..Q\Q.....]..'i.?..z*-m....b...W..$.,.{A|.8..g......>..a<..'OO...`m...s:.....n.......\.s.F^ 9M...OB.A_>%...=....fc$.q..a...fx..J.FA\..L.......x2...r...^c.A.rZ...n..-,y.*\..J.1.........y..N..5....|.B....I$..FO....u.s..83..a..J......:^..>O.s..5.1......<.sM.......5......[x...y.. .K.o..^.$\..n...C,#..{b9...q8...........t...........~....r..(...ItJ.Yo......N<.......c..b.....aP..=}...[8.Ch!=....h...{&]...."$.r.$....X...J.O...\.\..1o...R.....{.....7&...u.:..........H....VL.o..nU.<.... 3G...S[...l|.....'...b.9.......M..t<.y...D.<......G.\.r..3.....Q..oJ...toRU.m..=.nW.....X......*.....#..m....g..F..w.....8.[........7...............w....b..s.?O.........lf.......3I.1ws.3.~jdEvV&..5.p.y.X.N.........|.M.t...._....'.8.&L....A.^....{v..........6..... .P...~'".^yOO..$...].pMd.X...`x...D.

<<< skipped >>>

GET /pagead/images/nessie_icon_tiamat_white.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 14085932017949564970

Date: Wed, 07 Jan 2015 02:37:48 GMT

Expires: Thu, 08 Jan 2015 02:37:48 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 225

X-XSS-Protection: 1; mode=block

Age: 3316

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002

.PNG........IHDR.......*......0Kc....IDATX...A.. ..a#...F....`.".....=..=.;....<`.i.#..l...d.T7.H.S......,..\.. *.z ~...KCcI.5....f........`.t..`uhl}.3v...l].HQ 6.V..I......O2.%..^..@........Y..U..._.e..;;}2..........IEND.B`.....

GET /pagead/js/r20141209/r20110914/abg.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 4058474734652203665

Date: Thu, 01 Jan 2015 11:27:17 GMT

Expires: Thu, 15 Jan 2015 11:27:17 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 13641

X-XSS-Protection: 1; mode=block

Age: 489947

Cache-Control: public, max-age=1209600

Alternate-Protocol: 80:quic,p=0.002

...........}i[.:..w~Ep...'$...\..P(..r......i........d.K(.9.}...b-...h4..........n<..A....a.=4...,f.<..Yy...C] k.....9.4...7..ze..wO.A....jL...VD`.j.......;~.*l........v3...2d.x|...B..m.............&..NLG%.x`eOI0..~8....|...O...=...&..K.F.\;...A...vS.......Pa@.`.o......"..`...^..0.Yi.#B"....%.S..A..Xg9.N.A.wUvY..u.......v..n.@.#k..%.............H.".k...7.=..f..(....S.Q.P.......>`......l~..qd...ND. !|Ipn.(...$D..$.^...._.....X...F@...*.$..F..=1....`Cji....Y..R.. }b6...t.-GJ...........lp....!...(9CE..Yf..Ap[.......-nF........a........"..!..23....V.j.#.!xsL/...4.f2....S$21.fd...Z.T..../Ug.eF.W7.....@wz,l...7........I...rP..m..{,....v<.pQD.....:m.e.........8l...k.$SbHD..)e7.36..a0.....j......Uo.....SZ4.k{.....u],.....b......Q...9w.R...4.......T.....g...?......9.......?....;Vi..Q.....i.8...}....a.Qi...z.b5.........c.6..}..Q.z3.. t'........*....".......\./2....li#....R...R...K.L.....A..|7.....|..W...../Q-J8^,.....t.01........ ..h=....A...M...wf.............Vw.n....7t.0.].....F...!z.5.....x....ol...x.i;.V-o.a.d.SlC.....6.Uq.... ?.....s...4P].m..zNJ..ou...}X....Q..5m/(..P...m....=.G.s.TN.}eda.AH..9..1..I.... '............wtWw...cr...8{....K]....gmw<....c..R...E.93...|..........|XQ.'...!.<.o...~.......t.P.v..4H.,.9.m.n..0...NN.&....%.P....P.JM...#1..s.......L......CY..^.3..U.b. .g.\"uVK..#._;z*....9..i..........4...G5.....&.v4p4...0j.4..hlK....wb^'..-1..SU.f.e..V\..:0..?...r..TlE.2.7../....d..5..........rU_.$..o.48...uB|.v.YTa....N..E.x.....f\*.....@.2;T.Ee.m..7...&I...C.".9.N*:.4..SiN.t|..j<*..j...

<<< skipped >>>

GET /pagead/images/ad_choices_i.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 14036706360268997840

Date: Wed, 07 Jan 2015 02:46:20 GMT

Expires: Thu, 08 Jan 2015 02:46:20 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 365

X-XSS-Protection: 1; mode=block

Age: 2805

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002

.PNG........IHDR..............D.,...4IDAT8.c....fja.l.l...eXw.....W(6.d.2.|..Y..k......w..#..[..8B.a3..>.,....{.8..../}...l...^........}...4.$.....G.~.$....^.A.....2..Ig..&..{_....f...'.......f A..o<..b......{.wA....`..^|t..a5@...G.~9......q..i.!&.........0[.....~... .zHB..~.3z.#......s.o...}...........#..t.x#.a...}.......@8..0R...a0...."R.@........I.....IEND.B`.....

GET /bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Tue, 02 Dec 2014 17:50:02 GMT

Date: Mon, 15 Dec 2014 15:21:04 GMT

Expires: Tue, 15 Dec 2015 15:21:04 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 5719

X-XSS-Protection: 1; mode=block

Age: 1944722

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002

.............{.......<.....6.....c{.).....4..c.....ft.....{.k.u...\.....U.&......S......*.~S.D.....Y.. ..>_.N.T..../{..`.&;k.,......G..:H............o..I.Mf.M~. .....ieL/..e.R.9K.qL/....A.X.M...].&a.I}...).q..,.e7sA..|NN}.3..2M*....n...}..\....h@C*...qg1.'.m9..!....9.$.p.......wA:.g.U.f[..UG`..f...N,.q..j.`...&..&.#.c...c.....1......s.....laI~NF..p..Q.Sk...Af1......W&.".I.0.>DQ..X..m.Wr..T..?`.qCY'....I2v.......j...I.....E`V.x.T9.DEB.VV..."...KN.k..b4IDhU7...@...X.E..<]...".~.......&..m....j..|w....?..Sm.2\......[Q.,O. .9.p... c.......u.....]9....y6K..!H....B.,."}8.I.]........~Q....fYk....:*j..?.W.g..7.H.....Pt..t....s..w_.{z.J...[.............G.K../.....?..w..E#X...N8......q..xf. }%.v.I....A..E...p.).#...&4.)]J....}..>$.'j...4`z..'N*.1..}....|q~..7..U....cjY.la....x.^.,r...m...u...kzM)....F.:...`0..@[4.....{ .'.....>?....>.G,j.a..o..p.4JY.8...j....!].L...v@.....>...:."....-.]..ov%..&....m.*...Yj.X[..2`jT^...M......('...5.Y...9.!.sv..(}..m..{....s.6...O.Q..9:...t.I..>b.C.:..'..R8..tN....c......9..u....AY|.R}..c|p.{g..{.X.....>::>9}....?..x................`8....E<Mf..t.-.....h....~.......r....3..G..t.8=.?L...)N.i...S.h.....%k.x...$.p...x~...'.n....l0.]...a..U^...0..8...:!.n.......^.2..[.v.....r.Z]{...V.V.. j....C.6..1.4...e.....P..e...&...`.,..4.....c.1........e..N.....]..}..'..`.:..( ...).k.M{....&.[..\......F*b.C.x...\.M3C.]..M._f.,Q.E..... ......8 Vt.l4Z...*..........F...^^....di..K5....`........%_.x..4.2}h..\.V p...$.....FMgp.......q.Q:.j...^.......f...dLh6..K....-....-...

<<< skipped >>>

GET /activeview?id=osdim&avi=BFggm8KisVKv1JvGjiga8oIDgBgD1ubXv7QEAABABOAHIAQHIA8MEqBOAAQ&ti=1&adk=180657799&p=546,395,606,863&tos=1230,0,0,0,0&mtos=1230,1230,1230,1230,1230&rs=1&ht=0&tfs=1527&tls=2757&fp=client=ca-pub-2137902362367109&url=http%3A%2F%2FVVV.free-hideip.com%2Ffree-hide-ip-installed.html&correlator=4583063697160&eid=317150304%2C42631034&oid=3&afp=&output=html&slotname=8429118295&flash=10.0.45.2&dt=1420601562998&adx=395&ady=546&ifi=1&tdl=1747&abd=3-0-4&r=u&bs=1700,804&bos=1724,865&ps=1716,1440&ss=1716,901&tt=1016&pt=1742&deb=1-2-2-3-7-3&tvt=1231&iframe_loc=http://VVV.free-hideip.com/free-hide-ip-installed.html&is=468,60&uc=4 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.fr

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Access-Control-Allow-Origin: *

Content-Type: image/gif

Date: Wed, 07 Jan 2015 03:33:07 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"..Access-Control-Allow-Origin: *..Content-Type: image/gif..Date: Wed, 07 Jan 2015 03:33:07 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..X-Content-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.002..GIF89a.............!.......,...........D.;..

GET /templates/rt_dominion_j15/css/template.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e5-3cc9-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 15561

Connection: close

Content-Type: text/css

/**.. * @package Dominion Template - RocketTheme.. * @version 1.5.3 January 10, 2010.. * @author RocketTheme hXXp://VVV.rockettheme.com.. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC.. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License.. */../* Core */..body {font-family: Helvetica,Arial,sans-serif;}...font-family-optima {font-family: Optima, Lucida, 'MgOpen Cosmetica', 'Lucida Sans Unicode', sans-serif;}...font-family-geneva {font-family: Geneva, Tahoma, "Nimbus Sans L", sans-serif;}...font-family-helvetica {font-family: Helvetica, Arial, FreeSans, sans-serif;}...font-family-lucida {font-family: "Lucida Grande",Helvetica,Verdana,sans-serif;}...font-family-georgia {font-family: Georgia, sans-serif;}...font-family-trebuchet {font-family: "Trebuchet MS", sans-serif;}...font-family-palatino {font-family: "Palatino Linotype", "Book Antiqua", Palatino, "Times New Roman", Times, serif;}...rt-container {background: transparent;}..ul {list-style-image: none;}..ul.menu {padding-left: 0;}../* Header */...bodylevel-high #rt-header, .bodylevel-med #rt-header {margin: 0 -20px;padding: 0 20px;}..#rt-header2 {height: 30px;}..#rt-header .rt-block {margin-bottom: 0;}..#rt-logo {width: 320px;height: 48px;display: block;}...rt-desc1 {font-size: 170%;display: block;font-weight: bold;line-height: 1.1em;margin-bottom: 10px;margin-top: -10px;}...rt-desc2 {font-size: 120%;line-height: 1.4em;display: block;}...rt-head-spacer {height: 12px;}...header-demo {width: 510px;height:

<<< skipped >>>

GET /components/com_jcomments/libraries/joomlatune/ajax.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164ec-f8a-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 3978

Connection: close

Content-Type: application/x-javascript

/* based on xajax Javascript library (hXXp://VVV.xajaxproject.org) */.if (!window.jtajax) {..function jtAJAX().{..this.options = {url: '',type: 'post',nocache: true,data: ''};...this.$ = function(id) {if(!id){return null;}var o=document.getElementById(id);if(!o&&document.all){o=document.all[id];}return o;};..this.extend = function(o, e){for(var k in (e||{}))o[k]=e[k];return o;};..this.encode = function(t){return encodeURIComponent(t);};..this.setup = function(options) {this.options = this.extend(this.options, options);};...this.xhr = function()..{...var xhr = null;...if ('undefined' != typeof XMLHttpRequest) xhr = new XMLHttpRequest();...if (!xhr && 'undefined' != typeof ActiveXObject) {....var msxmlhttp = new Array('Msxml2.XMLHTTP.4.0','Msxml2.XMLHTTP.3.0','Msxml2.XMLHTTP','Microsoft.XMLHTTP');....for (var i=0;i<msxmlhttp.length;i ){try{xhr=new ActiveXObject(msxmlhttp[i]);}catch(e){xhr=null;}}...} ....return xhr;..};....this.form2query = function(sId)..{...var frm = this.$(sId);...if (frm && frm.tagName.toUpperCase() == 'FORM') {....var e = frm.elements, query = [];....for (var i=0; i < e.length; i ) {.....var name = e[i].name, value;.....if (!name) continue;.....if (e[i].type && ('radio' == e[i].type || 'checkbox' == e[i].type) && false === e[i].checked) continue;.....if ('select-multiple' == e[i].type) {......for (var j = 0; j < e[i].length; j ) {.......if (true === e[i].options[j].selected)........query.push(name "=" this.encode(e[i].options[j].value));......}.....} else { query.push(name

<<< skipped >>>

GET /pagead/html/r20141209/r20141212/zrt_lookup.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

ETag: 8281997907193036559

Date: Thu, 01 Jan 2015 11:27:17 GMT

Expires: Thu, 15 Jan 2015 11:27:17 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 5099

X-XSS-Protection: 1; mode=block

Age: 489947

Cache-Control: public, max-age=1209600

Alternate-Protocol: 80:quic,p=0.002

...........;.w...... z}.UT..~..(.n.~l.6.t..^`sd[....mB....f$..@.{?.9......f<..q{...?....Yc....#..S.z.)..^[.yIp....Hr......2..<.q....s.H.(..'....^LS..<]J....2?....#k...|......ic...4c.^......v!.qC...E....s..Ga.0.oc.g..}.{.....2_.1.8 ...{u..jx.......i.'.....<.....(.\.......4....(..l...."GA..$^.=...x$;.q.O.M....i,.r.]...............38X........E.a....$...}A.A.....Ix......FF.l..x.0...BZK(.....N......a. 2.<-e>W.U....en>...8.X.......}....g/.....Etky..]..fMI.G7.%.iM...i...].i..9^A.w...yz.I......h6.....-.....T.i.(....8I.p~.q.T.Y#...?.|....M.>=...j..4.... J....;.s..G].9..G....T......'N......e......P.UL*m.A.......4:....x.(.........p.u.Ij!x..c..4...A.\D...mY.<_d}g.....6..1l;...0hY}.^.c...O..<..dle.0n<l...Q.MI.@.6[& j.y..Jt.....Q.7.....J..~M|.I...n...%M.....FtF.u.....$...})......#N.~..h.........6......._...8.mcx!....21.G.g.hyZ...x..V j......x.IWro..Z#...lP.\^.}...S..H...).[F..&..2......=0........v[..z.8.c... ......k....6..."x.@k.......D.&..*g.J=.K..@.....4...R..o.T......D`..)..P1.NP7......1p.....2@..*"...N....GTQ......g.Y<.@X....u2....U ...=...$..M....3..Y..X1#ZI...V..B.-......4....1w7..@..=...)(y.....l...ka.M...pohU.:CZa..!:..s..6...*[z...........#.....n...1.........i..._>....N.Ac.....4..>.'.:......s.w6...^..?.....-H.F.,o..;]ZxD.^.=.A;...I...4..2@.....P@.4....D};..W['...O.>!......6g..a....n.`j..d...........=..........T~^.,..k.....Z.$.TXR......H..".y....}.s.>.....k...0O..x.5...K.vTa9.8..._..h.....I..*|^..E.p.....a...h._..V3...\P./.... ....Q.E..$..E8^r%.2....$..|x.,./..h..O.BGf.

<<< skipped >>>

GET /pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: cafe

Cache-Control: private

Content-Length: 30433

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002

.............W.J.0.W..."].c.@.....[..IH..i-..e..2K...UUwkw...;o9w..K.......^.s.v.8r .h..X..].|X.{A......t.h.Z\...h\..C.w..7.....=..;l....3.Y.j...a..F....t........G..w]7R*...D.C....k...{...0l....8.....y.#f..............^...#.8..k.).......'...k.B..G,t..../.^...f.....yo.. ..}.t8`......1.k..Okc;....jg..Qo...... ..u{c.c.....L...SaF..*C...#.4-.^!.....q......!{.B7.....E1.y.....b...m...(.FCl........f3.........o...._AOl...[&.u.r=? .d`.!..!.|7........vz..(s.............F.{.-...qa....?...L..s.wv[...oi.8....aUI... S......L .A)..8.@@..f...5.k=.....E..5.Z..z...!.E.C]...&.....;...'...V..~..N=SQx]....3.....p.]<..2E{~....*......=..))pp...%F..;...*...B...h.?.w.M6vU-.u.Z.^..........6_...oc...[8a.#N....}.L.P.s.1........T...Q.2....-...?5....?.gC[l......[....N.lU...n..U....>............0*3.?..>...i..e....HD'.*..95@...A.....`....a...u..`.....Y.....[...a...AGh>M.{....8....9../.U..T.-.1...|....F[.....{...m*..-*....?..J0Pt[...?Z..,..'......,Y..``*....\.6Y.'Um^..p.o.A........9h...Xc>.uH...t..f.....2.[Kk.@.m...S.f2.f6....c.......*j....Z8.....I-<..R.O.T..R.."...P.NL-..X;3.E'O-.|............Zj.7.......C-...v.Z.....k...?....j.Kja........n.....J$..J..._/. ..........s..9..#%...5.......6.....8.A.I......'A..D..V0.......E.....Ry..N.....ny.um....wa`..#2.i..7.]U...!.H.}..u'E.l...p.X..Z-....\...RDG.-..v.":Z..PD;O.1.6. ..i...A....x:..{PI..'..~e..i.o.@c|..R.....0.. ....y..e...y..y..y..@./.zSo\..FP6b...g....{......k.'U.........!g&..H....X.,-....b.......~...)....n....^......fM.h...Y.q...>..0G...^3lLe~..X..v..q.R.p........ ..7.f<.

<<< skipped >>>

GET /pagead/drt/s?v=r20120211 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

X-Frame-Options: ALLOWALL

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 02:39:50 GMT

Server: safe

Content-Length: 145

X-XSS-Protection: 1; mode=block

Age: 3195

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002

..........%....0.Ew...]....h..F....x.$-....o..=..9..t..g{.Kwk.}..k]e.fk....$...-...<o....RxzyZ...ML..bwX.).g.#..r..2....,U.....Q......M./6PzR........

GET /pagead/drt/s?v=r20120211 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

HTTP/1.1 200 OK

X-Frame-Options: ALLOWALL

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Wed, 07 Jan 2015 02:39:50 GMT

Server: safe

Content-Length: 145

X-XSS-Protection: 1; mode=block

Age: 3195

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.002

..........%....0.Ew...]....h..F....x.$-....o..=..9..t..g{.Kwk.}..k]e.fk....$...-...<o....RxzyZ...ML..bwX.).g.#..r..2....,U.....Q......M./6PzR....HTTP/1.1 200 OK..X-Frame-Options: ALLOWALL..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Date: Wed, 07 Jan 2015 02:39:50 GMT..Server: safe..Content-Length: 145..X-XSS-Protection: 1; mode=block..Age: 3195..Cache-Control: public, max-age=3600..Alternate-Protocol: 80:quic,p=0.002............%....0.Ew...]....h..F....x.$-....o..=..9..t..g{.Kwk.}..k]e.fk....$...-...<o....RxzyZ...ML..bwX.).g.#..r..2....,U.....Q......M./6PzR......

GET /images/stories/app/home/logo.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:36 GMT

ETag: "1685a-26cf-50b147c498e00"

Accept-Ranges: bytes

Content-Length: 9935

Connection: close

Content-Type: image/png

.PNG........IHDR...@...0.......4.....tEXtSoftware.Adobe ImageReadyq.e<..&qIDATx..}{|....<g.$$@.$.5.h..@..E........]W.]k...v........kW...ZE.....Z.J...(B.\.(.@.$..\....-!!y...9...33g.oB....8...w.\..s?g.*>.:}.....?.?....o..7...pQ..00.....U.QE.w.)...1.....At..v*C...2....q...Ll5...wX.....T.)o62..Hjyzz...F..o6W..........6D..<....Ab.N..O.Uf..|..f.V...?P!A.....{....O. .?..........RNv~.&Q...G.$p..3....#/.....X...i..H..W....w..;.A..7..".)....mEH.S 9... .Hc......i...h....E/..fR....j.1......`...q..f....R....[........ I.5.w.D#X...~..!../...&A.R7.&......=..S.W..v....6.c.V:52..|....l....W......l....=..~.... ..6d...6.W....,....p.L.W:..../%p.....h.=G.W.R.xZm0....*...9I`..5k.........P_ Q.....R.;8.uI...\.4b8...6z.S._.P....1.P3...L....z#.#.L.`...7...?f...x.j......g..Wf.p..g3V.$.O....4z.>2.`...h.....3.<,F.%N..~.I....<...P.y..@h. 8V.w.......{.....\.....J9.<.......9.. =i.9v|........b..E3#..7u.....J.....X..N..c.......O..gf..]....I..$.....:..... @..D..20.P'G.T..dy......R..C...P..L&...!..$_.."g....A..Y..'N.......[6..-..,.8 2^. ...k.n....Y..r....~..K.M.5U6.m...o.5....r..0.T...|..1....t..7.......>r..._:..A.....).&.....b.FW..]U9.....i<|..k..44.....7.(.o. G....q..a.-..G.-\...y...h.8..r>..i3....n..... ..G.....[.t..Q#..O_...`.4J..5.....?[...5..8.).@....X3...........?....5.....mp.lB..8.\..a.#._v................*u.`...r.\......^...%Kv....G.n..~.6D. ....2...6.;_.....q.!.YJ.......y....'.9I..f.=.X........}.[K......h..I....w.xK..U^V...g...y<........./.....#.."S^6p..?....1..{....7..b...O.D.D....{.......<}..% ,.

<<< skipped >>>

GET /media/system/js/mootools.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164f0-122c2-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 74434

Connection: close

Content-Type: application/x-javascript

//MooTools, My Object Oriented Javascript Tools. Copyright (c) 2006 Valerio Proietti, <hXXp://mad4milk.net>, MIT Style License...var MooTools={version:'1.12'};function $defined(obj){return(obj!=undefined);};function $type(obj){if(!$defined(obj))return false;if(obj.htmlElement)return'element';var type=typeof obj;if(type=='object'&&obj.nodeName){switch(obj.nodeType){case 1:return'element';case 3:return(/\S/).test(obj.nodeValue)?'textnode':'whitespace';}}.if(type=='object'||type=='function'){switch(obj.constructor){case Array:return'array';case RegExp:return'regexp';case Class:return'class';}.if(typeof obj.length=='number'){if(obj.item)return'collection';if(obj.callee)return'arguments';}}.return type;};function $merge(){var mix={};for(var i=0;i<arguments.length;i ){for(var property in arguments[i]){var ap=arguments[i][property];var mp=mix[property];if(mp&&$type(ap)=='object'&&$type(mp)=='object')mix[property]=$merge(mp,ap);else mix[property]=ap;}}.return mix;};var $extend=function(){var args=arguments;if(!args[1])args=[this,args[0]];for(var property in args[1])args[0][property]=args[1][property];return args[0];};var $native=function(){for(var i=0,l=arguments.length;i<l;i ){arguments[i].extend=function(props){for(var prop in props){if(!this.prototype[prop])this.prototype[prop]=props[prop];if(!this[prop])this[prop]=$native.generic(prop);}};}};$native.generic=function(prop){return function(bind){return this.prototype[prop].apply(bind,Array.prototype.slice.call(arguments,1));};};$native(Function,Array,St

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/css/joomla-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:56:02 GMT

ETag: "16943-297-50b14d3aaf080"

Accept-Ranges: bytes

Content-Length: 663

Connection: close

Content-Type: text/css

/**. * @package..Gantry Template Framework - RocketTheme. * @version..2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */...rt-joomla .rt-headline, .rt-joomla .rt-article-content, .rt-joomla .rt-article, .rt-joomla .rt-article-bg {zoom: 1;}../* Side Menus */.#rt-main ul.menu li, #rt-main ul.menu li a {zoom: 1;}../* Typography */..rt-pagination .tab {display: inline;}..rt-pagination .page-block {display: inline;}../* edit button */..rt-joomla .edit img {filter: alpha(opacity = 0);}..

GET /plugins/system/rokbox/rokbox.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:34 GMT

ETag: "164f2-563c-50b147c2b0980"

Accept-Ranges: bytes

Content-Length: 22076

Connection: close

Content-Type: application/x-javascript

/**. * RokBox System Plugin. *. * @package..Joomla. * @subpackage.RokBox System Plugin. * @copyright Copyright (C) 2009 RocketTheme. All rights reserved.. * @license hXXp://VVV.gnu.org/copyleft/gpl.html GNU/GPL, see RT-LICENSE.php. * @author RocketTheme, LLC. *. * RokBox System Plugin includes:. * ------------. * SWFObject v1.5: SWFObject is (c) 2007 Geoff Stearns and is released under the MIT License:. * hXXp://VVV.opensource.org/licenses/mit-license.php. * -------------. * JW Player: JW Player is (c) released under CC by-nc-sa 2.0:. * hXXp://creativecommons.org/licenses/by-nc-sa/2.0/. * . */..eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w '};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c])}}return p}('V.6f({\'2K\':D(){L 8.1D(\'2C\',\'\')},\'1U\':D(){L 8.1D(\'2C\',\'3C\')}});8A.6f({\'8v\':D(){l 6i=/^(25|6h):\\/\\/([a-z-.0-9] )[\\/]{0,1}/i.4S(I.35);l 1x=/^(25|6h):\\/\\/([a-z-.0-9] )[\\/]{0,1}/i.4S(8);L 6i[2]===1x[2]}});l 43=B 6T({2Y:\'2.1\',t:{\'1L\':\'8y\',\'6M\':\'8I\',\'1I\':2p.4d.4k.8S,\'1J\':4c,\'4x\':40,\'1g\':\'6K\',\'2U\':M,\'5W\':8T,\'4C\':G,\'36\':M,1j:{\'33\':\'#8U\',\'1e\':0.85,\'3t\':8P,\'1J\':4c,\'1I\':2p.4d.4k.6S},\'6x-6s\':0,\'6v-2T\':0,\'15-u\':50,32:{\'C\':6k,\'u\':8K},\'22\':\'M\',\'2N\':\'G\',\'1b\':\'#8J\',\'5d\':G,\'3c\':\'5p\',\'3X\':G,\'3Q\':G,\'3V\':M,\'3P\':G},6W:D

<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:34:07 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=df68309f24c39dde510d31875080618571420601647; expires=Thu, 07-Jan-16 03:34:07 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Mon, 05 Jan 2015 22:10:47 GMT

Expires: Sun, 11 Jan 2015 03:34:06 GMT

ETag: "6cb83c5a0979f7a013d3af9d841ab7d42bcceae2"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1a4d190654b71577-FRA

0..........0..... .....0......0...0..........<.|7...@N6p.I.e|..20150105221047Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.{.....Z..w...d..\.-....w.....20150105221047Z....20150109221047Z."0 0... .....0......20140105221047Z0...*.H.............<.7.1...@2....f.M.?]. ..._:..2.&7.o #!..].VkT3..8~....c....9F..{!Q....-...`.....!..~RJ...iVu.Uo..Q.whi ,Lr..@...K..1..?.K2`Qu...&w.<..gA.pNV.L.....sk.[.N.z.-_.T@....f.q.[...v..\..,..%..A@d"r.ZQ )...-.w..Qv..z;.tu..R..7.....B...V..{....pJ..n........H;1#...b....0...0...0..........Z..~..M..<ZYJ....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Should be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q...........bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... .......0... .....7....0.0... .......0... .....0......0...*.H..................sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..

<<< skipped >>>

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com

HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Wed, 07 Jan 2015 03:36:59 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..141210000000Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2....{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N....* ....010207212031Z0!..N....-.1Gq.@...C..040401175251Z0!..Y......w`G........070411175657Z0!..Z`..H.@B....Z.*q..080403172017Z0!..l....I...Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ....>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r../=l..?...9..V0..@Tk......fn?....0.A.HTTP/1.1 200 OK..Server: Apache..ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT..Date: Wed, 07 Jan 2015 03:36:59 GMT..Content-Length: 933..Connection: keep-alive..Content-Type: application/pkix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..141210000000Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=494186, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 20:49:30 GMT

Expires: Mon, 12 Jan 2015 20:49:30 GMT

Date: Wed, 07 Jan 2015 03:37:04 GMT

Connection: keep-alive

0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..20150105204930Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V.......K3.....20150105204930Z....20150112204930Z0...*.H.............$M.....sd...e&...|.W3.y........bQ.N.I.nT.. A.G^fJ.@3(...Z.......&0*..u.n......uC......^...0e..W..J..wD8....u..G....?i.r...k.R.....tx.x...c.f.m.R.....el\.sG.......c%.h%.d...w"....RT...G...@q...o.F.*6...F......".._..s.....e...:..;X$..:......rb.9%G..Z..Hl...n....0...0...0...........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 30.."0...*.H.............0...............2&..PL...,..2....:..tH...`JG.%..*...s.c%...?t..J..0.q....~..k@X.l.i....0..kk..h.9"1.5?..s.....3[...u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.....@2$"..$l.B.......D.ye..(..2.........@...... ...."... E..0M,..b{.^..s'....f.6.pr4.J........'j..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0!..U....0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..eUNp0...U.#..0.....e......0..C9...3130...*.H.............(.&..Dgr.Ve..#...5.N.v.Q

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEG4KXix8eJvaF19Xf/1VSWE= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=398209, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 18:09:20 GMT

Expires: Sun, 11 Jan 2015 18:09:20 GMT

Date: Wed, 07 Jan 2015 03:37:04 GMT

Connection: keep-alive

0..........0..... .....0......0...0......u\..3Oo?U...H.....O!..20150104180920Z0s0q0I0... ...................F....0.yV......{&.K......&.......n.^,|x..._W..UIa....20150104180920Z....20150111180920Z0...*.H.............\.A.5...o..-.....K.1._.;......<P.&=4.......n ...$l.k.$....)..:S.x......r.R.....;S..x..8XHP.=....s....y.D...ynv...J!.o..M...0.......o}.p..n.`yx.|I..p...JUT.v...4...n].T_`)......K{..lP.m{.=%#.<.rc^..w.g.....).}.a..3a&'.5u.........&.Z.&.|\..6....>.xA.............0...0...0........../...nj0...}..i..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...141204000000Z..150304235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0.........4.4...........o....?..f.........I.!.b.L...L..U.........rM.,.....=..cR4d.~*..k..x......=.WT.<.A2n1.qZyM.M..Q_...8....9....d.... ...'.........h..Z..I...(.b.jK..DO.ra..gb..j..A.(....mrzU.w.......Bv...l.:s..L....y.....u..n.)W......Y!....Q...,.i|.....:.Mu..DD1.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24600...*.H..............pjd....VpE.6.tO..@.....7.=.. ...........hi.......>.

<<< skipped >>>

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:34:06 GMT

Last-Modified: Thu, 01 Jan 2015 15:18:48 GMT

Server: ECS (frf/8799)

X-Cache: HIT

Content-Length: 1406

0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..20150101064605Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M....'.G....20141203203331Z....20150331203831Z0...*.H.............H...y5p...Z...%...y.......w.>1......XZ.5(.X....D......~.....G...."1...8J.g.y..5.. }.1._..@.c..@eE..j....i.Mp..(..!..c.....r....&,|....G3...[.F..(...;A<.{;Bs.%Q....M:8........G.nKu}.97.......p..?.n_.#..d.. .N@.M..IF[...X.lP.;.5'...v...-.....*l.8. ...e.?.q\.....0...0...0...........'..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root0...140122184236Z..150122184140Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM..*.4.MP..../D4n.=ZTeH.B=kOT.v..2@F.2L..A...yn.4......fP...L...2.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>.O....G.A........0..0... .....0......0...U.......0.0...U...........0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ..k.F..^|A.Tb0...*.H.............. .p.)...09W..Z.......]....}.:..Vr.....c..U..:V^.O.....<...b*5.c.\.fF./....5'.>./ iS..R0..)..*.!..q.h.T..ul.}&.......`.1".~.U....rB.BR.s..x..o..Y.......).4:.[.9.=....x...'.f..\ kC......@I....G:J!.hRH..!z2DtL.s2.r.....Yi~..E..AzO..i.."N.$j...b...o..i."{(3....

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/css/gantry-ie6.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:55:54 GMT

ETag: "16942-4b2-50b14d330de80"

Accept-Ranges: bytes

Content-Length: 1202

Connection: close

Content-Type: text/css

/**. * @package..Gantry Template Framework - RocketTheme. * @version..2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */..#rt-top, #rt-header, #rt-menu, #rt-showcase, #rt-feature, #rt-main, #rt-sidebar-a, #rt-sidebar-b, #rt-content-top, #rt-mainbody, #rt-content-bottom, #rt-bottom, #rt-footer, .rt-container {zoom: 1;}../* IE6 Warning */.#iewarn {background: #C6D3DA url(../images/error.png) 10px 20px no-repeat;position: absolute;z-index: 1000000;opacity: 0;top: -150px; margin: 0 auto;font-size: 110%;color: #001D29;z-index: 8000;}.#iewarn div {position: relative;border-top: 5px solid #95B8C9;border-bottom: 5px solid #95B8C9;padding: 10px 80px 10px 220px;}.#iewarn h4 {color: #900;font-weight: bold;line-height: 120%;}.#iewarn a {color: #296AC6;font-weight: bold;}.#iewarn_close {background: url(../images/close.png) 50% 50% no-repeat;display: block;cursor: pointer;position: absolute;width: 61px;height: 21px;top: 25px;right: 12px;}.#iewarn_close.cHover {background: url(../images/close_hover.png) 50% 50% no-repeat;}..

GET /templates/rt_dominion_j15/lib/gantry/css/joomla.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e3-2dc3-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 11715

Connection: close

Content-Type: text/css

/**.. * @package..Gantry Template Framework - RocketTheme.. * @version..2.0.3 January 10, 2010.. * @author..RocketTheme hXXp://VVV.rockettheme.com.. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC.. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License.. */../* Headings */...rt-joomla h1 {letter-spacing: -2px;}...rt-joomla h2, .rt-joomla h3, .rt-joomla h4, .rt-joomla h5 {letter-spacing: -1px;}...componentheading {font-weight: bold;display: block;margin-bottom: 15px;}...contentheading {font-size: 140%;font-weight: bold;margin-bottom: 15px;display: block;}../* Section Tables */...sectiontableheader {font-weight: bold;padding: 3px;line-height: 25px;text-align: left;}...sectiontablefooter {padding-bottom: 8px;}..tr.sectiontableentry0 td, tr.sectiontableentry1 td, tr.sectiontableentry2 td, td.sectiontableentry0, td.sectiontableentry1, td.sectiontableentry2 {text-align: left;padding: 6px 5px;vertical-align: middle;}..tr.sectiontableentry0 td, td.sectiontableentry0, tr.sectiontableentry1 td, td.sectiontableentry1, tr.sectiontableentry2 td, td.sectiontableentry2 {height: 30px;}...contentpane, .contentpaneopen {width: 100%;}../* Column Layout */...rt-joomla .float-left {float: left;}...rt-joomla .float-right {float: right;}...rt-joomla .width25 {width: 24.999%;}...rt-joomla .width33 {width: 33.333%;}...rt-joomla .width50 {width: 49.999%;}...rt-joomla .width100 {width: 100%;}../* Blog Layout */...rt-joomla .rt-blog .rt-description { margin: 10px 0px 15px 0px;padding-bottom

<<< skipped >>>

GET /favicon?q=tbn:ANd9GcReSaXCC2MAHzTS01g7TjEwIe8oX3B4FmQweFpVjdKFz1OlANtg9MkAb1JsXMSuWpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t1.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Mon, 22 Dec 2014 17:49:40 GMT

Date: Fri, 26 Dec 2014 23:52:25 GMT

Expires: Sat, 26 Dec 2015 23:52:25 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 315

X-XSS-Protection: 1; mode=block

Age: 963640

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002

.PNG........IHDR.............(-.S...fPLTE....*?......z.........=8...8P2'HZ......./DDY/Sc Gds*F5....>Q...5Ue.9:....4HPkztz#bz...>...Yg*....2<.5;D.......IDAT..M....0....$!...W..?.@B.<XZ.....B.......n.s.@.s....C.$g.#..C*....(.Y..O........-&|..H.7&.a.).......E.\......'R9..v....xQ.o..=s.<..............V/.......IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Last-Modified: Mon, 22 Dec 2014 17:49:40 GMT..Date: Fri, 26 Dec 2014 23:52:25 GMT..Expires: Sat, 26 Dec 2015 23:52:25 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 315..X-XSS-Protection: 1; mode=block..Age: 963640..Cache-Control: public, max-age=31536000..Alternate-Protocol: 80:quic,p=0.002...PNG........IHDR.............(-.S...fPLTE....*?......z.........=8...8P2'HZ......./DDY/Sc Gds*F5....>Q...5Ue.9:....4HPkztz#bz...>...Yg*....2<.5;D.......IDAT..M....0....$!...W..?.@B.<XZ.....B.......n.s.@.s....C.$g.#..C*....(.Y..O........-&|..H.7&.a.).......E.\......'R9..v....xQ.o..=s.<..............V/.......IEND.B`...

GET /templates/rt_dominion_j15/images/menus/style2/topmenu-daddy.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:58:25 GMT

ETag: "16a06-536-50b14dc30f240"

Accept-Ranges: bytes

Content-Length: 1334

Connection: close

Content-Type: image/png

.PNG........IHDR.............Br......sBIT.....O....!PLTE...............o..0^}/]| Rs.Qr.9_.w&^....tRNS...........JO......pHYs...........~.....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2009-01-25T19:51:15Z</xap:CreateDate>. <xap:ModifyDate>2009-12-30T19:12:18Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="hXXp://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>. . . ..y^....tEXtSoftware.Adobe Fireworks CS3..F.....tEXtCreation Time.1/25/09..2..../IDAT..cX........Y r...\e.."....* .B....D..._. ...#j..|d....IEND.B`...

<<< skipped >>>

GET /images/stories/app/common/button/buynow.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:39 GMT

ETag: "16894-a4a-50b147c7754c0"

Accept-Ranges: bytes

Content-Length: 2634

Connection: close

Content-Type: image/png

.PNG........IHDR...l..........DZ.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...whU....&...c... .n.b........wT.D..F..b....("."...........5z..3..e=.-y.$..]89egwf.;m..........w..s.....cy.......kQQQr..7.)Q..9v...C.......k.....iii........_.c...j.....bs...<x.8.. _.|..O[.....kW.n..9...g.o......r.B.v...Y..{.N....1....'N.....?H?... .r....<..?~....;u...q..&M.H.....6....z#.)...'.........GD......78..[.pa)04.E......(0..*T.`N.>],......K ..?~....?.....E...P...3g.x...W7....)..S.. j9.'O...s..stoG8..#...J.......^.l.........1.........?P.v.v..xm.V.........X......~...63{`V..7o.4.'O6u..._.{.6....8...2.....b.w....=.Y.f.^.z.n....{.^.........?X..q....xJ...G.E.......3.~.......#..Xi...Z......o...c..=*..2d.i....8m.4s...Lc..U...T.}.vq.@..c.....7N.k...j*U.d...g.L...W ...C..6......|....<yb...o..=S.pc..Ei.s....@.!..Yc^.|ij..iv..) m..A.....)....A....4h.@..F.x..Y.r..p..-.6# ~.vC...m....:u..={.|.`.^..,Y"...ukS.vm..aC........L.^..T%.y.....;:...3../65j...X....E../<..{..b$.N]..qM.P...iii..E.!...O.n.........H...p...3g......7..r......g.....w.U^._.G.p.b.....6.t..E.....#...wM..-E&.KNN..;..d..P<..a.J..h.T...>|../:4<......;Y...X.....&C......9..y.._.~...>|h.-.x....L.......9b..y#.....;gbbb..Q.dqn.g...?...Kt.O.X.n..3...|..].F.......y.Xt..e....%.......}..?~\.....;T.....3.<l......2.o.>}..M.Dn.....R..,..tre.q.j.N.0.....:..........y..._X.OKW...?6.K.....4.tWwX 2..!...3eq<C.....B.s....<,.o...M.6.y0..........x.S...:.5.......x`4U.T......p...w.o.....1..a..y......'O.P.....?....A9.../..z......{@m....Z..ioE...d.<...)...e

<<< skipped >>>

GET /templates/rt_dominion_j15/css/joomla.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164e0-5538-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 21816

Connection: close

Content-Type: text/css

/**. * @package Dominion Template - RocketTheme. * @version 1.5.3 January 10, 2010. * @author RocketTheme hXXp://VVV.rockettheme.com. * @copyright Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */./* Article */..rt-joomla .rt-article {margin-bottom: 35px;}..rt-joomla .rt-articleinfo {margin: 15px -12px 0 -12px;padding: 5px 11px 5px 0;overflow: hidden;}..bodylevel-low .rt-joomla .rt-articleinfo {padding-bottom: 15px !important;}..rt-joomla .rt-articleinfo2 {float: left;height: 24px;padding: 0 15px 0 12px;line-height: 24px;}..rt-author, .rt-date-posted, .rt-date-modified {display: inline;text-align: right;font-weight: bold;margin-bottom: 15px;letter-spacing: 0.1em;margin-right: 6px;font-size: 12px;}..rt-date-posted, .rt-date-modified {padding-left: 8px;}..rt-author span, .rt-date-posted span, .rt-date-modified span {display: inline;font-weight: normal;font-size: 12px;line-height: 1.2em;text-transform: none;letter-spacing: normal;}..rt-joomla .rt-article-cat {margin-top: 10px;margin-bottom: 15px;}..rt-joomla .rt-headline {margin: 0 0 15px 0;}..rt-comment-block {display: block;float: right;}..rt-comment-badge {display: block;width: 44px;height: 32px;margin: -4px 0;float: left;font-weight: bold;}..rt-comment-badge:hover {background-position: 0 -37px;}..bodylevel-low .rt-comment-badge {background-position: -56px 0;width: 36px;margin: -4px 5px -4px 0;text-shadow: none;font-weight: normal;}..bodylevel-low .rt-comment-badg

<<< skipped >>>

GET /templates/rt_dominion_j15/lib/gantry/js/gantry-ie6menu.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:57:20 GMT

ETag: "16974-416-50b14d8512000"

Accept-Ranges: bytes

Content-Length: 1046

Connection: close

Content-Type: application/x-javascript

/**. * @package..Gantry Template Framework - RocketTheme. * @version..2.0.3 January 10, 2010. * @author..RocketTheme hXXp://VVV.rockettheme.com. * @copyright .Copyright (C) 2007 - 2010 RocketTheme, LLC. * @license..hXXp://VVV.rockettheme.com/legal/license.php RocketTheme Proprietary Use License. */..var sfHover=function(B,C){if(!C){C="sfHover";}var A=$$("." B).getElements("li");if(!A.length){return false;}A.each(function(D){D.addEvents({mouseenter:function(){var F=this.getProperty("class").split(" ");F=F.filter(function(G){return !G.test("-" C);});F.each(function(G){if(this.hasClass(G)){this.addClass(G "-" C);}},this);var E=F.join("-") "-" C;if(!this.hasClass(E)){this.addClass(E);}this.addClass(C);},mouseleave:function(){var F=this.getProperty("class").split(" ");F=F.filter(function(G){return G.test("-" C);});F.each(function(G){if(this.hasClass(G)){this.removeClass(G);}},this);var E=F.join("-") "-" C;if(!this.hasClass(E)){this.removeClass(E);}this.removeClass(C);}});});};window.addEvent("domready",function(){sfHover("menutop");});..

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "0e20e453051989d614010fc5777516e5:1420601426"

Last-Modified: Wed, 07 Jan 2015 03:30:26 GMT

Date: Wed, 07 Jan 2015 03:33:05 GMT

Content-Length: 878

Connection: keep-alive

Content-Type: application/pkix-crl

0..j0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..150107030300Z..150117030300Z0..R0....X...140427081922Z0....v...140618150003Z0........140429180917Z0........140709194633Z0........140416233935Z0........140521155053Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140606204021Z0........100729164439Z0....x...140507204001Z0........140606222139Z0....%...020514181157Z0....S...140423105438Z0........140725020038Z0........100729164732Z0....M\..140430000442Z0.....-..140617185011Z0....V...140624123102Z0........120627171025Z0........100301134531Z0........140618143256Z0........120627171017Z0.....>..140711125531Z0....[...100730213120Z0....j...140226123519Z0...*.H............KS......%.-*....3...>.GF4....|V.|(t.D..V.z......j..0x.D..,X[....N.<....zD'..{.9.=6w....)...>L.?x.v|......>5L.R..S..x..1q[....f..HTTP/1.1 200 OK..Server: Apache..ETag: "0e20e453051989d614010fc5777516e5:1420601426"..Last-Modified: Wed, 07 Jan 2015 03:30:26 GMT..Date: Wed, 07 Jan 2015 03:33:05 GMT..Content-Length: 878..Connection: keep-alive..Content-Type: application/pkix-crl..0..j0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..150107030300Z..150117030300Z0..R0....X...140427081922Z0....v...140618150003Z0........140429180917Z0........140709194633Z0........140416233935Z0........140521155053Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140606204021Z0........100729164439Z0....x...14050

<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

Cookie: __utma=56730365.308850550.1420601563.1420601563.1420601563.1; __utmb=56730365.1.10.1420601564; __utmc=56730365; __utmz=56730365.1420601564.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:06 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:32:22 GMT

ETag: "1689a-9f6-50b147f077580"

Accept-Ranges: bytes

Content-Length: 2550

Connection: close

Content-Type: text/plain; charset=UTF-8

..............h...&......... .h.......(....... ...................................LO...!..."..."..."..."..."..%)..*-..,/..#&..%)..15..:=..."...#.. $..15..WZ..RU..VZ.._c..df..jm..rt..wy..tv..z}..be..ik..ru..QT..[^..[^..^`..jm..or..qt..vx..|~..{}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ..............."......................................... ...........(.......%...............)...............#*.................................................. ................&........"........$....'.............................%[..5................|..................................(....... ..... .....@........................................... $...... $...................................".. #

<<< skipped >>>

GET /free-hide-ip-installed.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.free-hideip.com

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:02 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 13:40:48 GMT

ETag: "16b24-49a3-50b1eac1c1800"

Accept-Ranges: bytes

Content-Length: 18851

Connection: close

Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >..<head>... <base href="hXXp://VVV.free-hideip.com/free-hide-ip-installed.html" />. <meta http-equiv="content-type" content="text/html; charset=utf-8" />. <meta name="robots" content="index, follow" />. <meta name="keywords" content="Free, Installed, Clear, Cookies, Downloaded, Solution, Easily, Price, Hide, Mozilla, Firefox, Explorer, Internet, Purge, Also, Provides, Domain, Protecting, Activities, Privacy, Improving, Performance, System, Offline, Online" />. <meta name="title" content="Free Hide IP Installed" />. <meta name="author" content="Administrator" />. <meta name="description" content="Free Hide IP Installed has been installed successfully. Get for free when you complete an offer with TrialPay. People who downloaded also downloade..." />. <meta name="generator" content="Joomla! 1.5 - Open Source Content Management" />. <title>Free Hide IP Installed | Free Hide IP</title>. <link href="/favicon.ico" rel="shortcut icon" type="image/x-icon" />. <link rel="stylesheet" href="/plugins/system/rokbox/themes/light/rokbox-style.css" type="text/css" />. <link rel="stylesheet" href="/plugins/system/rokbox/themes/light/rokbox-style-ie6.css" type="text/css" />. <link rel="stylesheet" href="/templates/rt_dominion_

<<< skipped >>>

GET /s/slabo27px/v2/PuwvqkdbcqU-fCZ9Ed-b7RsxEYwM7FgeyaSgU71cLG0.woff HTTP/1.1

Accept: */*

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://googleads.g.doubleclick.net

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: font/woff

Last-Modified: Mon, 11 Aug 2014 21:03:10 GMT

Date: Tue, 09 Dec 2014 02:38:32 GMT

Expires: Wed, 09 Dec 2015 02:38:32 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 20060

X-XSS-Protection: 1; mode=block

Age: 2508873

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002

wOFF......N\.......H........................GDEF.......'...(.I..GPOS.......\...L....GSUB.......A....S%QgOS/2...H...W...`k.c.cmap.......W.......tcvt .......9...:....fpgm...4.......a.A..gasp...,............glyf...<..=.....a.\.head..F....6...6...2hhea..F........$....hmtx..G.........m...loca..H............2maxp..J.... ... ....name..J........J..1.post..K........F.F..prep..M.........i..Bx.c`d``.a..&.. ....`..$.1<..O.~30..'..f.x.....fg....j...c..X..m.6......=."lT.....>k{......~................1@S....Y.....bBR.$%.....D...qY...........8...E.......j....Q......>.8._...4......Y..h>.......!.-.) C....".Z.i...%...U_.Q.0S..S.6S..S.!S.3...3......x..y.<H-'y.o...<L..#.*S.*T.*Uk..k..j..k.fk..j..k..j..k..j.VR.j..z.7h.6i..h.....c<...}[..S......-U..U.JU.Z......w..<..*T.e.o.m..N.jP...sW......<.4.w.7.v!Oz|F....o.c:..:..%_.) O.j.....*..j...j.I..E].M..C.......-....x..mN..B...{<.1...1.#..UE*V.r....]2E.K........u.._..~.....-...jU.z5...7.]..s.<W9F..JH.......s..s.%.?x...u.Z..<b......,7....W.^...%........... z... ...iV/..Zr.z.g.v...#........mhK{....B.)..r*...G.Dg...nt.. z....c.....&1...d=...&6....a/.8.!..mj........b..C.C..K[...I.g....ND.b...*W=jr.DwR...c_...I1...3.NG.$...D.4...B.3.....0..L...PK.G.%&.....5i.&M[...qV.........=<:...&`0C..n".2...&b...h...N61S....f...,$`...XaB....`".49<crp.......E&.*x.m.3..Q....9....b.^.mc..[.......>G.\Kzn..<._BC....,..N}m.....V9i..j.fL._.._.Hr...C...!.U..x.....Y.|.^.......t.5.d.24A....`...~...W_R)k...4X.4.]..Q..1....*...?*...KkdO.?..?5..L..z.c.1..c.%V.`.....0.P..

<<< skipped >>>

GET /templates/rt_dominion_j15/images/body/style2/header-bg-low.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:57:24 GMT

ETag: "16976-63d-50b14d88e2900"

Accept-Ranges: bytes

Content-Length: 1597

Connection: close

Content-Type: image/png

.PNG........IHDR.......n.......H(....sBIT.....O.....PLTE.Vp.Up.Sm.Sn.Rl.Qk.Pj.Oh.Oi.Ng.Mg.Lf.Le.Kd.Jc.Ib.Ha.H`.G_.F^.E].E^.D\.C[.CZ.AY.AX.@W.?V.>U.=T.<R.<S.;Q.:P.:Q.9O.8N.7M.7L.6L.5J.5K.4I.3H.2G.1F.1E./D..C..B.-A.,?.,@. ?.*>.*=.(;.)<.':.&9.%7.%8.$6."4.#6.#5.!3. 2..1..0.....,..-.. ..)..*..)..'..(..&..$..%..#..!..".. ..... ...(.X ....pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2009-12-15T21:28:30Z</xap:CreateDate>. <xap:ModifyDate>2009-12-30T08:07:00Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="hXXp://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>. . . ..U.....tEXtSoftwar

<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 02:18:54 GMT

Expires: Wed, 07 Jan 2015 04:18:54 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16068

Age: 4450

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0.002

...........}kW.:..w~....c...pk..f....--..M..dY.!Wb.KK.o.gF.-'..9...vob{t..Fs..O.".........9..@.#......?... e!...qg.I...A"..N_.').x.I.........I.Dr6}...|$].B..X...`...Ao.. .fQ.....x8..\..8....a..0............{...a}x.W|..:l..}.. ...u4....#.%O.AO....k.N[..a....&....tx..;.....'..:.N!y..Gg....9..a...7....cH>.bw...0..a.a..p5.1d.o|4.=8l.1&.D..,.X.5f..`...s.....[....&p:.H.........x......A.9h#.^..>. ...:...N...,H.1...;.....b..&a.;....o;.b......v.....N.wr..... ...z.......o..,Wjj8......j.r./.Y..RI.6.(........T....Dq....l.0.c.[1.o..h.R....ju..........,;...i....^.....T....|tV.L....;..i^S...-q........[Wup...~.......}.r .W.x..{-...Cd..k.V....A..^;.n...?.N...^.|..bc{.._...h.w=...f..}.U}...|...........[..62...Q....Cw.EV1..>..`..Q.cC.`..0...\v.:.'.....L.$.1.\O.C........B..A^2b..<..%....A%|.E...@N:I*.Y5.A.F.."h..... .^Y)|..L.2D...pqYc.......@..#Y(...J..#w...S.....70.. .;...Y....3..k.........@....&c..J.;....Q....R5.M...x.=`.<.f.U....C.{..>....{...t.....i>..Yk..@e..v.Cf5........o`.Z..V.....V)..9.....^u...X.....}.N.O....~...-......D..V.2o.F.......,Le.."J9.....k...r...#.w.i.!.......oe...a....O."..J.......P4.....F.w..v....F..[a.....|p`Oc..\....Q....}Q.=.(`../...2.L...4.L ..>P.....9.N`uQ...n../.X..@.f..."#...<.p...3....S~.?I.a...wx..d.;1.......X.....P.l....\&....X...^0<3.$D{iE.$c ....L.q...1.4....L....=.^...XW.(..?....#.......Y..%v..b.3.N.<Rll.p.......E..t.[..s..7Ht..gK..*0....]p... .H....S..g.73....5..)..._.d..MGaL..c.Y ..C...v...,W.@>.M...ouO. HC...Z.......O......@..~q.n..(.C...j.p.....c...cz...$..

<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.1&utms=1&utmn=288397215&utmhn=VVV.free-hideip.com&utmcs=utf-8&utmsr=1716x901&utmvp=1700x804&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=10.0 r45&utmdt=Free Hide IP Installed | Free Hide IP&utmhid=2086676748&utmr=-&utmp=/free-hide-ip-installed.html&utmht=1420601563639&utmac=UA-16601039-8&utmcc=__utma=56730365.308850550.1420601563.1420601563.1420601563.1;+__utmz=56730365.1420601564.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1655947318&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAQAAAAE~ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 07 Jan 2015 03:33:04 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Wed, 07 Jan 2015 03:33:04 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..Alternate-Protocol: 80:quic,p=0.002..GIF89a.............,...........D..;..

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=589437, public, no-transform, must-revalidate

Last-Modified: Tue, 6 Jan 2015 23:14:45 GMT

Expires: Tue, 13 Jan 2015 23:14:45 GMT

Date: Wed, 07 Jan 2015 03:33:05 GMT

Connection: keep-alive

0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....20150106231445Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:v....20150106231445Z....20150113231445Z0...*.H.............|..5.B..A.Zz}.8...S....Eo.>...S.J..........hJb.....z.....I.ob q.j..!..%z../F.....I..r..es..d ..<eF.5\l.h....1<....].ir....ue..~(0..Emv{K/M)*.@hP...ZR....L.y0].a..r................U.t.W>...l.R.23..-4KX85......6...q.?.."..X..dL,....(...7..n..<{u. .A./?...>q<....0...0..}0..e........:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTrust Global CA TGV OCSP Responder 30.."0...*.H.............0............\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd.....x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x..............6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830...*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a...nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7...=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v.....\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%....

<<< skipped >>>

GET /media/system/js/caption.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:03 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:33 GMT

ETag: "164f1-866-50b147c1bc740"

Accept-Ranges: bytes

Content-Length: 2150

Connection: close

Content-Type: application/x-javascript

/**.* @version..$Id: caption.js 5263 2006-10-02 01:25:24Z webImagery $.* @copyright.Copyright (C) 2005 - 2009 Open Source Matters. All rights reserved..* @license..GNU/GPL, see LICENSE.php.* Joomla! is free software. This version may have been modified pursuant.* to the GNU General Public License, and as distributed it includes or.* is derivative of works licensed under the GNU General Public License or.* other free or open source software licenses..* See COPYRIGHT.php for copyright notices and details..*/../**.* JCaption javascript behavior.*.* Used for displaying image captions.*.* @package.Joomla.* @since.1.5.* @version.1.0.*/.var JCaption = new Class({..initialize: function(selector)..{...this.selector = selector;....var images = $$(selector);...images.each(function(image){ this.createCaption(image); }, this);..},...createCaption: function(element)..{...var caption = document.createTextNode(element.title);...var container = document.createElement("div");...var text = document.createElement("p");...var width = element.getAttribute("width");...var align = element.getAttribute("align");...var docMode = document.documentMode;....//Windows fix...if (!align)....align = element.getStyle("float"); // Rest of the world fix...if (!align) // IE DOM Fix....align = element.style.styleFloat;....text.appendChild(caption);...text.className = this.selector.replace('.', '_');....if (align=="none") {....if (element.title != "") {.....element.parentNode.replaceChild(text, element);.....text.parentNode.insertBef

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDFpSHzfyfGc HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Sun, 04 Jan 2015 23:37:55 GMT

Expires: Thu, 08 Jan 2015 23:37:55 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 186910

Cache-Control: public, max-age=345600

Alternate-Protocol: 80:quic,p=0.002

0..........0..... .....0......0...0......J......h.v....b..Z./..20150104190440Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..1iH|........20150104190440Z....20150111190440Z0...*.H..............K...V.....DB-..u..&lidyo.t.........H.aY..J....^.Z...!HLT~..*6.'..W..i.(.*_....XHc/...c..................b.4.6n....wH.y....UN[.s`.(?....S...}....p........P...@.RI..q..V...).......%f.=..r4.n\.,wCR1D.@../....`.x..4..C.B....Ji....|k..zlF7.7/d.....:..-og.A.y..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Sun, 04 Jan 2015 23:37:55 GMT..Expires: Thu, 08 Jan 2015 23:37:55 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 186910..Cache-Control: public, max-age=345600..Alternate-Protocol: 80:quic,p=0.002..0..........0..... .....0......0...0......J......h.v....b..Z./..20150104190440Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..1iH|........20150104190440Z....20150111190440Z0...*.H..............K...V.....DB-..u..&lidyo.t.........H.aY..J....^.Z...!HLT~..*6.'..W..i.(.*_....XHc/...c..................b.4.6n....wH.y....UN[.s`.(?....S...}....p........P...@.RI..q..V...).......%f.=..r4.n\.,wCR1D.@../....`.x..4..C.B....Ji....|k..zlF7.7/d.....:..-og.A.y....

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67e94853d51d9631 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Wed, 07 Jan 2015 03:33:05 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..Cache-Control: max-age=86400..Date: Wed, 07 Jan 2015 03:33:05 GMT..Connection: keep-alive..

GET /pagead/images/ad_choices_en.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=180657799&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601562998&bpp=16&bdt=1506&shv=r20141209&cbv=r20141212&saldr=sa&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=546&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=UYLm6oXVdU&p=http://VVV.free-hideip.com&dtd=270

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 3514261995661079078

Date: Wed, 07 Jan 2015 02:47:04 GMT

Expires: Thu, 08 Jan 2015 02:47:04 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 776

X-XSS-Protection: 1; mode=block

Age: 2761

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002

.PNG........IHDR...M...........B.....IDATX....k.A.........O..?..'..C.."z........"A.j.9Y....Z..-.DwMm.66.vKCmk.H*.._.[...t......._o.|..7......J{bt....-..w....l..-..=`R.M/...B@.49g....T.....g..-...F".5...........w6.}......p1/.N..\....6.}....n~l...#C.Kh.w..wk.9.....d...d........9.:...m'<MB;..r..W......x...8_.Ro..mA.wa.,e;@.....J..:.....a|*..BI.h.7. .gb...~.g.4.u..[........v...c....7.........Xn".H..P...C..F...../.....WB..].O.~........6x.L.:hU.5...]_..cN.M.......$......Ss.......<..Nhj........!..u...a..T..i.!...Rm......M`g.zEB..K.\...0$..J5$......A.m.GB.u..^...W......~...1..=.7..q...L...7...v,H)6......g.E.M.Ak'<.[....u..X.va....................^....O...0.oAn@&\y......{rH........"..04..\[w....R.}e.[...}.....h.w.$...N|......Ao2.4.~O.u....?...Q....z..h...._...(V.....IEND.B`.HTTP/1.1 200 OK..P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"..Content-Type: image/png..ETag: 3514261995661079078..Date: Wed, 07 Jan 2015 02:47:04 GMT..Expires: Thu, 08 Jan 2015 02:47:04 GMT..X-Content-Type-Options: nosniff..Server: cafe..Content-Length: 776..X-XSS-Protection: 1; mode=block..Age: 2761..Cache-Control: public, max-age=86400..Alternate-Protocol: 80:quic,p=0.002...PNG........IHDR...M...........B.....IDATX....k.A.........O..?..'..C.."z........"A.j.9Y....Z..-.DwMm.66.vKCmk.H*.._.[...t......._o.|..7......J{bt....-..w....l..-..=`R.M/...B@.49g....T.....g..-...F".5...........w6.}......p1/.N..\....6.}....n~l...#C.Kh.w..wk.9.....d...d........9.:...m'<MB;..r..W......

<<< skipped >>>

GET /bg/As1rs6ZBldneBCLw2AxLEKkOIlt-mIA122l0HUMtT-g.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2137902362367109&output=html&h=60&slotname=8429118295&adk=3714006765&w=468&lmt=1419601248&flash=10.0.45.2&url=http://VVV.free-hideip.com/free-hide-ip-installed.html&dt=1420601563014&bpp=2&bdt=1525&shv=r20141209&cbv=r20141212&saldr=sa&prev_slotnames=8429118295&correlator=4583063697160&frm=20&ga_vid=308850550.1420601563&ga_sid=1420601563&ga_hid=2086676748&ga_fc=0&u_tz=120&u_his=1&u_java=1&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=12&adx=395&ady=1080&biw=1700&bih=804&eid=317150304,42631034&oid=3&rx=0&eae=0&fc=8&docm=10&brdim=0,53,-4,-4,1716,,1724,865,1716,804&vis=1&abl=CS&ppjl=t&fu=0&bc=1&ifi=2&xpc=31WOq6Z159&p=http://VVV.free-hideip.com&dtd=404

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pagead2.googlesyndication.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Tue, 02 Dec 2014 17:50:02 GMT

Date: Mon, 15 Dec 2014 15:21:04 GMT

Expires: Tue, 15 Dec 2015 15:21:04 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 5719

X-XSS-Protection: 1; mode=block

Age: 1944722

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic,p=0.002

.............{.......<.....6.....c{.).....4..c.....ft.....{.k.u...\.....U.&......S......*.~S.D.....Y.. ..>_.N.T..../{..`.&;k.,......G..:H............o..I.Mf.M~. .....ieL/..e.R.9K.qL/....A.X.M...].&a.I}...).q..,.e7sA..|NN}.3..2M*....n...}..\....h@C*...qg1.'.m9..!....9.$.p.......wA:.g.U.f[..UG`..f...N,.q..j.`...&..&.#.c...c.....1......s.....laI~NF..p..Q.Sk...Af1......W&.".I.0.>DQ..X..m.Wr..T..?`.qCY'....I2v.......j...I.....E`V.x.T9.DEB.VV..."...KN.k..b4IDhU7...@...X.E..<]...".~.......&..m....j..|w....?..Sm.2\......[Q.,O. .9.p... c.......u.....]9....y6K..!H....B.,."}8.I.]........~Q....fYk....:*j..?.W.g..7.H.....Pt..t....s..w_.{z.J...[.............G.K../.....?..w..E#X...N8......q..xf. }%.v.I....A..E...p.).#...&4.)]J....}..>$.'j...4`z..'N*.1..}....|q~..7..U....cjY.la....x.^.,r...m...u...kzM)....F.:...`0..@[4.....{ .'.....>?....>.G,j.a..o..p.4JY.8...j....!].L...v@.....>...:."....-.]..ov%..&....m.*...Yj.X[..2`jT^...M......('...5.Y...9.!.sv..(}..m..{....s.6...O.Q..9:...t.I..>b.C.:..'..R8..tN....c......9..u....AY|.R}..c|p.{g..{.X.....>::>9}....?..x................`8....E<Mf..t.-.....h....~.......r....3..G..t.8=.?L...)N.i...S.h.....%k.x...$.p...x~...'.n....l0.]...a..U^...0..8...:!.n.......^.2..[.v.....r.Z]{...V.V.. j....C.6..1.4...e.....P..e...&...`.,..4.....c.1........e..N.....]..}..'..`.:..( ...).k.M{....&.[..\......F*b.C.x...\.M3C.]..M._f.,Q.E..... ......8 Vt.l4Z...*..........F...^^....di..K5....`........%_.x..4.2}h..\.V p...$.....FMgp.......q.Q:.j...^.......f...dLh6..K....-....-...

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=430927, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 03:19:06 GMT

Expires: Mon, 12 Jan 2015 03:19:06 GMT

Date: Wed, 07 Jan 2015 03:36:59 GMT

Connection: keep-alive

0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCSP Responder..20150105031906Z0s0q0I0... ........?.@..w.........Y.!......Q...==d6|h.[x....7..`..........cV.!.....20150105031906Z....20150112031906Z0...*.H..............S.X.....3d*L....._.u..M...U...#..kf.?yG$Z...g#..=.R.~..#...S=<.;..K..,.......G..%eUb..'...K.vBd..u8`..H..4..\..2.........1.....J........N.......'|....}.xq...9Y..l.f.[..q)DfS%;.}I......tm>O;.......b.0..(DZ.....x{]..\[...%.D.... ..NM........5..V.;t.l..2........0...0...0..{.........[..I|.....Zm..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f..;]s!.\"v...|....].@.....K7m2...N......-S.I......5n...G7. ..W....n..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo......E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|........

<<< skipped >>>

POST / HTTP/1.1

Host: ocsp.verisign.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 115

Content-Type: application/ocsp-request

Connection: keep-alive

0q0o0M0K0I0... .........)8t..).~.5bRd.S....D\.SD..~. .%..c..y...]......[y......k..0.0... .....0...0... .....0..

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1730

content-transfer-encoding: binary

Cache-Control: max-age=316407, public, no-transform, must-revalidate

Last-Modified: Sat, 3 Jan 2015 19:24:16 GMT

Expires: Sat, 10 Jan 2015 19:24:16 GMT

Date: Wed, 07 Jan 2015 03:33:03 GMT

Connection: keep-alive

0..........0..... .....0......0...0......P).Niz5............?..20150103192416Z0s0q0I0... ..........)8t..).~.5bRd.S......D\.SD..~. .%..c..y...]......[y......k....20150103192416Z....20150110192416Z0...*.H................t..2v..x=q...' .....)=*.....w.....a."[......(..."...<./.F...%..a....@...gs..@.%.9 .....W..V...f....uq..`.R.)u.4..b8.?..E.^..n.....B".s....wa...........8..=.X..Qu...F..{qG..8.?gq.@6.g.._\.......F...^tq.E.wHmu..JB.. .t.4...#^qy].....<.....r=.5..$d.`.... .....0...0...0..........]../g.0.h.....$C0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101/0-..U...&VeriSign Class 3 Secure Server CA - G30...141204000000Z..150304235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1>0<..U...5VeriSign Class 3 Secure Server CA - G3 OCSP Responder0.."0...*.H.............0............Q..>.]....b...........G[..sz_:.eM.J..m)....J.KV..W....e.M...C.......8.|...^...S./.r.KOv.&...OVW....rG.@...e...:S4....R..&"......l.....1&..nY..p.....4...L`.g...E#t....Mw....1.O.....i..e.b.qa...p.....$...b...V....#.M3......|..B.R..:@UtY@:s..h.........me..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........https://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24570...*.H.............y.boc.....2<.-..O...ehR.............. .....n

<<< skipped >>>

GET /update/?ACTION=Update&39955&PID=FHI&SN=&MCD=00000000B48A115F&UNL=&LANG=English&DAY=0&RUNTIME=0&VER=04000106&SVER=0&WVER=6_1_Service Pack 1&WLANG=1033&CHL=64643765626338373462396362366133613864663866666465303837643261622E657865 HTTP/1.1

Accept: */*

Host: clientn.free-hideip.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:36:02 GMT

Server: Apache/2.2.21 (CentOS)

X-Powered-By: PHP/5.2.6

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8

4ca2..;userver=67109126..;updatever=67109128..magicword=FHI..result=1..page=hXXp://VVV.free-hideip.com/update.html..info=A new version of Free Hide IP 4.0.1.8 is available now. Update now?...Activate.NeedReactivated=1..otheractivated=1..__MODIFY__.CHANGESTATE=1..__MODIFY__.DCOUNTRY=IR;RU;IN;PK;ID;YE;TR;EG;RO;CN..__MODIFY__.NORMAL_IPS=54.211.2.150:3128|UNITED STATES|US|-74.2861022949219|40.5539016723633;107.182.17.243:7808|UNITED STATES|US|-96.8024|32.7961;64.31.22.131:7808|UNITED STATES|US|-96.8024|32.7961;209.170.151.142:7808|UNITED STATES|US|-78.7839965820313|35.7854995727539;166.78.162.23:3128|UNITED KINGDOM|UK|-4.47300004959106|54.1500015258789;162.243.106.177:3128|UNITED KINGDOM|UK|-4.47300004959106|54.1500015258789;58.96.180.8:8080|AUSTRALIA|AU|149.216995239258|-35.2830009460449;189.59.9.218:8080|BRAZIL|BR|-43.2330017089844|-22.8999996185303;189.11.175.187:3128|BRAZIL|BR|-43.2330017089844|-22.8999996185303;189.58.105.85:3128|BRAZIL|BR|-48.8330001831055|-26.2999992370605;187.5.38.130:8080|BRAZIL|BR|-51.2000007629395|-30.0330009460449;201.56.148.195:3128|BRAZIL|BR|-43.2330017089844|-22.8999996185303;201.45.116.140:3128|BRAZIL|BR|-43.2330017089844|-22.8999996185303;217.112.161.16:8080|CZECH REPUBLIC|CZ|14.4670000076294|50.0830001831055;202.153.130.214:80|INDONESIA|ID|106.800003051758|-6.16699981689453;203.142.87.132:8080|INDONESIA|ID|106.829399108887|-6.17439985275269;118.97.255.106:8080|INDONESIA|ID|106.829399108887|-6.17439985275269;202.145.3.242:8080|INDONESIA|ID|106.829399108887|-6.17439985275269;180.241

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDFpSHzfyfGc HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Sun, 04 Jan 2015 23:37:55 GMT

Expires: Thu, 08 Jan 2015 23:37:55 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 186910

Cache-Control: public, max-age=345600

Alternate-Protocol: 80:quic,p=0.002

0..........0..... .....0......0...0......J......h.v....b..Z./..20150104190440Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..1iH|........20150104190440Z....20150111190440Z0...*.H..............K...V.....DB-..u..&lidyo.t.........H.aY..J....^.Z...!HLT~..*6.'..W..i.(.*_....XHc/...c..................b.4.6n....wH.y....UN[.s`.(?....S...}....p........P...@.RI..q..V...).......%f.=..r4.n\.,wCR1D.@../....`.x..4..C.B....Ji....|k..zlF7.7/d.....:..-og.A.y......

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHj3S83xBK9k HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Sun, 04 Jan 2015 07:45:43 GMT

Expires: Thu, 08 Jan 2015 07:45:43 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 244043

Cache-Control: public, max-age=345600

Alternate-Protocol: 80:quic,p=0.002

0..........0..... .....0......0...0......J......h.v....b..Z./..20150104010642Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..x.K....d....20150104010642Z....20150111010642Z0...*.H............._...j.X..>...E.PT .4..$Xd..;....2C/.....?mH.b9......e......@..W.. ..gto....../....H..*R..@.2.p.g....N.T..5.....|..O.n..*.P...^gW...*.'........^.....cE..3....P...r.....H.2.3{.h....[(...E.)7/..L.dFk`G...5..!~....;< _Z..f....i.s.U..z.~...j..a.=....|&..=....HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Sun, 04 Jan 2015 07:45:43 GMT..Expires: Thu, 08 Jan 2015 07:45:43 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 244043..Cache-Control: public, max-age=345600..Alternate-Protocol: 80:quic,p=0.002..0..........0..... .....0......0...0......J......h.v....b..Z./..20150104010642Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..x.K....d....20150104010642Z....20150111010642Z0...*.H............._...j.X..>...E.PT .4..$Xd..;....2C/.....?mH.b9......e......@..W.. ..gto....../....H..*R..@.2.p.g....N.T..5.....|..O.n..*.P...^gW...*.'........^.....cE..3....P...r.....H.2.3{.h....[(...E.)7/..L.dFk`G...5..!~....;< _Z..f....i.s.U..z.~...j..a.=....|&..=......

<<< skipped >>>

GET /templates/rt_dominion_j15/images/backgrounds/style2/main-bg2.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.free-hideip.com/free-hide-ip-installed.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.free-hideip.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 07 Jan 2015 03:33:04 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Fri, 26 Dec 2014 01:31:35 GMT

ETag: "16858-9b7-50b147c3a4bc0"

Accept-Ranges: bytes

Content-Length: 2487

Connection: close

Content-Type: image/png

.PNG........IHDR...4............e....sBIT.....O.....pHYs... ... .........tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:11:41 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2009-12-12T07:19:17Z</xap:CreateDate>. <xap:ModifyDate>2009-12-30T21:12:00Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>. . . a.p.....tEXtSoftware.Adobe Fireworks CS3..F.....tEXtCreation Time.12/12/09.].H....IDATx......@.CQRf...........;.G....#ik....K.wZ...u..5..;w..=.6.9.s...-n.V.U.%\.;G..*....i......*i....u.V.Xi...m.7hq.@..d.V.Xi....B4hq.@l.T..m.4hq..B.....D...VI...=...B.J;Gw..G_.u.B...9.:.9x......W....9...........X.*..].....K....V....-

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=367293, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 09:34:14 GMT

Expires: Sun, 11 Jan 2015 09:34:14 GMT

Date: Wed, 07 Jan 2015 03:36:58 GMT

Connection: keep-alive

0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....20150104093414Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20150104093414Z....20150111093414Z0...*.H.................P.OK.w3.B.R..9_*..-....][\....5'.A.jL..=.OZ...|.......?..R..#YB.6q|...'.P..G ..h...I.H9.`G.M.}..M...3.......p.."Ug....U...7.3.?.......$.._Q.\_./.....|.L..[......gzO'.C..6.....B.sK.D..H[......iPI.... ...Xp.T.]..LR....R:.m.J..T...lDP..p....J..d./D.F....2....0...0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0..........'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p..^|o....S..v.).).....r.v.qo$......C.V!....@.h#qh...u1T.].G0.]E...=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=415806, public, no-transform, must-revalidate

Last-Modified: Sun, 4 Jan 2015 23:04:05 GMT

Expires: Sun, 11 Jan 2015 23:04:05 GMT

Date: Wed, 07 Jan 2015 03:36:58 GMT

Connection: keep-alive

0..........0..... .....0......0...0........6?s....V....OlL".O..20150104230405Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5........M.s.Q~...@?j.......20150104230405Z....20150111230405Z0...*.H................G..z./....,FS?..1..H.b*.!\..U.X)._...\d.V.....a.....). ......;..9.pD.o4.....!...........5.O*....Gt...DM'...a.S../......<{;.Q#....*..~g...p.._WB.:1.....~T....=.1...w'.p#*q..]$.NO..!..e5.`Ic..@.kd. ..v....~......F.....l.........3U..T...^p3.....q..i,RMX%&....#0...0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{(..t....2.Vf.....&;6).i*FK....W@....F....jnb.w._p.E.6.|.mk....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...

<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...^D..I....0.0... .....0...0... .....0..

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 07 Jan 2015 03:33:16 GMT

Expires: Sun, 11 Jan 2015 03:33:16 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.002

0..........0..... .....0......0...0......J......h.v....b..Z./..20150107010407Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...^D..I......20150107010407Z....20150114010407Z0...*.H.............:w..u...e..J-...g$.Y`....0...%#...hi......'_..../....h.Ya.....G...*.T&.WH..9. ).H.x.....f......l3.R...m.Q7k.G...j.....!.@0br.h..JLM.....x/..[....d1.. ..=.....x.\V....&.....Y.N...n...;.3. b8...*.V.8$.. 1.Y.[C.=h.p...y..[...0....&*..z.........2..e.T.......JLHTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Wed, 07 Jan 2015 03:33:16 GMT..Expires: Sun, 11 Jan 2015 03:33:16 GMT..Cache-Control: public, max-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:quic,p=0.002..0..........0..... .....0......0...0......J......h.v....b..Z./..20150107010407Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...^D..I......20150107010407Z....20150114010407Z0...*.H.............:w..u...e..J-...g$.Y`....0...%#...hi......'_..../....h.Ya.....G...*.T&.WH..9. ).H.x.....f......l3.R...m.Q7k.G...j.....!.@0br.h..JLM.....x/..[....d1.. ..=.....x.\V....&.....Y.N...n...;.3. b8...*.V.8$.. 1.Y.[C.=h.p...y..[...0....&*..z.........2..e.T.......JL..

<<< skipped >>>

Map

The Malware connects to the servers at the folowing location(s):

Strings from Dumps

FreeHideIP.exe_964:

.text

.text

`.itext

`.itext

`.data

`.data

.idata

.idata

.didata

.didata

.rdata

.rdata

@.reloc

@.reloc

B.rsrc

B.rsrc

biClrImportant

biClrImportant

PMsg

PMsg

tagMSG

tagMSG

Windows

Windows

HKEY

HKEY

TWMKey

TWMKey

KeyData

KeyData

grfLocksSupported

grfLocksSupported

POleCmdl

POleCmdl

_tagOLECMD

_tagOLECMD

cmdID

cmdID

cmdf

cmdf

POleCmdText

POleCmdText

_tagOLECMDTEXT

_tagOLECMDTEXT

cmdtextf

cmdtextf

ENotSupportedException

ENotSupportedException

ENoMonitorSupportException

ENoMonitorSupportException

.uvCOu

.uvCOu

Uh.hA

Uh.hA

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

etNoMonitorSupportException

etNoMonitorSupportException

Operator

Operator

EVariantBadIndexError

EVariantBadIndexError

EVariantBadIndexErrorx4B

EVariantBadIndexErrorx4B

mkOperatorOverload

mkOperatorOverload

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

TList.TDirection

TList.TDirection

AOperator

AOperator

TThread.TSynchronizeRecord

TThread.TSynchronizeRecord

TOperation

TOperation

Operation

Operation

FOnExecute

FOnExecute

OnExecute

OnExecute

TList.Sort$ActRec

TList.Sort$ActRec

TList.Sort$ActRect

TList.Sort$ActRect

Uh.dD

Uh.dD

TComponent.FindComponent$ActRec,

TComponent.FindComponent$ActRec,

TComponent.FindComponent$ActRec

TComponent.FindComponent$ActRec

HelpKeyword

HelpKeyword

UnderstandsKeyword

UnderstandsKeyword

DeleteKey

DeleteKey

TRegKeyInfo

TRegKeyInfo

NumSubKeys

NumSubKeys

MaxSubKeyLen

MaxSubKeyLen

FCurrentKey

FCurrentKey

FRootKey

FRootKey

FCloseRootKey

FCloseRootKey

CloseKey

CloseKey

CreateKey

CreateKey

GetKeyInfo

GetKeyInfo

GetKeyNames

GetKeyNames

HasSubKeys

HasSubKeys

KeyExists

KeyExists

LoadKey

LoadKey

MoveKey

MoveKey

OpenKey

OpenKey

OpenKeyReadOnly

OpenKeyReadOnly

ReplaceKey

ReplaceKey

RestoreKey

RestoreKey

SaveKey

SaveKey

UnLoadKey

UnLoadKey

CurrentKeyP

CurrentKeyP

LastErrorMsg

LastErrorMsg

RootKeyP

RootKeyP

RootKeyName

RootKeyName

EInvalidGraphicOperation

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsPartialTransparency

SupportsClipboardFormat

SupportsClipboardFormat

Monochrome

Monochrome

Uhr%F

Uhr%F

UrlMon

UrlMon

FPasswordChar

FPasswordChar

PasswordCharP

PasswordCharP

OnKeyDown

OnKeyDown

OnKeyPress(

OnKeyPress(

OnKeyUp

OnKeyUp

ssHorizontal

ssHorizontal

TCustomButton.TButtonStyle

TCustomButton.TButtonStyle

OnKeyUp

OnKeyUp

poPortrait

poPortrait

APort

APort

Port

Port

FProportional

FProportional

Proportional

Proportional

acoUpDownKeyDropsList

acoUpDownKeyDropsList

TComboBoxExEnumerator5

TComboBoxExEnumerator5

TComboBoxExEnumerator

TComboBoxExEnumerator

FURL

FURL

URLP

URLP

TMsgDlgType

TMsgDlgType

TMsgDlgBtn

TMsgDlgBtn

TMsgDlgButtons

TMsgDlgButtons

FAutoHotkeys

FAutoHotkeys

RethinkHotkeys

RethinkHotkeys

AutoHotkeysd

AutoHotkeysd

IsShortCut

IsShortCut

AutoHotkeys

AutoHotkeys

igoParentPassthrough

igoParentPassthrough

FAlwaysShowDragImages

FAlwaysShowDragImages

AlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

(TCustomGestureEngine.TGestureEngineFlags

Supported

Supported

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

FHelpKeyword

FHelpKeyword

HelpKeyword

HelpKeyword

FOnKeyDown

FOnKeyDown

FOnKeyPress

FOnKeyPress

FOnKeyUp

FOnKeyUp

IsHintMsg

IsHintMsg

FNativeWheelSupport

FNativeWheelSupport

FWheelSupportMessage

FWheelSupportMessage

Uh.tL

Uh.tL

thHeaderItemLeftPressed

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

ttbThumbLeftPressed

lrMonoChrome

lrMonoChrome

HelpKeyword\

HelpKeyword\

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

fsShowing

fsShowing

FWindowState

FWindowState

FKeyPreview

FKeyPreview

WantChildKey

WantChildKey

KeyPreview

KeyPreview

WindowState

WindowState

FBiDiKeyboard

FBiDiKeyboard

FNonBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FEnumAllWindowsOnActivateHint

FOnActionExecute

FOnActionExecute

Keyword

Keyword

EnumAllWindowsOnActivateHintP

EnumAllWindowsOnActivateHintP

BiDiKeyboardP

BiDiKeyboardP

NonBiDiKeyboard

NonBiDiKeyboard

OnActionExecutep!M

OnActionExecutep!M

LicenseKey

LicenseKey

EWebBrokerException

EWebBrokerException

HTTPApp

HTTPApp

fKeyword

fKeyword

Keywordt

Keywordt

1.1.2

1.1.2

deflate 1.1.2 Copyright 1995-1998 Jean-loup Gailly

deflate 1.1.2 Copyright 1995-1998 Jean-loup Gailly

1.1.4

1.1.4

cmDefault

cmDefault

FAnimationForAllWindows

FAnimationForAllWindows

RollUpLeftPoint

RollUpLeftPoint

AuthorURL

AuthorURL

AnimationForAllWindows

AnimationForAllWindows

FSkinSupport

FSkinSupport

FAlwaysShowInTray

FAlwaysShowInTray

FSupportNCArea

FSupportNCArea

OldWindowState

OldWindowState

SetSupportNCArea

SetSupportNCArea

AlwaysShowInTray

AlwaysShowInTray

SupportNCArea

SupportNCArea

FSupportChildMenus

FSupportChildMenus

SupportChildMenus

SupportChildMenus

TspSkinTabSheet,%X

TspSkinTabSheet,%X

TspGetItemImageIndexEvent

TspGetItemImageIndexEvent

FOnListBoxKeyDown

FOnListBoxKeyDown

FOnListBoxKeyPress

FOnListBoxKeyPress

FOnListBoxKeyUp

FOnListBoxKeyUp

OnListBoxKeyDown

OnListBoxKeyDown

OnListBoxKeyPress(

OnListBoxKeyPress(

OnListBoxKeyUp

OnListBoxKeyUp

FOnEditKeyDown

FOnEditKeyDown

FOnEditKeyPress

FOnEditKeyPress

FOnEditKeyUp

FOnEditKeyUp

OnEditKeyDown

OnEditKeyDown

OnEditKeyPress(

OnEditKeyPress(

OnEditKeyUp

OnEditKeyUp

FAlwaysShowGlowFrame

FAlwaysShowGlowFrame

FSpaceSupport

FSpaceSupport

AlwaysShowLayeredFrame

AlwaysShowLayeredFrame

PopupKeyDown

PopupKeyDown

FAlphaBlendSupport

FAlphaBlendSupport

AlphaBlendSupport

AlphaBlendSupport

3333333

3333333

THttpCharset

THttpCharset

FTURL

FTURL

FTPassword

FTPassword

FTPostQuery

FTPostQuery

FTProgress

FTProgress

FHttpCharset

FHttpCharset

FHttpSSL

FHttpSSL

aURL

aURL

aPassword

aPassword

FPassword

FPassword

PasswordP

PasswordP

HttpCharset

HttpCharset

grfKeyState

grfKeyState

TComTargetExecEvent

TComTargetExecEvent

CmdGroup

CmdGroup

nCmdID

nCmdID

nCmdexecopt

nCmdexecopt

IWebBrowser

IWebBrowser

IWebBrowserApp

IWebBrowserApp

IWebBrowser2

IWebBrowser2

IShellWindows

IShellWindows

TEWBWindowSetResizable

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetWidth

TEWBWindowSetHeight

TEWBWindowSetHeight

bstrUrlContext

bstrUrlContext

bstrUrl

bstrUrl

FOnWindowSetResizable

FOnWindowSetResizable

FOnWindowSetLeft

FOnWindowSetLeft

FOnWindowSetTop

FOnWindowSetTop

FOnWindowSetWidth

FOnWindowSetWidth

FOnWindowSetHeight

FOnWindowSetHeight

cmdexecopt

cmdexecopt

OnWindowSetResizable

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetLeft

OnWindowSetTop

OnWindowSetTop

OnWindowSetWidth

OnWindowSetWidth

OnWindowSetHeight

OnWindowSetHeight

LocationURL

LocationURL

CoShellWindows1

CoShellWindows1

CoShellWindows

CoShellWindows

TOleCmdArray

TOleCmdArray

rcmDefault

rcmDefault

rcmDebug

rcmDebug

DontExecuteScripts

DontExecuteScripts

DontExecuteJava

DontExecuteJava

DontExecuteActiveX

DontExecuteActiveX

DisableUrlIfEncodingUTF8

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

lpMsg

PMsg

PMsg

pguidCmdGroup

pguidCmdGroup

TTranslateUrlEvent

TTranslateUrlEvent

pchURLIn

pchURLIn

ppchURLOut

ppchURLOut

CmdID

CmdID

pszUrl

pszUrl

pszUrlContext

pszUrlContext

szPassWord

szPassWord

ErrorUrl

ErrorUrl

fOptionKeyPath

fOptionKeyPath

fOverOptionKeyPath

fOverOptionKeyPath

FOnTranslateUrL

FOnTranslateUrL

FOnCommandExec

FOnCommandExec

cCmds

cCmds

prgCmds

prgCmds

CmdText

CmdText

QueryCMDEnabled

QueryCMDEnabled

QueryCMDLatched

QueryCMDLatched

QueryCMDStatus

QueryCMDStatus

QueryCMDArrayStatus

QueryCMDArrayStatus

cmds

cmds

OptionKeyPath

OptionKeyPath

OverrideOptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl

OnTranslateUrl

OnCommandExec

OnCommandExec

WebocPopupManagement

WebocPopupManagement

ValidateNavigateUrl

ValidateNavigateUrl

HttpUsernamePasswordDisable

HttpUsernamePasswordDisable

GetUrlDomFilePathUnencoded

GetUrlDomFilePathUnencoded

XmlHttp

XmlHttp

n%D,3

n%D,3

TMsgEvent

TMsgEvent

TKeyEventEx

TKeyEventEx

FPort

FPort

Password

Password

PortP

PortP

WebBrowser

WebBrowser

sCmdId

sCmdId

InvokeCMD

InvokeCMD

#ShowImportExportFavoritesAndCookies

#ShowImportExportFavoritesAndCookies

DecodeUrl

DecodeUrl

EncodeUrl

EncodeUrl

GetCachedFileFromURL

GetCachedFileFromURL

ItemUrl

ItemUrl

GetURLSecurityZone

GetURLSecurityZone

ImportCertFile

ImportCertFile

URLFromFavorites

URLFromFavorites

dotURL

dotURL

UrlFromHistory

UrlFromHistory

ClearTypedUrls

ClearTypedUrls

nCMDShow

nCMDShow

SendURLInMail

SendURLInMail

TCnMsgType

TCnMsgType

TCnMsgTypes

TCnMsgTypes

FMsgTypes

FMsgTypes

MsgTypes

MsgTypes

AMsg

AMsg

LogMsg

LogMsg

LogMsgWithTag

LogMsgWithTag

LogMsgWithLevel

LogMsgWithLevel

LogMsgWithType

LogMsgWithType

LogMsgWithTagLevel

LogMsgWithTagLevel

LogMsgWithLevelType

LogMsgWithLevelType

LogMsgWithTypeTag

LogMsgWithTypeTag

LogMsgWarning

LogMsgWarning

LogMsgError

LogMsgError

LogInteger

LogInteger

LogVirtualKey

LogVirtualKey

AKey

AKey

LogVirtualKeyWithTag

LogVirtualKeyWithTag

TraceMsg

TraceMsg

TraceMsgWithTag

TraceMsgWithTag

TraceMsgWithLevel

TraceMsgWithLevel

TraceMsgWithType

TraceMsgWithType

TraceMsgWithTagLevel

TraceMsgWithTagLevel

TraceMsgWithLevelType

TraceMsgWithLevelType

TraceMsgWithTypeTag

TraceMsgWithTypeTag

TraceMsgWarning

TraceMsgWarning

TraceMsgError

TraceMsgError

TraceVirtualKey

TraceVirtualKey

TraceVirtualKeyWithTag

TraceVirtualKeyWithTag

MsgDesc

MsgDesc

FMsgBase

FMsgBase

CnDebugViewer.exe -a

CnDebugViewer.exe -a

lblSupport

lblSupport

FormKeyUp

FormKeyUp

Uh %c

Uh %c

TWindowsType

TWindowsType

TWindowsProductType

TWindowsProductType

TWindowsProductKind

TWindowsProductKind

TWindowsProductVersion

TWindowsProductVersion

TWindowsTypeEx8

TWindowsTypeEx8

TOnCmdFile

TOnCmdFile

FWM_CL_CMDPARAM

FWM_CL_CMDPARAM

FOnCmdFile

FOnCmdFile

GetURL

GetURL

GetURLParam

GetURLParam

ShowPageByURL

ShowPageByURL

strURL

strURL

WebBeforeNavigate2

WebBeforeNavigate2

OnCmdFile

OnCmdFile

pnWeb

pnWeb

FUrlString

FUrlString

TCLWebBanner5

TCLWebBanner5

TCLWebBanner(

TCLWebBanner(

CLWebBanner

CLWebBanner

ProfilePort`

ProfilePort`

EIdCanNotBindPortInRange

EIdCanNotBindPortInRange

EIdInvalidPortRange

EIdInvalidPortRange

EIdInvalidPortRange|[d

EIdInvalidPortRange|[d

CheckIPVersionSupport

CheckIPVersionSupport

VPort

VPort

WSGetServByPort

WSGetServByPort

APortNumber

APortNumber

IdStackWindows

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows4

TIdSocketListWindows\Ue

TIdSocketListWindows\Ue

TIdStackWindowsg

TIdStackWindowsg

ReceiveMsg

ReceiveMsg

WSTranslateSocketErrorMsg

WSTranslateSocketErrorMsg

SupportsIPv6

SupportsIPv6

TIdStackWindows4Ye

TIdStackWindows4Ye

EIdIPVersionUnsupported

EIdIPVersionUnsupported

FSourcePort

FSourcePort

FDestPort

FDestPort

SourcePort

SourcePort

DestPort

DestPort

ftpTransfer

ftpTransfer

ftpReady

ftpReady

ftpAborted

ftpAborted

FClientPortMin

FClientPortMin

FClientPortMax

FClientPortMax

FPeerPort

FPeerPort

ClientPortMin

ClientPortMin

ClientPortMaxP

ClientPortMaxP

PeerPortSVW

PeerPortSVW

EIdPortRequiredt

EIdPortRequiredt

EIdPortRequiredT

EIdPortRequiredT

EIdTCPConnectionError

EIdTCPConnectionError

EIdObjectTypeNotSupported

EIdObjectTypeNotSupported

EIdObjectTypeNotSupportedd

EIdObjectTypeNotSupportedd

VMsgEnd

VMsgEnd

"EIdTransparentProxyUDPNotSupported

"EIdTransparentProxyUDPNotSupported

OpenUDP

OpenUDP

CloseUDP

CloseUDP

RecvFromUDP

RecvFromUDP

VPeerPort

VPeerPort

SendToUDP

SendToUDP

Port8gd

Port8gd

FBoundPort

FBoundPort

FBoundPortMax

FBoundPortMax

FBoundPortMin

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustom'

TIdTCPClientCustom

TIdTCPClientCustom

IdTCPClient

IdTCPClient

BoundPort

BoundPort

BoundPortMax

BoundPortMax

BoundPortMin

BoundPortMin

TIdTCPClient

TIdTCPClient

IPAsString

IPAsString

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

saUsernamePassword

FUDPSocksAssociation

FUDPSocksAssociation

FDefaultPort

FDefaultPort

DefaultPort8gd

DefaultPort8gd

FLastCmdResult

FLastCmdResult

TIdTCPConnectionB

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

RaiseExceptionForLastCmdResult

SendCmd

SendCmd

SendCmdf

SendCmdf

TIdTCPConnection

TIdTCPConnection

IdTCPConnection

IdTCPConnection

LastCmdResult

LastCmdResult

URLDecode

URLDecode

URLEncode

URLEncode

Uh.ih

Uh.ih

AURL

AURL

FHttpOnly

FHttpOnly

HttpOnlyP

HttpOnlyP

FCommentURL

FCommentURL

FPortList

FPortList

FRecvPort

FRecvPort

FUsePort

FUsePort

CommentURL

CommentURL

PortCount

PortCount

UsePort

UsePort

RecvPort

RecvPort

CompressFTPDeflate

CompressFTPDeflate

CompressFTPToIO

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPFromIO

DecompressFTPDeflate

DecompressFTPDeflate

CompressHTTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

DecompressHTTPDeflate

fPassThrough

fPassThrough

PassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPort

MakeFTPSvrPasv

MakeFTPSvrPasv

IdHTTPHeaderInfo

IdHTTPHeaderInfo

ProxyPassword

ProxyPassword

ProxyPortP

ProxyPortP

dsa_keygen

dsa_keygen

pub_key

pub_key

priv_key

priv_key

PEVP_PKEY

PEVP_PKEY

EVP_PKEY_union

EVP_PKEY_union

EVP_PKEY

EVP_PKEY

pkey

pkey

pkey_type

pkey_type

required_pkey_type

required_pkey_type

key_len

key_len

key_length

key_length

AUTHORITY_KEYID

AUTHORITY_KEYID

keyid

keyid

PAUTHORITY_KEYID8yi

PAUTHORITY_KEYID8yi

X509_PUBKEY

X509_PUBKEY

public_key

public_key

PX509_PUBKEYtzi

PX509_PUBKEYtzi

X509_CERT_AUX

X509_CERT_AUX

PX509_CERT_AUXt|i

PX509_CERT_AUXt|i

cert_info

cert_info

ex_nscert

ex_nscert

get_cert_methods

get_cert_methods

cert_crl

cert_crl

ppem_password_cb

ppem_password_cb

key_arg_length

key_arg_length

key_arg

key_arg

master_key_length

master_key_length

master_key

master_key

sess_cert

sess_cert

Ptlsext_ticket_key_cb!

Ptlsext_ticket_key_cb!

cert_store

cert_store

default_passwd_callback

default_passwd_callback

default_passwd_callback_userdata

default_passwd_callback_userdata

client_cert_cb

client_cert_cb

extra_certs

extra_certs

max_cert_list

max_cert_list

cert

cert

msg_callback

msg_callback

msg_callback_arg

msg_callback_arg

client_cert_engine

client_cert_engine

tlsext_tick_key_name

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

tlsext_ticket_key_cb

init_msg

init_msg

read_key

read_key

write_key

write_key

key_material_length

key_material_length

key_material

key_material

tmp_cert_type

tmp_cert_type

tmp_cert_length

tmp_cert_length

tmp_cert_verify_md

tmp_cert_verify_md

tmp_cert_req

tmp_cert_req

tmp_key_block_length

tmp_key_block_length

tmp_key_block

tmp_key_block

tmp_cert_request

tmp_cert_request

msg_len

msg_len

w_msg_hdr

w_msg_hdr

r_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

sslvrfFailIfNoPeerCert

TPasswordEvent

TPasswordEvent

Certificate

Certificate

fsRootCertFile

fsRootCertFile

fsCertFile

fsCertFile

fsKeyFile

fsKeyFile

RootCertFileP

RootCertFileP

CertFileP

CertFileP

KeyFile

KeyFile

LoadRootCert

LoadRootCert

LoadCert

LoadCert

RootCertFilet

RootCertFilet

CertFilet

CertFilet

fPeerCert

fPeerCert

PeerCertd

PeerCertd

fOnGetPassword

fOnGetPassword

OnGetPassword

OnGetPassword

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertErrort

EIdOSSLLoadingRootCertErrort

EIdOSSLLoadingCertError\

EIdOSSLLoadingCertError\

EIdOSSLLoadingCertError4

EIdOSSLLoadingCertError4

EIdOSSLLoadingKeyError

EIdOSSLLoadingKeyError

TIdHTTPConnectionType

TIdHTTPConnectionType

IdHTTP

IdHTTP

TIdHTTPOption

TIdHTTPOption

TIdHTTPOptions

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPOnHeadersAvailable

FHTTP

FHTTP

TIdHTTPResponse7

TIdHTTPResponse7

TIdHTTPResponse

TIdHTTPResponse

TIdHTTPRequest5

TIdHTTPRequest5

AHTTP

AHTTP

TIdHTTPRequestthj

TIdHTTPRequestthj

TIdHTTPProtocol;

TIdHTTPProtocol;

TIdHTTPProtocol

TIdHTTPProtocol

FHTTPProto

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTP'

TIdCustomHTTPpmj

TIdCustomHTTPpmj

HTTPOptionsxcj

HTTPOptionsxcj

TIdHTTP

TIdHTTP

EIdHTTPProtocolExceptionn

EIdHTTPProtocolExceptionn

EIdHTTPProtocolException

EIdHTTPProtocolException

FItemKeyed

FItemKeyed

PersistentHotKeys

PersistentHotKeys

Keyed

Keyed

FAutoHotKeys

FAutoHotKeys

AutoHotKeys

AutoHotKeys

TCommandProperties.TChangeState

TCommandProperties.TChangeState

0TCommandProperties.TCommandPropertiesChangeEvent

0TCommandProperties.TCommandPropertiesChangeEvent

TButtonProperties.TButtonSize

TButtonProperties.TButtonSize

TButtonProperties.TButtonType

TButtonProperties.TButtonType

TButtonProperties.TGroupPosition

TButtonProperties.TGroupPosition

"TButtonProperties.TTextAssociation

"TButtonProperties.TTextAssociation

TGalleryProperties.TGalleryType

TGalleryProperties.TGalleryType

FKeyTip

FKeyTip

KeyTip

KeyTip

FPersistentHotKeys

FPersistentHotKeys

FControlHeightIndexes

FControlHeightIndexes

cbOpera

cbOpera

actChooseIPCountryExecute

actChooseIPCountryExecute

actHomePageExecute

actHomePageExecute

actHelpCenterExecute

actHelpCenterExecute

actBuyNowExecute

actBuyNowExecute

actHideIPExecute

actHideIPExecute

actSettingsExecute

actSettingsExecute

actStopHideExecute

actStopHideExecute

actEnterSNExecute

actEnterSNExecute

actCheckIPInfoExecute

actCheckIPInfoExecute

actOpenExecute

actOpenExecute

actExitExecute

actExitExecute

actAlwaysOnTopExecute

actAlwaysOnTopExecute

actUpdateExecute

actUpdateExecute

actAboutExecute

actAboutExecute

aFlagURL

aFlagURL

WebConst

WebConst

IdTCPServer

IdTCPServer

IdCustomTCPServer

IdCustomTCPServer

1.2.3

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

oleaut32.dll

oleaut32.dll

advapi32.dll

advapi32.dll

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

user32.dll

user32.dll

kernel32.dll

kernel32.dll

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

SetKeyboardState

SetKeyboardState

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyW

LoadKeyboardLayoutW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyboardLayout

GetKeyState

GetKeyState

GetKeyNameTextW

GetKeyNameTextW

GetAsyncKeyState

GetAsyncKeyState

EnumWindows

EnumWindows

EnumThreadWindows

EnumThreadWindows

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

msimg32.dll

msimg32.dll

gdi32.dll

gdi32.dll

SetViewportOrgEx

SetViewportOrgEx

version.dll

version.dll

WinExec

WinExec

GetCPInfo

GetCPInfo

RegUnLoadKeyW

RegUnLoadKeyW

RegSaveKeyW

RegSaveKeyW

RegRestoreKeyW

RegRestoreKeyW

RegReplaceKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegLoadKeyW

RegLoadKeyW

RegFlushKey

RegFlushKey

RegEnumKeyExW

RegEnumKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyExW

ole32.dll

ole32.dll

comctl32.dll

comctl32.dll

URLMON.DLL

URLMON.DLL

URLDownloadToFileW

URLDownloadToFileW

wininet.dll

wininet.dll

FindNextUrlCacheEntryExW

FindNextUrlCacheEntryExW

FindFirstUrlCacheEntryExW

FindFirstUrlCacheEntryExW

HttpSendRequestW

HttpSendRequestW

HttpQueryInfoW

HttpQueryInfoW

HttpOpenRequestW

HttpOpenRequestW

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

FindCloseUrlCache

FindCloseUrlCache

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

shell32.dll

shell32.dll

ShellExecuteExW

ShellExecuteExW

ShellExecuteW

ShellExecuteW

comdlg32.dll

comdlg32.dll

winspool.drv

winspool.drv

wsock32.dll

wsock32.dll

crypt32.dll

crypt32.dll

CertOpenSystemStoreW

CertOpenSystemStoreW

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertFreeCertificateContext

CertFreeCertificateContext

CertCreateCertificateContext

CertCreateCertificateContext

CertCloseStore

CertCloseStore

shdocvw.dll

shdocvw.dll

oleacc.dll

oleacc.dll

winmm.dll

winmm.dll

uxtheme.dll

uxtheme.dll

DWMAPI.DLL

DWMAPI.DLL

windowscodecs.dll

windowscodecs.dll

1$1$0,0004080

1$1$0,0004080

0%0-050=0

0%0-050=0

3&3.363>3

3&3.363>3

>#>'> >/>3>7>

>#>'> >/>3>7>

1#1'1 1/13171;1

1#1'1 1/13171;1

5$5:5`5~5

5$5:5`5~5

:,:0:@:_:

:,:0:@:_:

>#>'> >/>

>#>'> >/>

; ;$;(;,;0;4;

; ;$;(;,;0;4;

3%3u3

3%3u3

11U1c1w1

11U1c1w1

4F4F4N4\4m4

4F4F4N4\4m4

4_5

4_5

0-0O0d0}0

0-0O0d0}0

4C4D4U4Y4j4r4

4C4D4U4Y4j4r4

2$2 232_2

2$2 232_2

5 5'5.565>5[5

5 5'5.565>5[5

11C1[1c1q1

11C1[1c1q1

4C4D4V4Z4

4C4D4V4Z4

;!;&; ;6;

;!;&; ;6;

2"2)20282

2"2)20282

7 747;7%8,8

7 747;7%8,8

6h6F6W6n6

6h6F6W6n6

3!3%3)3-313

3!3%3)3-313

3'3 3/33373;3?3

3'3 3/33373;3?3

333C3

333C3

6c6F6\6m6

6c6F6\6m6

9&9-959=9_9

9&9-959=9_9

3J3j3n3r3v3z3~3

3J3j3n3r3v3z3~3

:#:': :/:3:7:;:

:#:': :/:3:7:;:

8 8$8(8,808

8 8$8(8,808

0

0

9•9u9

9•9u9

4-6}6

4-6}6

353X3f3z3

353X3f3z3

4%5U5`5

4%5U5`5

4E4D4Z4u4

4E4D4Z4u4

88R8e8

88R8e8

4L4Q4b4r4

4L4Q4b4r4

:":&:6:_:~:

:":&:6:_:~:

6%8x8

6%8x8

; ;?;^;};

; ;?;^;};

9"9&9;9`9

9"9&9;9`9

7&707`7~7

7&707`7~7

787

787

: :$:(:,:0:4:8:@:

: :$:(:,:0:4:8:@:

> >$>(>,>

> >$>(>,>

1014181`2

1014181`2

;$

;$

333333333333333333

333333333333333333

33333833

33333833

3333339

3333339

3333333333333338

3333333333333338

:*"*"$3338

:*"*"$3338

33333333

33333333

33333333333

33333333333

3333333333338

3333333333338

33338?383

33338?383

333333333333

333333333333

:*3:"$3338

:*3:"$3338

333333333333333

333333333333333

62..,(&"

62..,(&"

842.,)(&

842.,)(&

8541.,)(&"

8541.,)(&"

88542.,(#

88542.,(#

888521.,(("

888521.,(("

888852110'

888852110'

( ) (() &

( ) (() &

5-)(((()

5-)(((()

KWindows

KWindows

IdTCPServer

IdTCPServer

?HTTPApp

?HTTPApp

>WebConst

>WebConst

0IdHTTPHeaderInfo

0IdHTTPHeaderInfo

.uIPsTesting

.uIPsTesting

Font.Charset

Font.Charset

Font.Color

Font.Color

Font.Height

Font.Height

Font.Name

Font.Name

Font.Style

Font.Style

DefaultFont.Charset

DefaultFont.Charset

DefaultFont.Color

DefaultFont.Color

DefaultFont.Height

DefaultFont.Height

DefaultFont.Name

DefaultFont.Name

DefaultFont.Style

DefaultFont.Style

frmMain.spSkinData

frmMain.spSkinData

ListBoxDefaultFont.Charset

ListBoxDefaultFont.Charset

ListBoxDefaultFont.Color

ListBoxDefaultFont.Color

ListBoxDefaultFont.Height

ListBoxDefaultFont.Height

ListBoxDefaultFont.Name

ListBoxDefaultFont.Name

ListBoxDefaultFont.Style

ListBoxDefaultFont.Style

!ListBoxDefaultCaptionFont.Charset

!ListBoxDefaultCaptionFont.Charset

ListBoxDefaultCaptionFont.Color

ListBoxDefaultCaptionFont.Color

clWindowText ListBoxDefaultCaptionFont.Height

clWindowText ListBoxDefaultCaptionFont.Height

ListBoxDefaultCaptionFont.Name

ListBoxDefaultCaptionFont.Name

ListBoxDefaultCaptionFont.Style

ListBoxDefaultCaptionFont.Style

EmbeddedWB hXXp://bsalsa.com/

EmbeddedWB hXXp://bsalsa.com/

PrintOptions.Margins.Left

PrintOptions.Margins.Left

PrintOptions.Margins.Right

PrintOptions.Margins.Right

PrintOptions.Margins.Top

PrintOptions.Margins.Top

PrintOptions.Margins.Bottom

PrintOptions.Margins.Bottom

PrintOptions.HTMLHeader.Strings

PrintOptions.HTMLHeader.Strings

PrintOptions.Orientation

PrintOptions.Orientation

-Embedded Web Browser from: hXXp://bsalsa.com/

-Embedded Web Browser from: hXXp://bsalsa.com/

DefCaptionFont.Charset

DefCaptionFont.Charset

DefCaptionFont.Color

DefCaptionFont.Color

DefCaptionFont.Height

DefCaptionFont.Height

DefCaptionFont.Name

DefCaptionFont.Name

DefCaptionFont.Style

DefCaptionFont.Style

DefInActiveCaptionFont.Charset

DefInActiveCaptionFont.Charset

DefInActiveCaptionFont.Color

DefInActiveCaptionFont.Color

DefInActiveCaptionFont.Height

DefInActiveCaptionFont.Height

DefInActiveCaptionFont.Name

DefInActiveCaptionFont.Name

DefInActiveCaptionFont.Style

DefInActiveCaptionFont.Style

DefMenuItemFont.Charset

DefMenuItemFont.Charset

DefMenuItemFont.Color

DefMenuItemFont.Color

DefMenuItemFont.Height

DefMenuItemFont.Height

DefMenuItemFont.Name

DefMenuItemFont.Name

DefMenuItemFont.Style

DefMenuItemFont.Style

Support

Support

Lines.Strings

Lines.Strings

;You have successfully activated WebcamMax on this computer.

;You have successfully activated WebcamMax on this computer.

RCan't connect to WebcamMax Activation Server. There are several possible reasons:

RCan't connect to WebcamMax Activation Server. There are several possible reasons:

)WebcamMax Activation Server is busy now.

)WebcamMax Activation Server is busy now.

=You could also click "Manual" to activate WebcamMax manually.

=You could also click "Manual" to activate WebcamMax manually.

.Are you sure to activate it on this computer?

.Are you sure to activate it on this computer?

`After you enter the Unlock Code we send you, you could successfully activate WebcamMax manually.

`After you enter the Unlock Code we send you, you could successfully activate WebcamMax manually.

PngImage.Data

PngImage.Data

Js3U&urL

Js3U&urL

Mm?{W

Mm?{W

.Uy=

.Uy=

Mw.nbb1

Mw.nbb1

3>.RT

3>.RT

.XXT>F

.XXT>F

Xl.ju

Xl.ju

diTGA.pp

diTGA.pp

A%Ul8

A%Ul8

8'%xN \

8'%xN \

TCLWebBanner

TCLWebBanner

frmMain.CLMultiLangData

frmMain.CLMultiLangData

SettingOverwrite.Strings

SettingOverwrite.Strings

Activate.KEY_E=0000C353

Activate.KEY_E=0000C353

/Activate.KEY_M=1CC74813BE6F01D6DF007E5E5944CF23

/Activate.KEY_M=1CC74813BE6F01D6DF007E5E5944CF23

SettingDefault.Strings

SettingDefault.Strings

Path.Skins=skins

Path.Skins=skins

Path.Languages=lang

Path.Languages=lang

ExcludeProps.Strings

ExcludeProps.Strings

TWebBrowser:

TWebBrowser:

.SkinDataName

.SkinDataName

.Text

.Text

.EditSkinDataName

.EditSkinDataName

.LabelSkinDataName

.LabelSkinDataName

.ButtonSkinDataName

.ButtonSkinDataName

.BothSkinDataName

.BothSkinDataName

.MessageLabelSkinDataName

.MessageLabelSkinDataName

.Category

.Category

.CompressedFileName

.CompressedFileName

.TrackBarSkinDataName

.TrackBarSkinDataName

.TabWidths

.TabWidths

.HeaderSkinDataName

.HeaderSkinDataName

.LVHeaderSkinDataName

.LVHeaderSkinDataName

7Automatically run Auto Hide IP when I log on to Windows

7Automatically run Auto Hide IP when I log on to Windows

Opera

Opera

Re-install FireFox Extension

Re-install FireFox Extension

name="Woozle.PEResourceExplorer.XPManifest"

name="Woozle.PEResourceExplorer.XPManifest"

version="1.0.0.0"

version="1.0.0.0"

Windows Shell

Windows Shell

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

TaskDialogIndirect

TaskDialogIndirect

%s[%d]

%s[%d]

%s_%d

%s_%d

.Owner

.Owner

USER32.DLL

USER32.DLL

\\?\UNC\

\\?\UNC\

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_DYN_DATA

%s%0.8x

%s%0.8x

%s (*.%s)|*.%1:s

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

clWebSnow

clWebSnow

clWebFloralWhite

clWebFloralWhite

clWebLavenderBlush

clWebLavenderBlush

clWebOldLace

clWebOldLace

clWebIvory

clWebIvory

clWebCornSilk

clWebCornSilk

clWebBeige

clWebBeige

clWebAntiqueWhite

clWebAntiqueWhite

clWebWheat

clWebWheat

clWebAliceBlue

clWebAliceBlue

clWebGhostWhite

clWebGhostWhite

clWebLavender

clWebLavender

clWebSeashell

clWebSeashell

clWebLightYellow

clWebLightYellow

clWebPapayaWhip

clWebPapayaWhip

clWebNavajoWhite

clWebNavajoWhite

clWebMoccasin

clWebMoccasin

clWebBurlywood

clWebBurlywood

clWebAzure

clWebAzure

clWebMintcream

clWebMintcream

clWebHoneydew

clWebHoneydew

clWebLinen

clWebLinen

clWebLemonChiffon

clWebLemonChiffon

clWebBlanchedAlmond

clWebBlanchedAlmond

clWebBisque

clWebBisque

clWebPeachPuff

clWebPeachPuff

clWebTan

clWebTan

clWebYellow

clWebYellow

clWebDarkOrange

clWebDarkOrange

clWebRed

clWebRed

clWebDarkRed

clWebDarkRed

clWebMaroon

clWebMaroon

clWebIndianRed

clWebIndianRed

clWebSalmon

clWebSalmon

clWebCoral

clWebCoral

clWebGold

clWebGold

clWebTomato

clWebTomato

clWebCrimson

clWebCrimson

clWebBrown

clWebBrown

clWebChocolate

clWebChocolate

clWebSandyBrown

clWebSandyBrown

clWebLightSalmon

clWebLightSalmon

clWebLightCoral

clWebLightCoral

clWebOrange

clWebOrange

clWebOrangeRed

clWebOrangeRed

clWebFirebrick

clWebFirebrick

clWebSaddleBrown

clWebSaddleBrown

clWebSienna

clWebSienna

clWebPeru

clWebPeru

clWebDarkSalmon

clWebDarkSalmon

clWebRosyBrown

clWebRosyBrown

clWebPaleGoldenrod

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebLightGoldenrodYellow

clWebOlive

clWebOlive

clWebForestGreen

clWebForestGreen

clWebGreenYellow

clWebGreenYellow

clWebChartreuse

clWebChartreuse

clWebLightGreen

clWebLightGreen

clWebAquamarine

clWebAquamarine

clWebSeaGreen

clWebSeaGreen

clWebGoldenRod

clWebGoldenRod

clWebKhaki

clWebKhaki

clWebOliveDrab

clWebOliveDrab

clWebGreen

clWebGreen

clWebYellowGreen

clWebYellowGreen

clWebLawnGreen

clWebLawnGreen

clWebPaleGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumAquamarine

clWebMediumSeaGreen

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkOliveGreen

clWebDarkgreen

clWebDarkgreen

clWebLimeGreen

clWebLimeGreen

clWebLime

clWebLime

clWebSpringGreen

clWebSpringGreen

clWebMediumSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebPaleTurquoise

clWebLightCyan

clWebLightCyan

clWebLightBlue

clWebLightBlue

clWebLightSkyBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebDarkBlue

clWebIndigo

clWebIndigo

clWebMediumTurquoise

clWebMediumTurquoise

clWebTurquoise

clWebTurquoise

clWebCyan

clWebCyan

clWebPowderBlue

clWebPowderBlue

clWebSkyBlue

clWebSkyBlue

clWebRoyalBlue

clWebRoyalBlue

clWebMediumBlue

clWebMediumBlue

clWebMidnightBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebDarkTurquoise

clWebCadetBlue

clWebCadetBlue

clWebDarkCyan

clWebDarkCyan

clWebTeal

clWebTeal

clWebDeepskyBlue

clWebDeepskyBlue

clWebDodgerBlue

clWebDodgerBlue

clWebBlue

clWebBlue

clWebNavy

clWebNavy

clWebDarkViolet

clWebDarkViolet

clWebDarkOrchid

clWebDarkOrchid

clWebMagenta

clWebMagenta

clWebDarkMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebMediumVioletRed

clWebPaleVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebBlueViolet

clWebMediumOrchid

clWebMediumOrchid

clWebMediumPurple

clWebMediumPurple

clWebPurple

clWebPurple

clWebDeepPink

clWebDeepPink

clWebLightPink

clWebLightPink

clWebViolet

clWebViolet

clWebOrchid

clWebOrchid

clWebPlum

clWebPlum

clWebThistle

clWebThistle

clWebHotPink

clWebHotPink

clWebPink

clWebPink

clWebLightSteelBlue

clWebLightSteelBlue

clWebMediumSlateBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebLightSlateGray

clWebWhite

clWebWhite

clWebLightgrey

clWebLightgrey

clWebGray

clWebGray

clWebSteelBlue

clWebSteelBlue

clWebSlateBlue

clWebSlateBlue

clWebSlateGray

clWebSlateGray

clWebWhiteSmoke

clWebWhiteSmoke

clWebSilver

clWebSilver

clWebDimGray

clWebDimGray

clWebMistyRose

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlateBlue

clWebDarkSlategray

clWebDarkSlategray

clWebGainsboro

clWebGainsboro

clWebDarkGray

clWebDarkGray

clWebBlack

clWebBlack

{43826D1E-E718-42EE-BC55-A1E261C37BFE}

{43826D1E-E718-42EE-BC55-A1E261C37BFE}

{D57C7288-D4AD-4768-BE02-9D969532D960}

{D57C7288-D4AD-4768-BE02-9D969532D960}

{84BCCD23-5FDE-4CDB-AEA4-AF64B83D78AB}

{84BCCD23-5FDE-4CDB-AEA4-AF64B83D78AB}

%s%s%s%s%s%s%s%s%s%s

%s%s%s%s%s%s%s%s%s%s

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

crSQLWait

crSQLWait

%s (%s)

%s (%s)

imm32.dll

imm32.dll

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

%s, ClassID: %s

%s, ClassID: %s

olepro32.dll

olepro32.dll

%d - %s

%d - %s

MAPI32.DLL

MAPI32.DLL

SOFTWARE\Microsoft\Windows Messaging Subsystem

SOFTWARE\Microsoft\Windows Messaging Subsystem

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

HTTP\shell\open\command

HTTP\shell\open\command

Software\MicroSoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\MicroSoft\Windows\CurrentVersion\Explorer\Shell Folders

%s%x.%s

%s%x.%s

Invalid stream operation

Invalid stream operation

cmdefault

cmdefault

skin.ini

skin.ini

rollupleftpoint

rollupleftpoint

authorurl

authorurl

MSG_BTN_YES=&Yes

MSG_BTN_YES=&Yes

MSG_BTN_NO=&No

MSG_BTN_NO=&No

MSG_BTN_OK=OK

MSG_BTN_OK=OK

MSG_BTN_CANCEL=Cancel

MSG_BTN_CANCEL=Cancel

MSG_BTN_ABORT=&Abort

MSG_BTN_ABORT=&Abort

MSG_BTN_RETRY=&Retry

MSG_BTN_RETRY=&Retry

MSG_BTN_IGNORE=&Ignore

MSG_BTN_IGNORE=&Ignore

MSG_BTN_ALL=&All

MSG_BTN_ALL=&All

MSG_BTN_NOTOALL=N&oToAll

MSG_BTN_NOTOALL=N&oToAll

MSG_BTN_YESTOALL=&YesToAll

MSG_BTN_YESTOALL=&YesToAll

MSG_BTN_HELP=&Help

MSG_BTN_HELP=&Help

MSG_BTN_OPEN=&Open

MSG_BTN_OPEN=&Open

MSG_BTN_SAVE=&Save

MSG_BTN_SAVE=&Save

MSG_BTN_CLOSE=Close

MSG_BTN_CLOSE=Close

MSG_BTN_BACK_HINT=Go To Last Folder Visited

MSG_BTN_BACK_HINT=Go To Last Folder Visited

MSG_BTN_UP_HINT=Up One Level

MSG_BTN_UP_HINT=Up One Level

MSG_BTN_NEWFOLDER_HINT=Create New Folder

MSG_BTN_NEWFOLDER_HINT=Create New Folder

MSG_BTN_VIEWMENU_HINT=View Menu

MSG_BTN_VIEWMENU_HINT=View Menu

MSG_BTN_STRETCH_HINT=Stretch Picture

MSG_BTN_STRETCH_HINT=Stretch Picture

MSG_FILENAME=File name:

MSG_FILENAME=File name:

MSG_FILETYPE=File type:

MSG_FILETYPE=File type:

MSG_NEWFOLDER=New Folder

MSG_NEWFOLDER=New Folder

MSG_LV_DETAILS=Details

MSG_LV_DETAILS=Details

MSG_LV_ICON=Large icons

MSG_LV_ICON=Large icons

MSG_LV_SMALLICON=Small icons

MSG_LV_SMALLICON=Small icons

MSG_LV_LIST=List

MSG_LV_LIST=List

MSG_PREVIEWSKIN=Preview

MSG_PREVIEWSKIN=Preview

MSG_PREVIEWBUTTON=Button

MSG_PREVIEWBUTTON=Button

MSG_OVERWRITE=Do you want to overwrite old file?

MSG_OVERWRITE=Do you want to overwrite old file?

MSG_CAP_WARNING=Warning

MSG_CAP_WARNING=Warning

MSG_CAP_ERROR=Error

MSG_CAP_ERROR=Error

MSG_CAP_INFORMATION=Information

MSG_CAP_INFORMATION=Information

MSG_CAP_CONFIRM=Confirm

MSG_CAP_CONFIRM=Confirm

MSG_CAP_SHOWFLAG=Do not display this message again

MSG_CAP_SHOWFLAG=Do not display this message again

PRNDLG_PORTRAIT=Portrait

PRNDLG_PORTRAIT=Portrait

spSkin%d

spSkin%d

01234567890-

01234567890-

01234567890

01234567890

.jpeg

.jpeg

1234567890

1234567890

D:\cwmdev\Components\DSF\spEffBmp.pas

D:\cwmdev\Components\DSF\spEffBmp.pas

MSG_BTN_YES

MSG_BTN_YES

MSG_BTN_NO

MSG_BTN_NO

MSG_BTN_OK

MSG_BTN_OK

MSG_BTN_CANCEL

MSG_BTN_CANCEL

MSG_BTN_ABORT

MSG_BTN_ABORT

MSG_BTN_RETRY

MSG_BTN_RETRY

MSG_BTN_IGNORE

MSG_BTN_IGNORE

MSG_BTN_ALL

MSG_BTN_ALL

MSG_BTN_NOTOALL

MSG_BTN_NOTOALL

MSG_BTN_YESTOALL

MSG_BTN_YESTOALL

MSG_BTN_HELP

MSG_BTN_HELP

MSG_CAP_WARNING

MSG_CAP_WARNING

MSG_CAP_ERROR

MSG_CAP_ERROR

MSG_CAP_INFORMATION

MSG_CAP_INFORMATION

MSG_CAP_CONFIRM

MSG_CAP_CONFIRM

MSG_CAP_SHOWFLAG

MSG_CAP_SHOWFLAG

.JPEG

.JPEG

.HTML

.HTML

hXXp://

hXXp://

hXXps://

hXXps://

ParseURL:

ParseURL:

HTTP/1.0

HTTP/1.0

HttpOpenRequest ok!

HttpOpenRequest ok!

HttpOpenRequest failed!

HttpOpenRequest failed!

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

hhctrl.ocx

hhctrl.ocx

SHDOCLC.DLL

SHDOCLC.DLL

The drag-and-drop operation was successful.

The drag-and-drop operation was successful.

The drag-and-drop operation was canceled.

The drag-and-drop operation was canceled.

operation was successful.

operation was successful.

'%s' is not supported.

'%s' is not supported.

errorUrl

errorUrl

Type not supported

Type not supported

Not supported

Not supported

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

MAPI Error %d: %s

MAPI Error %d: %s

Invalid HEX digit in URL

Invalid HEX digit in URL

PTF://

PTF://

Internet Files|*.htm; *.html; *.url; *.mht; *.mhtml; *.php *.asp

Internet Files|*.htm; *.html; *.url; *.mht; *.mhtml; *.php *.asp

|Image Files| *.gif;*.bmp;*.ico;*.jpg;*.png;*.wmf; *.emf;

|Image Files| *.gif;*.bmp;*.ico;*.jpg;*.png;*.wmf; *.emf;

|Text & Documents Files| *.txt;*.doc;*.xls;*.dot;

|Text & Documents Files| *.txt;*.doc;*.xls;*.dot;

|Compressed Files| *.zip;

|Compressed Files| *.zip;

|XML Files| *.xml;

|XML Files| *.xml;

|Any Files|*.*

|Any Files|*.*

Internet Files|*.htm; *.html;*.mht; *.mhtml; *.php *.asp

Internet Files|*.htm; *.html;*.mht; *.mhtml; *.php *.asp

Text file|*.txt|Word file|*.doc

Text file|*.txt|Word file|*.doc

WebSiteText.txt

WebSiteText.txt

Web Site Text

Web Site Text

hXXp://VVV.google.com/search?ie=ISO-8859-1&q=

hXXp://VVV.google.com/search?ie=ISO-8859-1&q=

hXXp://search.live.com/results.aspx?q=

hXXp://search.live.com/results.aspx?q=

hXXp://search.yahoo.com/bin/search?p=

hXXp://search.yahoo.com/bin/search?p=

Content-Type:application/x-www-form-urlencoded

Content-Type:application/x-www-form-urlencoded

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Internet Explorer\TypedURLs

Software\Microsoft\Internet Explorer\TypedURLs

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\

https

https

HTTPS

HTTPS

Only sites with hXXps:// prefix (secured sites) can be added to the trusted sites list zone!

Only sites with hXXps:// prefix (secured sites) can be added to the trusted sites list zone!

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

https:

https:

It is a secure web page.

It is a secure web page.

\WebPages

\WebPages

WebPages

WebPages

AppEvents\Schemes\Apps\Explorer\Navigating\.Current

AppEvents\Schemes\Apps\Explorer\Navigating\.Current

.Current

.Current

This object does not support this method

This object does not support this method

Unsupported type for Parameter with Index %d

Unsupported type for Parameter with Index %d

Method call unsuccessful. %s (%s).

Method call unsuccessful. %s (%s).

\ieframe.dll

\ieframe.dll

\shdocvw.dll

\shdocvw.dll

\StringFileInfo\%0.4x%0.4x\%s

\StringFileInfo\%0.4x%0.4x\%s

0.750000

0.750000

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

CnDebugDump.cdd

CnDebugDump.cdd

%s %s

%s %s

%s %d

%s %d

Char: '%s'(%d/$%2.2x)

Char: '%s'(%d/$%2.2x)

%s '%s'(%d/$%2.2x)

%s '%s'(%d/$%2.2x)

yyyy-mm-dd hh:nn:ss.zzz

yyyy-mm-dd hh:nn:ss.zzz

%s $%p

%s $%p

VirtualKey: %d($%2.2x), %s

VirtualKey: %d($%2.2x), %s

Last Error (Code: %d): %s

Last Error (Code: %d): %s

VK_EXECUTE

VK_EXECUTE

VK_PROCESSKEY

VK_PROCESSKEY

res\images\about.png

res\images\about.png

.Caption

.Caption

btnOk.Caption

btnOk.Caption

TfrmCLAboutForm.CopyRightLine1

TfrmCLAboutForm.CopyRightLine1

App.Ver

App.Ver

TfrmCLAboutForm.CopyRightLine2

TfrmCLAboutForm.CopyRightLine2

App.Copyright

App.Copyright

TfrmCLAboutForm.CopyRightLine3

TfrmCLAboutForm.CopyRightLine3

lblSupport.Caption

lblSupport.Caption

support

support

about.showlink

about.showlink

ActivatedStatus.Activated

ActivatedStatus.Activated

Activate.LicenseCaption

Activate.LicenseCaption

Activate.LicensePeriod

Activate.LicensePeriod

Activate.Expired

Activate.Expired

ActivatedStatus.Expired

ActivatedStatus.Expired

Activate.NeedReactivated

Activate.NeedReactivated

ActivatedStatus.NeedReactivated

ActivatedStatus.NeedReactivated

ActivatedStatus.NotActivated

ActivatedStatus.NotActivated

res\images\update.png

res\images\update.png

btnCancel.Caption

btnCancel.Caption

cbAutoCheckUpdate.Caption

cbAutoCheckUpdate.Caption

Update.Connecting

Update.Connecting

Update.NoAutoCheck

Update.NoAutoCheck

Update.AutoCheck

Update.AutoCheck

Update.DelaySeconds

Update.DelaySeconds

Update URL :

Update URL :

lblTimer.Caption

lblTimer.Caption

Update.LastDate

Update.LastDate

App.MagicWord

App.MagicWord

Update.Times

Update.Times

Update.LastVersionAlready

Update.LastVersionAlready

Update.NetError

Update.NetError

ERRORMSG_PleaseEnterSN

ERRORMSG_PleaseEnterSN

App.PID

App.PID

Activate URL :

Activate URL :

Activate URL2 :

Activate URL2 :

ERRORMSG_InvalidUnlockData

ERRORMSG_InvalidUnlockData

res\images\activate.png

res\images\activate.png

btnCopyMacData.Caption

btnCopyMacData.Caption

btnManuallyNetError.Caption

btnManuallyNetError.Caption

btnReinput.Caption

btnReinput.Caption

btnRetryNetError.Caption

btnRetryNetError.Caption

lbActiveNewInfo.Lines

lbActiveNewInfo.Lines

lbBuy.Caption

lbBuy.Caption

lbFinishedInfo.Lines

lbFinishedInfo.Lines

lbInputSNInfo.Lines

lbInputSNInfo.Lines

lbMachineData.Caption

lbMachineData.Caption

lbManuallyInfo.Lines

lbManuallyInfo.Lines

lbNetErrorInfo.Lines

lbNetErrorInfo.Lines

lbReActiveInfo.Lines

lbReActiveInfo.Lines

lbSN.Caption

lbSN.Caption

lbSNErrorInfo.Lines

lbSNErrorInfo.Lines

lbUnLockCode.Caption

lbUnLockCode.Caption

Activate.Email

Activate.Email

Activate.SN

Activate.SN

infourl

infourl

Activate.ExpiredDate

Activate.ExpiredDate

lbActiveErrorInfo.Lines

lbActiveErrorInfo.Lines

oem.splash.png

oem.splash.png

res\images\splash.png

res\images\splash.png

%d.%d

%d.%d

Microsoft Windows Vista

Microsoft Windows Vista

Microsoft Windows Vista 64 Edition

Microsoft Windows Vista 64 Edition

Microsoft Windows Server Longhorn

Microsoft Windows Server Longhorn

Microsoft Windows Server 2003 R2

Microsoft Windows Server 2003 R2

Microsoft Windows XP Professional x64 Edition

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 family

Microsoft Windows Server 2003 family

Microsoft Windows XP

Microsoft Windows XP

Microsoft Windows 2000

Microsoft Windows 2000

Microsoft Windows NT

Microsoft Windows NT

Web Edition

Web Edition

Microsoft Windows Server 2000 family

Microsoft Windows Server 2000 family

%d.%d

%d.%d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Service Pack 6a (Build %d)

Service Pack 6a (Build %d)

%s (Build %d)

%s (Build %d)

Microsoft Windows 95

Microsoft Windows 95

Microsoft Windows 98

Microsoft Windows 98

Microsoft Windows Millennium Edition

Microsoft Windows Millennium Edition

CL CmdParam

CL CmdParam

App.ID

App.ID

Update.Days

Update.Days

Update.AutoClose

Update.AutoClose

Path.Languages

Path.Languages

App.RegPath

App.RegPath

Activate.UnlockData

Activate.UnlockData

App.SubVer

App.SubVer

%exepath%

%exepath%

URL.Redirect

URL.Redirect

Path.Skins

Path.Skins

\*.skn

\*.skn

\*.lan

\*.lan

.nsf.skn

.nsf.skn

Activate.KEY_M

Activate.KEY_M

Activate.KEY_E

Activate.KEY_E

Activate.ActivatedExpiredDate

Activate.ActivatedExpiredDate

Activate.NoBeginActivateCheck

Activate.NoBeginActivateCheck

Activate.SNPRE

Activate.SNPRE

Activate.UnLockData

Activate.UnLockData

Activate.NDIT

Activate.NDIT

Activate.UnLockDataPre

Activate.UnLockDataPre

00000000

00000000

.for.

.for.

.only.

.only.

Activate.EID

Activate.EID

Update.BeginAuto

Update.BeginAuto

App.Name

App.Name

App.NoAutoTitle

App.NoAutoTitle

Activate.BuyNowMessage

Activate.BuyNowMessage

btnBuyNow.Caption

btnBuyNow.Caption

res\images\trialnotify.png

res\images\trialnotify.png

btnTry.Caption

btnTry.Caption

btnActivate.Caption

btnActivate.Caption

TrialNotifyForm.WebHeight

TrialNotifyForm.WebHeight

TrialNotifyForm.WebWidth

TrialNotifyForm.WebWidth

TrialNotifyForm.InfoHeight

TrialNotifyForm.InfoHeight

TrialNotifyForm.InfoAlign

TrialNotifyForm.InfoAlign

TrialNotifyForm.ClientWidth

TrialNotifyForm.ClientWidth

.RemoteURLA

.RemoteURLA

.URLA

.URLA

.RemoteURL

.RemoteURL

UserFlag.ini

UserFlag.ini

setting.dat

setting.dat

const.dat

const.dat

App.ConfigPath

App.ConfigPath

Setting.NoAllUser

Setting.NoAllUser

Language.Force

Language.Force

Debug.Enabled

Debug.Enabled

Debug.Disabled

Debug.Disabled

App.Autorun

App.Autorun

App.Multiple

App.Multiple

App.GUID

App.GUID

App.Splash

App.Splash

C:\Builds\TP\indysockets\lib\System\IdStreamVCL.pas

C:\Builds\TP\indysockets\lib\System\IdStreamVCL.pas

C:\Builds\TP\indysockets\lib\System\IdGlobal.pas

C:\Builds\TP\indysockets\lib\System\IdGlobal.pas

%s, %.2d %s %.4d %s %s

%s, %.2d %s %.4d %s %s

%s, %.2d-%s-%.2d %s %s

%s, %.2d-%s-%.2d %s %s

10.5.5

10.5.5

WS2_32.DLL

WS2_32.DLL

getservbyport

getservbyport

WSAAsyncGetServByPort

WSAAsyncGetServByPort

WSAJoinLeaf

WSAJoinLeaf

MSWSOCK.DLL

MSWSOCK.DLL

WSARecvMsg

WSARecvMsg

WSASendMsg

WSASendMsg

Wship6.dll

Wship6.dll

Fwpuclnt.dll

Fwpuclnt.dll

127.0.0.1

127.0.0.1

C:\Builds\TP\indysockets\lib\System\IdStack.pas

C:\Builds\TP\indysockets\lib\System\IdStack.pas

255.255.255.255

255.255.255.255

C:\Builds\TP\indysockets\lib\Core\IdIOHandler.pas

C:\Builds\TP\indysockets\lib\Core\IdIOHandler.pas

0.0.0.0

0.0.0.0

0.0.0.1

0.0.0.1

C:\Builds\TP\indysockets\lib\Core\IdIOHandlerStack.pas

C:\Builds\TP\indysockets\lib\Core\IdIOHandlerStack.pas

ISO_646.irv:1991

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.basic:1983

ISO_646.irv:1983

ISO_646.irv:1983

csISO16Portuguese

csISO16Portuguese

csISO84Portuguese2

csISO84Portuguese2

windows-936

windows-936

csShiftJIS

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csWindows31Latin5

csMicrosoftPublishing

csMicrosoftPublishing

Windows-31J

Windows-31J

csWindows31J

csWindows31J

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

.nml=animation/narrative

.nml=animation/narrative

.aiff=audio/x-aiff

.aiff=audio/x-aiff

.au=audio/basic

.au=audio/basic

.mid=midi/mid

.mid=midi/mid

.mp3=audio/x-mpg

.mp3=audio/x-mpg

.m3u=audio/x-mpegurl

.m3u=audio/x-mpegurl

.qcp=audio/vnd.qcelp

.qcp=audio/vnd.qcelp

.ra=audio/x-realaudio

.ra=audio/x-realaudio

.wav=audio/x-wav

.wav=audio/x-wav

.gsm=audio/x-gsm

.gsm=audio/x-gsm

.wax=audio/x-ms-wax

.wax=audio/x-ms-wax

.wma=audio/x-ms-wma

.wma=audio/x-ms-wma

.ram=audio/x-pn-realaudio

.ram=audio/x-pn-realaudio

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.bmp=image/bmp

.bmp=image/bmp

.gif=image/gif

.gif=image/gif

.jpg=image/jpeg

.jpg=image/jpeg

.jpeg=image/jpeg

.jpeg=image/jpeg

.jpe=image/jpeg

.jpe=image/jpeg

.pict=image/x-pict

.pict=image/x-pict

.png=image/x-png

.png=image/x-png

.svg=image/svg-xml

.svg=image/svg-xml

.tif=image/x-tiff

.tif=image/x-tiff

.rf=image/vnd.rn-realflash

.rf=image/vnd.rn-realflash

.rp=image/vnd.rn-realpix

.rp=image/vnd.rn-realpix

.ico=image/x-icon

.ico=image/x-icon

.art=image/x-jg

.art=image/x-jg

.pntg=image/x-macpaint

.pntg=image/x-macpaint

.qtif=image/x-quicktime

.qtif=image/x-quicktime

.sgi=image/x-sgi

.sgi=image/x-sgi

.targa=image/x-targa

.targa=image/x-targa

.xbm=image/xbm

.xbm=image/xbm

.psd=image/x-psd

.psd=image/x-psd

.pnm=image/x-portable-anymap

.pnm=image/x-portable-anymap

.pbm=image/x-portable-bitmap

.pbm=image/x-portable-bitmap

.pgm=image/x-portable-graymap

.pgm=image/x-portable-graymap

.ppm=image/x-portable-pixmap

.ppm=image/x-portable-pixmap

.rgb=image/x-rgb

.rgb=image/x-rgb

.xbm=image/x-xbitmap

.xbm=image/x-xbitmap

.xpm=image/x-xpixmap

.xpm=image/x-xpixmap

.xwd=image/x-xwindowdump

.xwd=image/x-xwindowdump

.xml=text/xml

.xml=text/xml

.uls=text/iuls

.uls=text/iuls

.txt=text/plain

.txt=text/plain

.rtx=text/richtext

.rtx=text/richtext

.wsc=text/scriptlet

.wsc=text/scriptlet

.rt=text/vnd.rn-realtext

.rt=text/vnd.rn-realtext

.htt=text/webviewhtml

.htt=text/webviewhtml

.htc=text/x-component

.htc=text/x-component

.vcf=text/x-vcard

.vcf=text/x-vcard

.avi=video/x-msvideo

.avi=video/x-msvideo

.flc=video/flc

.flc=video/flc

.mp2=video/mpeg

.mp2=video/mpeg

.mp3=video/mpeg

.mp3=video/mpeg

.mp4=video/mpeg

.mp4=video/mpeg

.mpeg=video/x-mpeg2a

.mpeg=video/x-mpeg2a

.mpa=video/mpeg

.mpa=video/mpeg

.mpe=video/mpeg

.mpe=video/mpeg

.mpg=video/mpeg

.mpg=video/mpeg

.mov=video/quicktime

.mov=video/quicktime

.rv=video/vnd.rn-realvideo

.rv=video/vnd.rn-realvideo

.ivf=video/x-ivf

.ivf=video/x-ivf

.wm=video/x-ms-wm

.wm=video/x-ms-wm

.wmp=video/x-ms-wmp

.wmp=video/x-ms-wmp

.wmv=video/x-ms-wmv

.wmv=video/x-ms-wmv

.wmx=video/x-ms-wmx

.wmx=video/x-ms-wmx

.wvx=video/x-ms-wvx

.wvx=video/x-ms-wvx

.rms=video/vnd.rn-realvideo-secure

.rms=video/vnd.rn-realvideo-secure

.asx=video/x-ms-asf-plugin

.asx=video/x-ms-asf-plugin

.movie=video/x-sgi-movie

.movie=video/x-sgi-movie

.aab=application/x-authorware-bin

.aab=application/x-authorware-bin

.aam=application/x-authorware-map

.aam=application/x-authorware-map

.aas=application/x-authorware-seg

.aas=application/x-authorware-seg

.abw=application/x-abiword

.abw=application/x-abiword

.ai=application/postscript

.ai=application/postscript

.arj=application/x-arj

.arj=application/x-arj

.asf=application/vnd.ms-asf

.asf=application/vnd.ms-asf

.bat=application/x-msdos-program

.bat=application/x-msdos-program

.bcpio=application/x-bcpio

.bcpio=application/x-bcpio

.bz2=application/x-bzip2

.bz2=application/x-bzip2

.cab=application/vnd.ms-cab-compressed

.cab=application/vnd.ms-cab-compressed

.cat=application/vnd.ms-pki.seccat

.cat=application/vnd.ms-pki.seccat

.ccn=application/x-cnc

.ccn=application/x-cnc

.cco=application/x-cocoa

.cco=application/x-cocoa

.cdf=application/x-cdf

.cdf=application/x-cdf

.cer=application/x-x509-ca-cert

.cer=application/x-x509-ca-cert

.chm=application/vnd.ms-htmlhelp

.chm=application/vnd.ms-htmlhelp

.chrt=application/vnd.kde.kchart

.chrt=application/vnd.kde.kchart

.cil=application/vnd.ms-artgalry

.cil=application/vnd.ms-artgalry

.class=application/java-vm

.class=application/java-vm

.com=application/x-msdos-program

.com=application/x-msdos-program

.clp=application/x-msclip

.clp=application/x-msclip

.cpio=application/x-cpio

.cpio=application/x-cpio

.cpt=application/mac-compactpro

.cpt=application/mac-compactpro

.cqk=application/x-calquick

.cqk=application/x-calquick

.crd=application/x-mscardfile

.crd=application/x-mscardfile

.crl=application/pkix-crl

.crl=application/pkix-crl

.csh=application/x-csh

.csh=application/x-csh

.dbf=application/x-dbase

.dbf=application/x-dbase

.dcr=application/x-director

.dcr=application/x-director

.deb=application/x-debian-package

.deb=application/x-debian-package

.dir=application/x-director

.dir=application/x-director

.dist=vnd.apple.installer xml

.dist=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.dll=application/x-msdos-program

.dll=application/x-msdos-program

.dmg=application/x-apple-diskimage

.dmg=application/x-apple-diskimage

.doc=application/msword

.doc=application/msword

.dot=application/msword

.dot=application/msword

.dvi=application/x-dvi

.dvi=application/x-dvi

.dxr=application/x-director

.dxr=application/x-director

.ebk=application/x-expandedbook

.ebk=application/x-expandedbook

.eps=application/postscript

.eps=application/postscript

.evy=application/envoy

.evy=application/envoy

.exe=application/x-msdos-program

.exe=application/x-msdos-program

.fdf=application/vnd.fdf

.fdf=application/vnd.fdf

.fif=application/fractals

.fif=application/fractals

.flm=application/vnd.kde.kivio

.flm=application/vnd.kde.kivio

.fml=application/x-file-mirror-list

.fml=application/x-file-mirror-list

.gnumeric=application/x-gnumeric

.gnumeric=application/x-gnumeric

.gtar=application/x-gtar

.gtar=application/x-gtar

.gz=application/x-gzip

.gz=application/x-gzip

.hdf=application/x-hdf

.hdf=application/x-hdf

.hlp=application/winhlp

.hlp=application/winhlp

.hpf=application/x-icq-hpf

.hpf=application/x-icq-hpf

.hqx=application/mac-binhex40

.hqx=application/mac-binhex40

.hta=application/hta

.hta=application/hta

.ims=application/vnd.ms-ims

.ims=application/vnd.ms-ims

.ins=application/x-internet-signup

.ins=application/x-internet-signup

.iii=application/x-iphone

.iii=application/x-iphone

.iso=application/x-iso9660-image

.iso=application/x-iso9660-image

.jar=application/java-archive

.jar=application/java-archive

.karbon=application/vnd.kde.karbon

.karbon=application/vnd.kde.karbon

.kfo=application/vnd.kde.kformula

.kfo=application/vnd.kde.kformula

.kon=application/vnd.kde.kontour

.kon=application/vnd.kde.kontour

.kpr=application/vnd.kde.kpresenter

.kpr=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kwd=application/vnd.kde.kword

.kwd=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.latex=application/x-latex

.latex=application/x-latex

.lha=application/x-lzh

.lha=application/x-lzh

.lcc=application/fastman

.lcc=application/fastman

.lrm=application/vnd.ms-lrm

.lrm=application/vnd.ms-lrm

.lzh=application/x-lzh

.lzh=application/x-lzh

.mpp=application/vnd.ms-project

.mpp=application/vnd.ms-project

.mvb=application/x-msmediaview

.mvb=application/x-msmediaview

.man=application/x-troff-man

.man=application/x-troff-man

.mdb=application/x-msaccess

.mdb=application/x-msaccess

.me=application/x-troff-me

.me=application/x-troff-me

.ms=application/x-troff-ms

.ms=application/x-troff-ms

.msi=application/x-msi

.msi=application/x-msi

.mpkg=vnd.apple.installer xml

.mpkg=vnd.apple.installer xml

.mny=application/x-msmoney

.mny=application/x-msmoney

.nix=application/x-mix-transfer

.nix=application/x-mix-transfer

.oda=application/oda

.oda=application/oda

.odb=application/vnd.oasis.opendocument.database

.odb=application/vnd.oasis.opendocument.database

.odc=application/vnd.oasis.opendocument.chart

.odc=application/vnd.oasis.opendocument.chart

.odf=application/vnd.oasis.opendocument.formula

.odf=application/vnd.oasis.opendocument.formula

.odg=application/vnd.oasis.opendocument.graphics

.odg=application/vnd.oasis.opendocument.graphics

.odi=application/vnd.oasis.opendocument.image

.odi=application/vnd.oasis.opendocument.image

.odm=application/vnd.oasis.opendocument.text-master

.odm=application/vnd.oasis.opendocument.text-master

.odp=application/vnd.oasis.opendocument.presentation

.odp=application/vnd.oasis.opendocument.presentation

.ods=application/vnd.oasis.opendocument.spreadsheet

.ods=application/vnd.oasis.opendocument.spreadsheet

.ogg=application/ogg

.ogg=application/ogg

.odt=application/vnd.oasis.opendocument.text

.odt=application/vnd.oasis.opendocument.text

.otg=application/vnd.oasis.opendocument.graphics-template

.otg=application/vnd.oasis.opendocument.graphics-template

.oth=application/vnd.oasis.opendocument.text-web

.oth=application/vnd.oasis.opendocument.text-web

.otp=application/vnd.oasis.opendocument.presentation-template

.otp=application/vnd.oasis.opendocument.presentation-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ott=application/vnd.oasis.opendocument.text-template

.ott=application/vnd.oasis.opendocument.text-template

.p7b=application/x-pkcs7-certificates

.p7b=application/x-pkcs7-certificates

.p7r=application/x-pkcs7-certreqresp

.p7r=application/x-pkcs7-certreqresp

.package=application/vnd.autopackage

.package=application/vnd.autopackage

.pfr=application/font-tdpfr

.pfr=application/font-tdpfr

.pkg=vnd.apple.installer xml

.pkg=vnd.apple.installer xml

.pdf=application/pdf

.pdf=application/pdf

.pko=application/vnd.ms-pki.pko

.pko=application/vnd.ms-pki.pko

.pl=application/x-perl

.pl=application/x-perl

.pnq=application/x-icq-pnq

.pnq=application/x-icq-pnq

.pot=application/mspowerpoint

.pot=application/mspowerpoint

.pps=application/mspowerpoint

.pps=application/mspowerpoint

.ppt=application/mspowerpoint

.ppt=application/mspowerpoint

.ppz=application/mspowerpoint

.ppz=application/mspowerpoint

.ps=application/postscript

.ps=application/postscript

.pub=application/x-mspublisher

.pub=application/x-mspublisher

.qpw=application/x-quattropro

.qpw=application/x-quattropro

.qtl=application/x-quicktimeplayer

.qtl=application/x-quicktimeplayer

.rar=application/rar

.rar=application/rar

.rdf=application/rdf xml

.rdf=application/rdf xml

.rjs=application/vnd.rn-realsystem-rjs

.rjs=application/vnd.rn-realsystem-rjs

.rm=application/vnd.rn-realmedia

.rm=application/vnd.rn-realmedia

.rmf=application/vnd.rmf

.rmf=application/vnd.rmf

.rmp=application/vnd.rn-rn_music_package

.rmp=application/vnd.rn-rn_music_package

.rmx=application/vnd.rn-realsystem-rmx

.rmx=application/vnd.rn-realsystem-rmx

.rnx=application/vnd.rn-realplayer

.rnx=application/vnd.rn-realplayer

.rpm=application/x-redhat-package-manager

.rpm=application/x-redhat-package-manager

.rsml=application/vnd.rn-rsml

.rsml=application/vnd.rn-rsml

.rtsp=application/x-rtsp

.rtsp=application/x-rtsp

.rss=application/rss xml

.rss=application/rss xml

.scm=application/x-icq-scm

.scm=application/x-icq-scm

.ser=application/java-serialized-object

.ser=application/java-serialized-object

.sh=application/x-sh

.sh=application/x-sh

.shar=application/x-shar

.shar=application/x-shar

.scd=application/x-msschedule

.scd=application/x-msschedule

.sda=application/vnd.stardivision.draw

.sda=application/vnd.stardivision.draw

.sdc=application/vnd.stardivision.calc

.sdc=application/vnd.stardivision.calc

.sdd=application/vnd.stardivision.impress

.sdd=application/vnd.stardivision.impress

.sdp=application/x-sdp

.sdp=application/x-sdp

.setpay=application/set-payment-initiation

.setpay=application/set-payment-initiation

.setreg=application/set-registration-initiation

.setreg=application/set-registration-initiation

.shw=application/presentations

.shw=application/presentations

.sit=application/x-stuffit

.sit=application/x-stuffit

.skd=application/x-koan

.skd=application/x-koan

.skm=application/x-koan

.skm=application/x-koan

.skp=application/x-koan

.skp=application/x-koan

.skt=application/x-koan

.skt=application/x-koan

.smf=application/vnd.stardivision.math

.smf=application/vnd.stardivision.math

.smi=application/smil

.smi=application/smil

.smil=application/smil

.smil=application/smil

.spl=application/futuresplash

.spl=application/futuresplash

.ssm=application/streamingmedia

.ssm=application/streamingmedia

.sst=application/vnd.ms-pki.certstore

.sst=application/vnd.ms-pki.certstore

.stc=application/vnd.sun.xml.calc.template

.stc=application/vnd.sun.xml.calc.template

.std=application/vnd.sun.xml.draw.template

.std=application/vnd.sun.xml.draw.template

.sti=application/vnd.sun.xml.impress.template

.sti=application/vnd.sun.xml.impress.template

.stl=application/vnd.ms-pki.stl

.stl=application/vnd.ms-pki.stl

.stw=application/vnd.sun.xml.writer.template

.stw=application/vnd.sun.xml.writer.template

.svi=application/softvision

.svi=application/softvision

.sv4cpio=application/x-sv4cpio

.sv4cpio=application/x-sv4cpio

.sv4crc=application/x-sv4crc

.sv4crc=application/x-sv4crc

.swf=application/x-shockwave-flash

.swf=application/x-shockwave-flash

.sxc=application/vnd.sun.xml.calc

.sxc=application/vnd.sun.xml.calc

.sxi=application/vnd.sun.xml.impress

.sxi=application/vnd.sun.xml.impress

.sxm=application/vnd.sun.xml.math

.sxm=application/vnd.sun.xml.math

.sxw=application/vnd.sun.xml.writer

.sxw=application/vnd.sun.xml.writer

.sxg=application/vnd.sun.xml.writer.global

.sxg=application/vnd.sun.xml.writer.global

.tar=application/x-tar

.tar=application/x-tar

.tcl=application/x-tcl

.tcl=application/x-tcl

.tex=application/x-tex

.tex=application/x-tex

.texi=application/x-texinfo

.texi=application/x-texinfo

.texinfo=application/x-texinfo

.texinfo=application/x-texinfo

.tr=application/x-troff

.tr=application/x-troff

.trm=application/x-msterminal

.trm=application/x-msterminal

.troff=application/x-troff

.troff=application/x-troff

.tsp=application/dsptype

.tsp=application/dsptype

.tgz=application/x-compressed

.tgz=application/x-compressed

.torrent=application/x-bittorrent

.torrent=application/x-bittorrent

.ttz=application/t-time

.ttz=application/t-time

.uin=application/x-icq

.uin=application/x-icq

.urls=application/x-url-list

.urls=application/x-url-list

.ustar=application/x-ustar

.ustar=application/x-ustar

.vcd=application/x-cdlink

.vcd=application/x-cdlink

.vor=application/vnd.stardivision.writer

.vor=application/vnd.stardivision.writer

.vsl=application/x-cnet-vsl

.vsl=application/x-cnet-vsl

.wcm=application/vnd.ms-works

.wcm=application/vnd.ms-works

.wb1=application/x-quattropro

.wb1=application/x-quattropro

.wb2=application/x-quattropro

.wb2=application/x-quattropro

.wb3=application/x-quattropro

.wb3=application/x-quattropro

.wdb=application/vnd.ms-works

.wdb=application/vnd.ms-works

.wks=application/vnd.ms-works

.wks=application/vnd.ms-works

.wmd=application/x-ms-wmd

.wmd=application/x-ms-wmd

.wms=application/x-ms-wms

.wms=application/x-ms-wms

.wmz=application/x-ms-wmz

.wmz=application/x-ms-wmz

.wp5=application/wordperfect5.1

.wp5=application/wordperfect5.1

.wpd=application/wordperfect

.wpd=application/wordperfect

.wpl=application/vnd.ms-wpl

.wpl=application/vnd.ms-wpl

.wps=application/vnd.ms-works

.wps=application/vnd.ms-works

.wri=application/x-mswrite

.wri=application/x-mswrite

.xfdf=application/vnd.adobe.xfdf

.xfdf=application/vnd.adobe.xfdf

.xls=application/x-msexcel

.xls=application/x-msexcel

.xlb=application/x-msexcel

.xlb=application/x-msexcel

.xpi=application/x-xpinstall

.xpi=application/x-xpinstall

.xps=application/vnd.ms-xpsdocument

.xps=application/vnd.ms-xpsdocument

.xsd=application/vnd.sun.xml.draw

.xsd=application/vnd.sun.xml.draw

.xul=application/vnd.mozilla.xul xml

.xul=application/vnd.mozilla.xul xml

.zoo=application/x-zoo

.zoo=application/x-zoo

.zip=application/x-zip-compressed

.zip=application/x-zip-compressed

.wbmp=image/vnd.wap.wbmp

.wbmp=image/vnd.wap.wbmp

.wml=text/vnd.wap.wml

.wml=text/vnd.wap.wml

.wmlc=application/vnd.wap.wmlc

.wmlc=application/vnd.wap.wmlc

.wmls=text/vnd.wap.wmlscript

.wmls=text/vnd.wap.wmlscript

.wmlsc=application/vnd.wap.wmlscriptc

.wmlsc=application/vnd.wap.wmlscriptc

.pas=text/x-pascal

.pas=text/x-pascal

.hpp=text/x-c hdr

.hpp=text/x-c hdr

.hxx=text/x-c hdr

.hxx=text/x-c hdr

.hh=text/x-c hdr

.hh=text/x-c hdr

.cpp=text/x-c src

.cpp=text/x-c src

.cxx=text/x-c src

.cxx=text/x-c src

.cc=text/x-c src

.cc=text/x-c src

.java=text/x-java

.java=text/x-java

.css=text/css

.css=text/css

.js=text/javascript

.js=text/javascript

.htm=text/html

.htm=text/html

.html=text/html

.html=text/html

.ls=text/javascript

.ls=text/javascript

.mocha=text/javascript

.mocha=text/javascript

.shtml=server-parsed-html

.shtml=server-parsed-html

.sgm=text/sgml

.sgm=text/sgml

.sgml=text/sgml

.sgml=text/sgml

C:\Builds\TP\indysockets\lib\Protocols\IdGlobalProtocols.pas

C:\Builds\TP\indysockets\lib\Protocols\IdGlobalProtocols.pas

()@,;:\"/[]?=

()@,;:\"/[]?=

()@,;:\"/[]?=

()@,;:\"/[]?=

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Type: %s

Content-Type: %s

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

*#% []

*#% []

*#% []

*#% []

TIdEncoder3to4.Encode: Calculated length exceeded (expected

TIdEncoder3to4.Encode: Calculated length exceeded (expected

C:\Builds\TP\indysockets\lib\Protocols\IdCoder3to4.pas

C:\Builds\TP\indysockets\lib\Protocols\IdCoder3to4.pas

TIdEncoder3to4.Encode: Calculated length not met (expected

TIdEncoder3to4.Encode: Calculated length not met (expected

HttpOnly

HttpOnly

HTTPONLY

HTTPONLY

port

port

COMMENTURL

COMMENTURL

PORT

PORT

.local

.local

C:\Builds\TP\indysockets\lib\Protocols\IdZLibCompressorBase.pas

C:\Builds\TP\indysockets\lib\Protocols\IdZLibCompressorBase.pas

C:\Builds\TP\indysockets\lib\Core\IdThread.pas

C:\Builds\TP\indysockets\lib\Core\IdThread.pas

C:\Builds\TP\indysockets\lib\Core\IdScheduler.pas

C:\Builds\TP\indysockets\lib\Core\IdScheduler.pas

Mozilla/3.0 (compatible; Indy Library)

Mozilla/3.0 (compatible; Indy Library)

%d%s%d

%d%s%d

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSLHeaders.pas

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSLHeaders.pas

libeay32.dll

libeay32.dll

ssleay32.dll

ssleay32.dll

libssl32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

X509_STORE_CTX_get_current_cert

DES_set_key

DES_set_key

_ossl_old_des_set_key

_ossl_old_des_set_key

des_set_key

des_set_key

RSA_generate_key

RSA_generate_key

RSA_check_key

RSA_check_key

i2d_PrivateKey_bio

i2d_PrivateKey_bio

X509_set_pubkey

X509_set_pubkey

X509_REQ_set_pubkey

X509_REQ_set_pubkey

PEM_write_bio_PKCS8PrivateKey

PEM_write_bio_PKCS8PrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_PrivateKey

EVP_PKEY_type

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_free

EVP_PKEY_assign

EVP_PKEY_assign

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSL.pas

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSL.pas

C:\Builds\TP\indysockets\lib\Protocols\IdHTTP.pas

C:\Builds\TP\indysockets\lib\Protocols\IdHTTP.pas

application/x-www-form-urlencoded

application/x-www-form-urlencoded

HTTP/1.0 200 OK

HTTP/1.0 200 OK

HTTP/

HTTP/

\Software\Microsoft\Windows\CurrentVersion\Internet Settings

\Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

http=

https=

https=

SWITCH.IE

SWITCH.IE

SWITCH.OPERA

SWITCH.OPERA

\Opera\Opera\profile\opera6.ini

\Opera\Opera\profile\opera6.ini

\Opera\Opera\operaprefs.ini

\Opera\Opera\operaprefs.ini

Use HTTP

Use HTTP

Use HTTPS

Use HTTPS

Use FTP

Use FTP

HTTP server

HTTP server

HTTPS server

HTTPS server

FTP server

FTP server

FireFoxPath

FireFoxPath

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

PathToExe

Software\Firefox Plus

Software\Firefox Plus

\Firefox Plus.exe

\Firefox Plus.exe

SWITCH.FF

SWITCH.FF

-silent -nosplash -chrome "chrome://hideip/content/hideip.xul?clear"

-silent -nosplash -chrome "chrome://hideip/content/hideip.xul?clear"

-silent -nosplash -chrome "chrome://hideip/content/hideip.xul?ssl=&proxy=

-silent -nosplash -chrome "chrome://hideip/content/hideip.xul?ssl=&proxy=

&port=

&port=

ffextension.xpi"

ffextension.xpi"

MozillaUIWindowClass

MozillaUIWindowClass

FindFirstUrlCacheEntry

FindFirstUrlCacheEntry

FindNextUrlCacheEntry

FindNextUrlCacheEntry

-silent -nosplash -chrome "chrome://hideip/content/hideip.xul?cc"

-silent -nosplash -chrome "chrome://hideip/content/hideip.xul?cc"

URL.GetInfo

URL.GetInfo

ActionClientItem%d

ActionClientItem%d

MSGBox.TrialUSOnly

MSGBox.TrialUSOnly

URL.FlagPath

URL.FlagPath

URL.MapMask

URL.MapMask

res\map.tpl

res\map.tpl

MSGBox.FFUninstalled

MSGBox.FFUninstalled

MSGBox.FFPath

MSGBox.FFPath

Choose Firefox Path

Choose Firefox Path

MSGBox.FFRestart

MSGBox.FFRestart

URL.CheckIP

URL.CheckIP

MSGBox.CHKNET

MSGBox.CHKNET

MSGBox_ACTIONFAST

MSGBox_ACTIONFAST

URL.LocalFlagPath

URL.LocalFlagPath

FLSMsg.Hiding

FLSMsg.Hiding

FLSMsg.Ready

FLSMsg.Ready

Reg.Text_3

Reg.Text_3

FLSMsg.Reg

FLSMsg.Reg

Reg.Text_2

Reg.Text_2

UnReg.Txt

UnReg.Txt

FLSMsg.Verifing

FLSMsg.Verifing

FFEXT.INSTALLED

FFEXT.INSTALLED

MSGBox.CloseNotify

MSGBox.CloseNotify

FLS.Background

FLS.Background

FLS.Logo

FLS.Logo

APP.Name

APP.Name

res\hideip.dat

res\hideip.dat

FLS.Width

FLS.Width

FLS.Height

FLS.Height

Portable Network Graphics

Portable Network Graphics

Kernel32.dll

Kernel32.dll

Open SSL Support DLL Delphi and C Builder interface

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

hXXp://VVV.indyproject.org/

1993 - 2009

1993 - 2009

SP_KEY

SP_KEY

pUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

pUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

Unsupported operation.

Unsupported operation.

DThis authentication method is already registered with class name %s.KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

DThis authentication method is already registered with class name %s.KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

Could not load certificate.#Could not load key, check password.

SSL status: "%s"

SSL status: "%s"

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Reply Code is not valid: %s

Reply Code is not valid: %s

Reply Code already exists: %s

Reply Code already exists: %s

Unknown Protocol(Request method requires HTTP version 1.1

Unknown Protocol(Request method requires HTTP version 1.1

"Not enough data in buffer. (%d/%d)

"Not enough data in buffer. (%d/%d)

File "%s" not found

File "%s" not found

Object type not supported.

Object type not supported.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Command not supported.

Address type not supported."%d: Circular links are not allowed

Address type not supported."%d: Circular links are not allowed

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation now in progress.

Operation now in progress.

Operation already in progress.

Operation already in progress.

Socket operation on non-socket.

Socket operation on non-socket.

Protocol not supported.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Protocol family not supported.0Address family not supported by protocol family.

-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Resolving hostname %s.

Connecting to %s.

Connecting to %s.

Socket Error # %d

Socket Error # %d

Operation would block.

Operation would block.

Rename to %s failed4Failed attempting to retrieve time zone information.

Rename to %s failed4Failed attempting to retrieve time zone information.

jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.

jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.

Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.oThe "Portable Network Graphics" could not be created because invalid image type parameters have being provided.

Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.oThe "Portable Network Graphics" could not be created because invalid image type parameters have being provided.

JPEG error #%d

JPEG error #%d

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid.

The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.

This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

DCOM not installed"'%s' is not a valid property value

DCOM not installed"'%s' is not a valid property value

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s=Error decoding URL style (%%XX) encoded string at position ÑInvalid URL encoded character (%s) at position %d

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s=Error decoding URL style (%%XX) encoded string at position ÑInvalid URL encoded character (%s) at position %d

UTF-7"PageControl must first be assigned"%s requires Windows Vista or later %s requires themes to be enabled

UTF-7"PageControl must first be assigned"%s requires Windows Vista or later %s requires themes to be enabled

Button%d

Button%d

RadioButton%d

RadioButton%d

Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d

Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d

ExpandMError loading previously saved settings file: %s

ExpandMError loading previously saved settings file: %s

%s does not allow hiding

%s does not allow hiding

Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count

Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count

Invalid clipboard format Clipboard does not support Icons

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard: %s

Cannot open clipboard: %s

Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.eCannot assign a subitem to an actionbar when one of it's parent's is already assigned to an actionbar$Item %s has subitems, delete anyway?'You are not allowed to delete this item"Item %s is not allowed to be moved

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.eCannot assign a subitem to an actionbar when one of it's parent's is already assigned to an actionbar$Item %s has subitems, delete anyway?'You are not allowed to delete this item"Item %s is not allowed to be moved

Value must be between %d and %d

Value must be between %d and %d

Invalid input value7Invalid input value. Use escape key to abandon changes

Invalid input value7Invalid input value. Use escape key to abandon changes

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

%s property out of range

%s property out of range

Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Unsupported clipboard format

Unsupported clipboard format

Unable to Replace ImagerLow surrogate char without a preceding high surrogate char at index: %d. Check that the string is encoded properly

Unable to Replace ImagerLow surrogate char without a preceding high surrogate char at index: %d. Check that the string is encoded properly

Invalid Timeout value: %s

Invalid Timeout value: %s

''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value

''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value

''%s'' is not a valid time

''%s'' is not a valid time

No help found for %s0Tab position incompatible with current tab style0Tab style incompatible with current tab position

No help found for %s0Tab position incompatible with current tab style0Tab style incompatible with current tab position

Thread creation error: %s

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

The specified path is too long The specified path was not found The path format is not supported The specified file was not found$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and

The specified path is too long The specified path was not found The path format is not supported The specified file was not found$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and

List capacity out of bounds (%d)

List capacity out of bounds (%d)

List count out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Error reading %s%s%s: %s

Error reading %s%s%s: %s

Failed to create key %s

Failed to create key %s

Failed to get data for '%s'

Failed to get data for '%s'

Failed to set data for '%s'

Failed to set data for '%s'

Resource %s not found

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Property %s does not exist

ECheckSynchronize called from thread $%x, which is NOT the main thread

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot create file "%s". %s

Cannot open file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Unable to write to %s

Invalid file name - %s

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s'

Invalid data type for '%s'

Invalid destination array"Character index out of bounds (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid destination index (%d)

Ancestor for '%s' not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Cannot assign a %s to a %s

Operation not supported

Operation not supported

External exception %x

External exception %x

Interface not supported

Interface not supported

Object lock not owned(Monitor support function not initialized

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

System Error. Code: %d.

Invalid variant operation

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Invalid pointer operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

No argument for format '%s'"Variant method calls not supported

('%s' is not a valid floating point value

('%s' is not a valid floating point value

'%s' is not a valid GUID value

'%s' is not a valid GUID value

I/O error %d

I/O error %d

Integer overflow Invalid floating point operation

Integer overflow Invalid floating point operation

FreeHideIP.Com

FreeHideIP.Com

4.0.1.6

4.0.1.6

IEXPLORE.EXE_3272:

.text

.text

`.data

`.data

.idata

.idata

.rsrc

.rsrc

@.reloc

@.reloc

u\j.Xf9

u\j.Xf9

j.Xf9

j.Xf9

USER32.dll

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

IEFRAME.dll

SHELL32.dll

SHELL32.dll

iexplore.pdb

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

name="Microsoft.InternetExplorer"

name="Microsoft.InternetExplorer"

true

true

KEYW

KEYW

.ENNNG.

.ENNNG.

a.ry.v

a.ry.v

l.igM4

l.igM4

?1%SGf

?1%SGf

xh.JW^

xh.JW^

.97777"7" " " !

.97777"7" " " !

3.... ))

3.... ))

8888888888888

8888888888888

8888888888

8888888888

.lPV)

.lPV)

úW1

úW1

.ApX/

.ApX/

H.ZAf

H.ZAf

ð[U

ð[U

%s!FK

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

888777777

Y.hilkRROMLK=C,

Y.hilkRROMLK=C,

..(((($$

..(((($$

3...((((%

3...((((%

3....(.''$

3....(.''$

3.2...((((%

3.2...((((%

33.2....(,'

33.2....(,'

55323222...

55323222...

(%&'00443445?

(%&'00443445?

00.,,,4(

00.,,,4(

000.,,9(

000.,,9(

0020..9(

0020..9(

003200;(

003200;(

(#'( (''''!'!

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

Kernel32.dll

"%s" %s

"%s" %s

kernel32.dll

kernel32.dll

IEXPLORE.EXE

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

{00000000-0000-0000-0000-000000000000}

\\?\Volume

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Frame_URLEntered

Imaging_CreateWebPagePreview

Imaging_CreateWebPagePreview

WS_ExecuteQuery

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

Windows

10.00.9200.16521

10.00.9200.16521

firefox.exe_780:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

hXXps://crash-reports.mozilla.com/submit?id={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&version=29.0.1&buildid=20140506152807

hXXps://crash-reports.mozilla.com/submit?id={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&version=29.0.1&buildid=20140506152807

{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

20140506152807

20140506152807

29.0.1

29.0.1

Firefox

Firefox

Mozilla

Mozilla

Couldn't read application.ini

Couldn't read application.ini

Couldn't set %s.

Couldn't set %s.

XUL_APP_FILE=%s

XUL_APP_FILE=%s

application.ini path not recognized: '%s'

application.ini path not recognized: '%s'

Incorrect number of arguments passed to -app

Incorrect number of arguments passed to -app

Invalid path found: '%s'

Invalid path found: '%s'

Could not find the Mozilla runtime.

Could not find the Mozilla runtime.

xul.dll

xul.dll

.gtest

.gtest

dependentlibs.list

dependentlibs.list

\dependentlibs.list

\dependentlibs.list

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb

KERNEL32.dll

KERNEL32.dll

_amsg_exit

_amsg_exit

MSVCR100.dll

MSVCR100.dll

mozglue.dll

mozglue.dll

_crt_debugger_hook

_crt_debugger_hook

l8%Ul

l8%Ul

version="1.0.0.0"

version="1.0.0.0"

name="Firefox"

name="Firefox"

Firefox

Firefox

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

f^.mHuQ8

f^.mHuQ8

.KscP

.KscP

yy.QG

yy.QG

c"=Ýp

c"=Ýp

.CE&I8

.CE&I8

%d>ZZ

%d>ZZ

\LMQ!)%C

\LMQ!)%C

Wuser32.dll

Wuser32.dll

kernel32.dll

kernel32.dll

Firefox and Mozilla Developers; available under the MPL 2 license.

Firefox and Mozilla Developers; available under the MPL 2 license.

Mozilla Corporation

Mozilla Corporation

Firefox is a Trademark of The Mozilla Foundation.

Firefox is a Trademark of The Mozilla Foundation.

firefox.exe

firefox.exe